Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-02-2024 19:41
Static task
static1
Behavioral task
behavioral1
Sample
acb02a90e26b4e028d35661110fac8e2.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
acb02a90e26b4e028d35661110fac8e2.html
Resource
win10v2004-20240226-en
General
-
Target
acb02a90e26b4e028d35661110fac8e2.html
-
Size
53KB
-
MD5
acb02a90e26b4e028d35661110fac8e2
-
SHA1
ad2f0c23fad93db60138b36cde067897707ecaf2
-
SHA256
e3dff06f5d6d147709d777db453936f76206ef406a88281aa81d387c2afb0d28
-
SHA512
fa7b111bf15ff083e8f673106cf772b586dd03c5a324f90522b35eae97c59718d2d4c6c660c36389e3bcfa7edef74edcf027938bddcbfe33009933e0478f541f
-
SSDEEP
1536:CkgUiIakTqGivi+PyURrunlY763Nj+q5Vy0R0w2AzTICbbeow/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyURrunlY763Nj+qx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50042f267e6ada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c2401d346805655508d9d9b8dd6058e6dc9d296591750ecc6c768409e5015b34000000000e8000000002000020000000d39bce5a7aed492e693707cdf1a322faa5d9f467bf6d50057aeb94f0b674179090000000d5324f7dbd78eb70b3edaa7882594ed7c05ac53e7aebea8aa08c1068c83dcfc2a6efd71e0ad0187abc3f571ca74ff9fe79fc9c4372663451e371763aba964335e66d6bcdd25e9fb30ca4404d76bfa7e9a5f0228548fd2db43df0be362cf592dd0e4af383a704c3da03980d71aa3e2ffa0afa3f46c03c5b8c35c945e071c05702b1dc1b543cda65c4853b7b217e2699b94000000033cdd9b7af9421dbda01d32ac7a3d5696980da1b0c233ea2b3019829eb6e47b5d80ade8120aa42bd8baf5a92a353f9bb713b4f8321ba56179218d1ca6a69d147 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d7d798852ff2f4d4b69c533864b6a42344cfe0f13db17f27fa30e15f1e449e99000000000e80000000020000200000007fc3bf5478c43aa953f77566d740237726a0ab3393f7c623726153136fdc703720000000f5f8fb59b17fb9a65362685f15f0a11f34ef6bc0647ae538f5612d67a199e3f240000000e36465695ee8fc1fc7c812e3436dab2869eeb33660341003309263a4b8a3d78a9ea5d08c8ea76cb150e2844d759e17f524e53edcf230eeb768d9aef48db44824 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5032A181-D671-11EE-989B-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415311136" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2876 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2876 iexplore.exe 2876 iexplore.exe 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2812 2876 iexplore.exe 28 PID 2876 wrote to memory of 2812 2876 iexplore.exe 28 PID 2876 wrote to memory of 2812 2876 iexplore.exe 28 PID 2876 wrote to memory of 2812 2876 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acb02a90e26b4e028d35661110fac8e2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54730e34bbddd4b6e017a1528a180832a
SHA11fb3dfed93b415e72d6a48c620011b7e12659dad
SHA2569984fa505c6219946a4817480099b97e28900f7b4fbf291f9996b7c46d51c297
SHA51238a70dadcb164a7fd401ec29efe0f57d080adfc85af4c61af92477cf1cb2c505422aff03f3e0bd7ad3af40841e0ffea80a9eb07550e3cfe6a8d8aa2cf5e31aa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52968b59220a72d9f415f2fa3530bbda8
SHA173dd13e2beaba589f7ed0cce2c0d154d0100b811
SHA2564a20c8a93b39ce4ad6f66494fe96e3561031a77ffcdab75ba438a71efb1b0cd1
SHA5123899efd88a584520d82fc168cc54fc478581a252be13bd8cdc59d2d7dbe4c05ffe5686b9477129721a04d1a826ca493b697cb163e0081da45e2ba87189d860e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5307bc98f6f76ed39c182e13c7d0027d2
SHA1ad5e0285b3c86a3b0c41481d3db515a05a4ff123
SHA2568fa5285b5ede82de5a230e2343d123cde1f43e887544a02e04ae7399db9a3e61
SHA512ad73c0d12b3077c013c22395d020cd508005e5ca793ee9e24b9740338504b2efa59bdf5d8f0d31859c1f2ef782aeb7e363ed545fc1f13a745eaab3309a1c2ac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574c77a17957b4cf82f9e90a71a31f15f
SHA1c14224a94ea25ad9b816e1384b0bc7113911d93c
SHA256f2b204b028a9f3c39ffb23cd26c3d0e065ab80864a3e8fcf040ac6b5dc728f7e
SHA512e1c32df71843233e05f330598d804d1b9e784de85b4402b23c66a86cc61e281eea8f9fdfb10e7528b108b2ba48a1305d7998d4ebfdb7c5b1b7deac21a7acb870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa8d347fce3c2f893a1c5c9c0b390fae
SHA1de7a7756e1d6c2f82d5f9456b2766d84d30ced87
SHA2567b6fe0671f5d693616795c5325af48401b59219789cd06988cbbc92f5010579c
