Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-02-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
aca80be2750865e42aa6a95c2324a96c.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aca80be2750865e42aa6a95c2324a96c.html
Resource
win10v2004-20240226-en
General
-
Target
aca80be2750865e42aa6a95c2324a96c.html
-
Size
44KB
-
MD5
aca80be2750865e42aa6a95c2324a96c
-
SHA1
a9804956d6efc38c5049c9673461315ccdcef1f8
-
SHA256
789f761accbeb2b9586467363ebd472a41cb8b69eb8f72ca6e3d625be48d2b3f
-
SHA512
ad28a802b77ec080c7ea0e5571baf778814c06b6bd8d2d8f8be88d4fb54c75498652d7e4196ee6a046aaafbe4dfc93c7a7fbcb303b93d2dadb119d06dbd313a2
-
SSDEEP
768:tpsMx5yXfS8nlerLrGGXjj33kaonBirEfraoFfFxnxtkMF6A1WU4cEXSeBNu77Xh:tpsMx5yXfS8nlerLrGGXjj33kaonBira
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415310097" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000eca53d3966b7b2e46c7195c8ae5616d7746d4a4694b2ad4fdca97554b85c7071000000000e80000000020000200000005d1edc1efcd1d69893875255be0aef5670f077b835af3df06f3f86db655d21be200000008aa680a436193087fbfde9dfcbb9c4a3513ece420436c8ab991216e7aa1e501940000000b02170c21268087c2ed70c320b061ab998d5b223e4e283d080fa25cf8f9c8d7ee613a73502b46cf18936b5d6574f3cd1b34b0d569b6c62915a937dcb9a9b2e38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000aff19834ea35cb1bc26e3b0d5e6cf54d096cf2eab8aad40d7099f910124f6e2b000000000e80000000020000200000002d18252e056c046db2f14b661198a9a073323e0d0b07e22d2ae081d1b610b35090000000467d60bf61c90c0605e227644b00c6f946fda4a5bf352a077f41abe5b30b6f41d7c3583cb589165a564a774e441991d0b3dff936f43276598236bbb4ad61116c45be3c6578cfb32c3d918d6b7b750c0248066feeeee38ac779e8fa631b47f2a964a1e5c1b83eaac0182008fa6853bd8048d8011ff06f89f827a3ff019a01eb4288e18df1a251662a537ea372417c31f3400000006a0ed6b434fbe0a478779197bb883dd24106c25f8dbd239a7500561face0ed05344ed02ccc152c9cf43a0a051b39e146ebb32afcd58e951cec5f7427f32bf580 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4024f1ab7b6ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E518C341-D66E-11EE-9667-569FD5A164C1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2772 iexplore.exe 2772 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 1612 2772 iexplore.exe 28 PID 2772 wrote to memory of 1612 2772 iexplore.exe 28 PID 2772 wrote to memory of 1612 2772 iexplore.exe 28 PID 2772 wrote to memory of 1612 2772 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aca80be2750865e42aa6a95c2324a96c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9c4d88114a7d942f4fd139f47db114
SHA140c9682f803c206fb99275b4384b1aa6ec56651e
SHA256a5b816957792fe27c703b41afcf35e6dded76b3a65cfd1e748e4aab8e407b3d3
SHA512b916515847b777c5ab67a397ea0b25c9f4e03218d840253a77896bb4e7dbd5ef7f2bb58469cdee557b144a5b4383f07258f7148fcd5aa2fd728a061a06c972b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539cf26aef84188598f026d2ce34ff052
SHA193537043657d5329801845d65eb690eeb9eb2249
SHA25694f946625ad02d4d39fe2207f7b9b142c0e5a23ca33684e2cc147d7c6d01f9cd
SHA512d1e53e422245a4e45be80e5ffe53bbde34009a09eb312a87af607b9d0bf4ec5606efa38f8bd3f3d5d6ee1adacaac2f56833b70e69351723a515f1711182e3d37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bc619191725257e71374599a945b12b
SHA1ca2eddbafbdb0a569ffd23b90a504ba21fdf95d2
SHA256fac30959f63ab22d383577ba27d02c96b3925ee14d5338e846fe2c725217d78a
SHA512565a882decb320d2b6c38ddc8b8481c96479adc85a9c1ffd64e3a1f485f4ea798badb07fc6157ae0f65142035dee60e04f98c8a10edabedcdf8512bd9375a6f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547c7adcd299d95e173ed4fbd8b35bf15
SHA1ab704073de5bf5829ae97faa3074e7ed7b0dad4a
SHA256fff2090c39c6e05f875ea497a4fc0912891c49b1d55980eaf93f945e7a1f0a9e
SHA512074c5e9ce459ee27cc73ad559355a2249f573d022349b903ba1b423244288e60c3768a9b53c4b154a24e5bf19e599c9232c222282dfc7f8ee4982ffac288607f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561bda9fa583e15cdea59da04871e428d
SHA193e7ade3cc4cd26f6394653ce994f17246384f23
SHA256799730ebfd7878ef02714a529c8040703cf49a4fec4f8a1e5e3948bad9347bc6
SHA512f3656734dbe2af33a818c84533444aa8bcb5efc3c58d8ed7b825b57fe29efba220761c4ce797ce623eecaa8a0e86c051b31abae995319dd20e222a16f1f55c27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfd5603e634658b3eba61d59e4ab9c11
SHA1387ae8033ee30a050e57fa684f0a7d7d43dab977
