Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
ba1dbb9239593052976daf73dee682b0.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ba1dbb9239593052976daf73dee682b0.html
Resource
win10v2004-20240226-en
General
-
Target
ba1dbb9239593052976daf73dee682b0.html
-
Size
37KB
-
MD5
ba1dbb9239593052976daf73dee682b0
-
SHA1
c2c7f1bf9df1e130e4d96f3b497989c4a5df9453
-
SHA256
deae0e541bf9de595a06140e5c87e2379d1cc60db112c3d2412e67bbf6861ef4
-
SHA512
5c6603b3553992cb249e9e2b598c42e7fa52f252037480b70f51a54422b9ef7055f8027d9599c5c3776a85f1208e4c1ce8fe853fb03dd1e9466393daea573a89
-
SSDEEP
384:SIeJ8IKJmsCyp4ZUVJU3Jk+WTTip2yeHip2SXr9+isU8c:SKVsWU3RWT96Ngc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000c4d33c8a97982a1148b778dc4bcba35ebf732f291c6ee41940c344f38fe4f027000000000e80000000020000200000007d72c6257fd646768e35e53980049c9c56107ab2173b81f1d8668537a1dccca620000000687e8a53c0062b221abac19fd4fb14f3acc19f5823a259c3f5de3c556e4eeaa9400000005aa08258debc005f95d5c9994ed6aea183fc299722eb4b398a9fec26570ca04ecaca956e373a8edbc971f966417132bcdfc152551d0e01e413816a423f6a54d0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000007d5380a99f86aed2ec2fac06691df48a7c2110d67ce1fa2228da12dc77d6cdb8000000000e80000000020000200000005df42b8cde264be64f47eedaa2177176d91d36a7ea1da78ac6b4e3ff23765b60900000005b5f1f2222066f9b8c732b126ee089ba7fa7eb68c8da9bea111a687bacaf06a641c1cca7ce5cc8547de85fe8415db056ed6fd95f00528df609112d9b8b8e24eb5dd0bcdaab6868c5722b0a602dc1e7eaa9923f88c85398a720d078359e25c81ebd8309212ad7f14057cfe43de67a9f3a2189e7d64bb755dfa3b9fb691e248f5df9ad7fded206f8f6fb389450deb8248840000000088387a226668b9afc623839abead1f285223860a8beb59e84800b585dbed4bdbd7ee24e46b1817406378814836e0706cd03d3135cf8c524e5d4c96f987e6915 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF595AE1-DCE6-11EE-877D-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00198b6f370da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416021332" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 320 iexplore.exe 320 iexplore.exe 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE 2524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 320 wrote to memory of 2524 320 iexplore.exe 28 PID 320 wrote to memory of 2524 320 iexplore.exe 28 PID 320 wrote to memory of 2524 320 iexplore.exe 28 PID 320 wrote to memory of 2524 320 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba1dbb9239593052976daf73dee682b0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0aac4ccab8ca232d7d1fb5924399e5d
SHA1011dab712955038f7be4336165134baa1fd6f373
SHA256296ed9d821c63dbe54ef2e97a70bd0d94b6cd838e65d4b2804e063901e738269
SHA512a93991f5dc8c136114b9a88abc11c31cfcc3b90850b3da311844a296155012f75e619983bd6fadc3730f38926a8b0e103e8936a93394096492f766e5f224f96a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab08fc2e5533305036dd43edd062e086
SHA11ed8be291066b6c1d0940508b9d5412e1e6dd22c
SHA256515af8567a1e6b2ad1c7b1478002c51d568029820817c6db440aa1d396dc32d4
SHA5125c31f27822d2f0d8df885f1cf5696631f5d748c6225195a3bf6f2032e7061ef7c17eb20d8358017e0013a0645ed8303a5211b30ac247eae576e56b8798f9f73c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c1ca00cf2b19dbe9a082662247e6b74
SHA13566f2bc6d83fca977870595d839342b3e148e0a
SHA25687c387ea805c3e4e6fb21992c4d7eef3a0adfa476300857a560a18fbd1c8295f
SHA512544fc494c61dbddaebe02e4a6085ada6a2115746f9a1fb2961c65a83a3e73a4bd2040b98911d9d46e4f428a0a03cbe128fdef5852f5828ffce7a5a499f531183
