Analysis
-
max time kernel
122s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
b90ed12ea8abd39769dc252038bfb33f.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b90ed12ea8abd39769dc252038bfb33f.html
Resource
win10v2004-20240226-en
General
-
Target
b90ed12ea8abd39769dc252038bfb33f.html
-
Size
3.5MB
-
MD5
b90ed12ea8abd39769dc252038bfb33f
-
SHA1
e4c673cfe391b0a49fe3035fafdc0437b58765ef
-
SHA256
7d5e83861e190822ee47c540499332c9c6daec47bcea4beaa8b6678b639ba90a
-
SHA512
12ca67f263a512a29f7a5af585805c3323bcabfe0ed6e8070b6b2479c1aca306956cf702410a283718451afacbd93b2dc75b4abc2637298564fa79e36b04e19f
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NID:jvpjte4tT6eD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415986947" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE11E361-DC96-11EE-B7A3-EEF45767FDFF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000dda715713655b4c426496b72e735cfa1cd56f8c70007f435f019d314182c06fa000000000e8000000002000020000000c5280f63d75bc32d7ac6502c6169a17f821b99152721d4da0bc475c3f4d3c70320000000757af7031be37d49189bf4ea7206b37af0604eef32e21d0e281921c672545c65400000008198f41e13ceda33a7b3b4d8664898b5c20dc9a1b1e96ee691d68ee03e90baab3dea69d6e278dfeb60d9c151f0a14ec7325e4d242cb2650ea9469944069ca21a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000009c1a79e3e464eaf491f77cf1771cb1da99c4252036effa008d96521d3e9db1ef000000000e8000000002000020000000755f4fe15bf51c864b49a02451d63654150e66699009a42d5e913b79e90c9bb690000000a554d31f43fdda0f764758ba3a0234b1c19fd611ca341aabe10b291d06e27ddaa24c4cb3ca178d61bcb419f57ba1e0626ac1f8419aa9983b600734e7e6c66e439f9417e18d956da395c6770001ea1bb0bf4bf6bb4fdc26c69bd2f800631e0a1529aa25a67b85b322076ecc3113439940492ebd69556413a9be96e24d52dea1cc0c7a3c0d184d79d3876ee769f88e81f840000000e39d1266444eca5c1cf16402085c0c349a653bccc798550fcb8b238a7a6567d59c5ed44195e52016b0d8197ca762ab93867df0acc421732e5d14e8b60b619c89 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e978cba370da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1416 1948 iexplore.exe 28 PID 1948 wrote to memory of 1416 1948 iexplore.exe 28 PID 1948 wrote to memory of 1416 1948 iexplore.exe 28 PID 1948 wrote to memory of 1416 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b90ed12ea8abd39769dc252038bfb33f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549f13417e60fbd5e641c0e46d5f7fdbf
SHA1a2fed8e91992426e0604829c2a52d00dc78f3f03
SHA2566546dce226323f9000e491568cd922d56fe5c3e93b0e622e846213ac702e8bb5
SHA5124475b474f18a9d4a5d61913e7eb81e147239e17e8290cca993ff9829d07f6779fc41f50488f4836a89b4dd2c1c0180f4ed9dbc7c2273ad7f393c076d0fb25829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fee1a92ed13de17412a53af914c0a67d
SHA1daadc4620255d00e1beba1324db70a6aea45bb0f
SHA25676120ef0cf60d4902e3539d4bb11c7b253901eb64647ac4d7f576f1239ac404d
SHA5125c3649d932e7c18d8fe80cbda024dca460a426fb1d264de2a160dd3f23577b295bf5cca98f7a6752cbd6309711eed6d351d6d8253484bcecd93bbfad4e385536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfc46666211439859d0b8e0ffac5fa98
SHA1f9cf8f858ea6fee1b900887545276764757a3578