SHA25619176096e7dcb34e255ef82d4697177266eb815560677d18d26d088abee0af7e
SHA512e0c663a9e213f61ebde0bab1056df89ea123d54c117c872116c22a9b304adc275cd8746e8b9c3f4f0597fec7be5cc790f94f7c477ccae138abc8b74bef5ef84d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fc9865e0e396575caa4dc3370fe1437
SHA1be0f31c70ff1ca342c2d0e61a7b65e445f95e43b
SHA2564c3a2b2668cda753c2e0031181eff66931eb182db94c3d15b3ea5ee59aeb3d68
SHA5128c0d8ae1a74e136a1262ad24791b62c361f9015e5ad749ba81ac4ac1bef294be780305b88c397eefbe5a8ab058a3aee42788f41941bc27626a5809a0d659b183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a56a4e2ef7d01bc399d2a99786c6b9f8
SHA167a07613cf83213df5dd7f47c726be8cb91a6f0f
SHA256070b8c114ae6b26f0d9e01dac2959fbe152725987e3e01f92f1d1e5958c56c87
SHA5120b8a79318bfb4de09b790632581ad1b3f82b438994e0ddf79510306518bd56e29630b367a9756c445e1d5b5b64da2a3a470bf03fe0ddda7c604194d1b180cd65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5377cdf5c4498bcc04dbdd51da89b6b44
SHA1c2afe293ecd313a9792c05d0e5a4770535fb73d1
SHA2565d9108fba67f6fc60e300b9497919572c2cc65b3311455593b735aa94cc4bae9
SHA51274ed91e8c05ad9a4ea7c3c580e6ded15a1c7ae843f0a6c5c8606020fc1bff9c5f2136b097cb63c809ca393db1a1db8962e626c7006dfd236030725a864e376a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fb8829216ef8c1162a24e7679d56f68
SHA1a0ad2180b1796de4ce9112ae612890efb5485f38
SHA256842674949cf3a0097964f5b1782658022197e886cc2c41d61be5f090a178e171
SHA5124c7c46561e07c14a186fc6660aa020e347beab9dcb2d86774ca45eb096c7dbfd281cf2e1071ee8f9deda7b7449f3f257b2bbea640f796f9238883cee0a0c5d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afa450f35f44ac783f4fce4f995b26ce
SHA1c4e283010a2bbe3e5d72f202a9c52070b461a5c4
SHA256354bf20638601f1745291282f876050cbce72a7ed25332c09efecf092d9e9676
SHA512300f117718ad9685ee3d1f87d2f5c08ba885d30141e27e0415d88d3c954d75f690eee8819008adf5791ea6531e455c3884225ae3516aa735001bdc2e81cb4a0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d4d1a4261b4cc1757e969fd308b8ecf
SHA1451714d377e8df8de00336fb447a595a30da9492
SHA256b3df5385a9212a84efcf8856d0ed34acedb5b586da778bd03f7c4841cea43c49
SHA51249802cbcb9932495ccff7747d7252badee82d43c7c30390b6d07a80db2e1819b9c497cdbf482164ac17a38d61f2d2e35c92d48ad3f265d3dfc778d1e019a8249
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa8971ac9297a9fe9466ec86fb43bf26
SHA1c2dec55666a4fa4eafe187042d93c6e05bff3291
SHA2566cc4b08c118e52737e8bc17780b447ec064162f6777686afdb7d13b7e57d6fb9
SHA5126c61026b68c5fb2ea44ddcd9ed1cf4f4f23092f35ade4877ed19d71e5b1fa9f36ab069b888c874fab8be4a056d8373960234f08145c5f1d6f3b5b8d602326de4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cf04770c02d90f6bb9bdad2587a1447
SHA10cb63e0f0b2bd39e73d2ff5feddb4f28cf943a6a
SHA2565e9f8cdee91d82f95b3b6cde76c2d5804250e467d4e304c1076665c62a7f163e
SHA5120f8251801460f2ffcf04c050c8d87135a0087528c7bc5c5411f8b6447bd782dcc61b698f0907456b11912d65cb091380b32bfef24bd1aab72b654ec4b7c1e11a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d71c165574e120cbe336de9d8744bfdb
SHA12c674a2d009ffd9a76e4ec963272f78d7ba2376d
SHA2563bf54169c994a947b86ccf89700731dc8cd962ac78da2b6ef8798bed836f55c7
SHA5123d3babc4e655081959dce3bcadfc760b4dfe03f3e20c6eebf0016a6edd92a076aa41797cb479ff911cf3d0f8d4ce5667f5d596e1730cd61c7b1a145bbbb327e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d042640a3a93ba6b74f85af55f69c8a
SHA1255121e869f0c6a5564f1f99c79ebd9fd79ac685
SHA256973ccae07faf1730ece93eecddc05c5bdd6161ae05b683919c123d12151402f1
SHA512c57a050533e31cea9cef75d14584cd118346210abe7be469264be05d89def9c3754b56555d85860922421fbc9f422c346d51638be9b8710bee8af3f83a01faab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5857e9befe08acfe964c754a7d57db54f
SHA1db5e26f18ce655d92ab03aa9e4e430c77461ec20
SHA25656f4275ea4727a69b88cc1fa1d4c3168b9d7a8a97f5f9903ca58d5d0094555f7
SHA5122e18befbf8fb39aadae62a5af24782a596a9b8b67696db8f61269256b397bc88cd2ee76e4ea9557ff5188caef9dbe49a16ceddeeecbf26463e92549e682b2d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdac5beb181384562558cde779a8ea46
SHA1b8f7ac045684f40fbd933b5147f24133cbba6f01
SHA256c9c7923c97408da056b3a152581fd9924cf00a2e82ab79464bd0e43cf6be7fb1
SHA51277edb9d82bad75cfd61006c1345069ea31d47bb4f07abd270b52d2a86161cb3fb5273add91c62d63b4d2524be89ff1884cc17ee8d8b0df3d8cb775f295744e2a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63