SHA512d6cea9aea4e657009063f4bbe125e6a34c21f94ea3674bd5aea1a51b3528a248afd447af28fbc3558af6802beb43360fc9044d65d205bd119c5b2e75a6f4d3ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bd9aff35597713e47349e26b6ef9a18
SHA176b69099536544cf9ea0fb1ab026184360ad1a41
SHA25691c310114da8807254fd87efad6532a9ec05ce7f2491a4423eb1aaa11c5cf4b2
SHA512ee5b1955272b177daaa14df5d9df4a4cf64d9dd1209e16da5bd4bf0382d23a35437a93e415412d8b8cbba1c88d2a18e0c5304a29d181cc92dd6b8af139e17578
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7f71cd41419ae7769d9a9859f46a95b
SHA177e2e18c0515eae44d1b29337f8b70b645279f38
SHA25630db35154efbb1dc8c7b7f6447446a61abc0e41cd54fadd6775bd0df14059bbf
SHA512e44b57206277f8488eaa2f0efd7c7b11b50ccb1ba77b1c5b541099f1b4a1f08152c9e31dc1fbec7e760be241db4ef5c217c292c1b80f6895474c94eb78855dd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc1ad1de3f1f0fccc99ebd6be207900
SHA1e437ebfbb3631d4ae727d9a9c54b58f609f2e4c6
SHA25680ca6006cc81cde5866503614d9e9a19f6c0997e22d68701606c306bf3443d5e
SHA512cc6311630e7fc77cc21183bc7dac32a39c08352ff3360b9709deb1e5800c33aa6996db1c5f3fdcb32c268b07ec10589629642c6dbbe0fa82279989d21e4b7fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c8647e8d50dd15e62935f83ae7a65f7
SHA1ab7296095fd3ee60c75cc2e4aa28865735a651da
SHA256f5a8384cffeec856fa5282107cee3c50d42efdb8fba988c6a2ed9d00de5cf669
SHA5129d540b1ddc9d82d32b8470bf189e858681f3d3d32f9fe4adc6019f091aa6a2599c8f460de27d86e1503f73a4d8598c7ae6619296df3168a3260cbe6bb0ca59c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1aea8b3a0fd32b3fd80439fe7c756cb
SHA1ad63100aa24e4b55979d0cde872f1ca144d2271a
SHA2567649c07142e7f275247f0dbf1462c8b9ebee3ba977fb761f032093cb6c22a648
SHA51214d9f58f1f95974a85db4dd9073a92fe419cdbc9d3a9e20b00c41c6a53bf339d0f266d77c8e1e19271fd9676ddce2e38bcfe0fbecd4ce7d185d7457afbf31452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db68fc19938f45bc8fefa7f774ec46ba
SHA18c75b705bb56b622c931ef542c093594c00e4c71
SHA256573afd8c01fe6194c5b69bbb68b8ab7d2dc97cc013f9a2d19d748e362984f6fe
SHA512da6addb9b8652b4181ac97595f3516da137355dd8cbe0fc35cd740e47f3b737e19c02cf89f17de669ef7b5af04ed5fd8e262ecc8bab7a01dffd87891449ed320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c13a9c9970aa18de7a00376a69523895
SHA1c1df814451a584907de453f68479fd3f1516ca82
SHA25604d5d8b57c7ba488c6a19df7b700670184b108023e6974c32bf68d3c932a1065
SHA512d7328b39ff719246fc0e2947694ece955e53088b35173c84cc8ac82b734778296678255ec34ac9499c5d34eed6bbf8a484fa2845c8a89d977585db61b2f136cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5c917ecb0df20c6f640b4f43c6590f
SHA1bd579d51b4e767ca24b7e3db77b135400a8bfb11
SHA256dc575ae414a087d93102dad621785a9ac262949944d13701cddb370176f59f07
SHA512a3519d8cdb9f3306ef4301b6782d2f9af101632ecc4e2183d3e9bf434ea157775b5e72b50fb22c9c6e332565bfc5a9ae46d56139d2b21e72457f11f9ccc85d33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568f494771fe82cea876ab579a6495279
SHA1bd9763b87b925048f000d42fac5fc7b061145c48
SHA2566e0a69731db3d213b324d545639a7fd74f39ce7e7b763449c73c87baf0bf6f80
SHA512997336174a6a828e6756977b74548fe320dba95a9bd952a413201b8b763f7fd5518131f5d9b5f8eb5e53ea736b1b0439cd82b478c87235583b78bd9819c06929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2459d41bec44211f1df3311aece7337
SHA1cb33ec50cbe21f8772245e98a1b7ad1ce928640c
SHA2563aa54f1dd3fef8f5bab29546b53e77b1f30e82b3c7b049619d5d567339846579
SHA51287dc32b1c2e55e161b56ab7fb0f2a66f628411eba4fdd8d4f492d84f17887723499a511dc1ca72621077f503058f4d274cf433e0145274895383cc9630470a3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3ac7fa7ea85e743d6ad5597473df7bf
SHA10d57dce5e48f333d4528bd9ef07498e4ead84067
SHA256e8823be52a82d53a61b53893b4bd08bb8967140e1df73b91bb65768150f563c4
SHA5125edde46921171b957822718114c1596913c467d766d35ab5746678da503716336516a1ff04dd1afc4350d1bbc9bbdf312c1fde221b819f12ae7f2b9e29483813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56471048423be52f970ac5e8cb38e5965
SHA113356527cbd7ce192ffedcb0a05c9801d80c1469
SHA256b0077e5fed45d70683617ca8778ceed03065ff9378dfc27d0f7ec81425a00889
SHA512099c2870f871eb516187e08b7a279cd250ac31934f41b4cc94174845c568d0b7e148cae3ca84fa349c7e454d2aa7f3ade42b44f233ee1afe3626c342883084b7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63