SHA2569e24330b373cf7b4a3c3260208557be94833018709d0b4dfff18ee7d520ab380
SHA5124a7142010d07b317cf5514d86a46e798d97c6a3b4c0f30f836e018b92b3f348eb62227687538e2bfa7d5a5d12b882225a678db228e7db789a2c016339c170379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d86b788a01d34166ceb4a08db429333
SHA1394b1c7eff9dd98d3da11da5f90e9b85d314d326
SHA256252c15f300dcc919813a47741a65915b45f41b6dafa27c8b32254d41953b981d
SHA51258fd47101d3ec642c4787a0a403b933b5b01772c339c4c5ed45b583a0ee1bf179b874c45a9f0da9fd18071762735ad12b314cd7bd26546b47ef6634c4e6b4647
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bc37e73e2817ba0c6e5ef05e80f9f89
SHA1860e1d1c9461ee20138e2794a88b67c2e9aea7ed
SHA256353724fe894ce54a031ac854519da32100f7b71147a9ea8f93a2679945d7f9e4
SHA512f3897447d650c37bffbb65a124f18d6353182699946e679c0a76e0cd0bc70bde70b8c7e531d5b90e8783724fbc602661b4efd938e8af1b6a5a73dc7b2461db00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a23eb2375800483f34a4ddd3df46f2c9
SHA1c9479160a115a05214606b4e12ae53bf575936c4
SHA25619ab90ec6de93d7b727805031cab741651e859766cba482109d2d0ed91f62bb6
SHA512e5863532a34d04680fe6c8ae2199b5edd1674e55d3021bce86dcdd58f6add7e7ad5dafe4ead7eb8f690361dea230a387206f500624e3b75f2c494145ab1a90b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569ecc8e814e72ab57df16c9a73e08f26
SHA153a2ea1efe030ba4e4737ff06e4500959d72aab8
SHA2560b447e8337960c8a63527713bf7ce82cd14fe993a39b582c4d04ed1521dd5eea
SHA512b567fb3a5417c1df5285586aaff791e3ca40d4c335ca9af202b1dada46f60e7579e915b4552b59c017f2e023401a1aaa5e419f7baf9eab2148ce3471d5fd6112
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b080b5ce834994e4998781a71ae82448
SHA148587cb7af64847914c93fbd6d621165aa4393d4
SHA2561eee0ce1dfcb7de0aaa560466599b0ab1d977b6be85b2eae13af344b788700fb
SHA5125e65604836019807c06243ca00edd58f8e746179bc4f067946d7c048268b63472d83cc7397220a43466de855e3739cba90b5f9f2ef83b52d13f8cb89875537cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53113101e2bc270f85320d6c5601b6c31
SHA1617d5ec9e13abb3d39937682305310fda74e071b
SHA2567c2e13b11f7fbd073c9e69a928e18e679e563e7ad1b290a7d2b8b8d7c4204790
SHA5126c0aa967ce7ca4f560f8555144266c2101f8d379f9163e223f374f2e9505a65d07696456256e6cf1fb3c339270a8f57e0dd6dffa1d550a924b57298fef9080f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c22d6d6b6d21075546a0f34b06be770
SHA1ff3f752cafe27d4c488129fc986b4c6d5b6544d1
SHA2561572d741eef25a79ee394c7805dd2b4cb731bde66b36e621ba6f406a63d445b4
SHA512857d2f08d7d9f1edc18b2b16619a537f9747e01044922fcdcffa3dfc310245b1ce9abed8bb4d04c0b7ab9cb26349c32c830a2579366a5992ed09dd582496b07f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584d2818ddda75af2da7f59ab63f6b503
SHA1316256d87f26d59ea37f88b8007ca83fa9229a94
SHA2565da951ebf1c39bf1922910299ce95c3c79c578b45185a7d4fc4d2c9cdcd6dcb5
SHA51297919bf6d7ac020a102846cdf6bb167d0ad87233c116b65b137ee98b43adbf8cef720f4124833ee2f2a9d117728cb0b9b93138b60bf4388cf766ab30ac16ed2a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23EIUNT7\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQQVSTWU\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63