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5543f44757faa0cac9121db6b8cda2ced
SHA1d9286d9fa50769e3b5b1b9e50b16967748335410
SHA2562743801fb66e4ab743caa5501ac4dbb50d1b40a6a4831247847bf7dbb9f482e0
SHA5127f53896d1660c8164ccf0a1754d3b6f8338d3e9badc5d8584053093675e2bb5ab2418a6384f9f1e14d967bcc3bfe2580f3cf7c860bbfc2c0d755064e50f884e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52550b4827cc45b0837d35a7c2e9ffdb3
SHA1062266b0516d0c32edf3d4f827b0de76d69f56da
SHA256bf14cb0dbc54e201116d5075ef45bbb1ac204f45f98cf6bcfbaa0117642c6490
SHA512109789b1d95b5cbd987f039f8302d6edab9df051b9ac5121a4737cece1500afb44454fda627a643dfc54ada30823607dc6486b0a5052617640cce6d4d886e6c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f12076f8711923661a2b2458d04e1f
SHA149edd9a98a02a5a1f6f7013553116394bb5de196
SHA256b9f9fd16c43641feabc91a17286fdc1b6729893a2c314ba0ada071a62dd56c35
SHA51277e682c0dbf39c3f9a3eb16cc99cdf636e93c4541401aaeb183ec82bc05a6286c92c196956339f5f295ee1763c22ca49cc6cf72a82a5a7e0880db7d5b92d1df1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c694a6d5e4b175d4bce75cdc3c2f93
SHA19ec5bee1950ab91dea54558a7f1f79365b932526
SHA256484cf005ec9464330c98bd17e7db5acefa1cc7e3bb3b0af79ea7793905542775
SHA512b86e99f4f1315633cf9cdd429ebe07172d32e7eb52e8caf080394b2c4b7bac8b2392c30a84ccfcedd2df6e4743dddfd53bbc4e7ab0877b0dc02b1cb8cfd1bae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dcb385b21bb5143b762f3cce9a72f44
SHA1f0eab9ff291703ad2dbdb5e8d094f9aa821c28e6
SHA25647ecc0fae0a559d67fed14dddec8150548f0d4c5c85fab7fe9b22ce3f7c2b3a3
SHA512b8af332fdb12bbaa3302b2a314cc32e5bc726f23aa4a0a5fab3cb521dc9effd4150bc430eb3756160d240b73cc4d0bc23b09c3a8ab92e528c190e23b46c37fcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2170ec04e6e5fdc2ec3b378b15304c3
SHA1f4acb9a9fa9844cdcf7125bffe4c9fb5b65a96d8
SHA256c340025e077d2fb99d589c8df5e7f43efaf7a656e65c956d3173f9bc8e88bffd
SHA512445e411a09fe509707d91f8d9dd5ce6f8f97b75e7c419033dcb86f1b5212f0d848190cf63cc0d8e78aae24acf3c732ad0a8255b408a3f6e5a1c674231e8e263a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53182a226e7c5a17d03d57eee254ee0ae
SHA1af9757a05f1005cc6bc05bd4e55eaa44bc843db6
SHA256ea52c5ff754a443c91928209151fcd58cbeaaebb1c74eea4acca16af90bd7eb2
SHA5122b19fcffa53f28fdfbe0ada7a9ae9a7568f4984642765ddd3ebb8dfb9becdd64abe8b3aaf4778f3271dd5ee2b90dd60e0cf294c6e83e0e38d77f8a7ba4a45ccf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfa86d9d8cb4e28ae3ebab5e38f46019
SHA1815329a2204c2a2e628d72346c47f9efbe684bb3
SHA25676288b0398b5938f482173ec9fd75c2cdbc0f7b35bb2bfd09524f2bc99537de9
SHA512a4aa1df335d3dc233ef481d6241357045b12bf5466dc589192741b0c67a30919fa90446dacb9eb9d9f204b6058b5655069be18c8f7f32c280808b99337a7c9ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5b3d2b669957dd2874b7d882fd2b5d
SHA1e1479a7b80957338501f1da7debc8f8831c433d7
SHA2564d2fcd9b9835e6452ec93a3a6d2b1e1f5d6e0e08fed536fa3601ccbed387f5a5
SHA512d0880b3aef45f335ddd7fe75ad116d8568ae5b2fb0bb67bd5951ac0b7357fdf71f1542b15679ae76d0b372a152f8547fe9d87880f0744cf01b6b27e08d7677fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c413c9c8a1fef4ca8466aa364dd0ecd
SHA198b9aecab9b4570fc49806a20446749f78080740
SHA25654b63674532c11f66ca8e68c52839bd6c6706179a9498b47bf7de319366f715b
SHA512d66c25e311ecebbaeec6886eff57b720499958ca5116d4858cd92e16f7a3a198f2dcf5e428403cab2c316d6192eadae2058fd4dab608fffb7145cdd4dac30fca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c56ffaebfd78c3bac99792eaf7d9c96
SHA10ba70920db4146a43ea370c719051a1c291aeb04
SHA2569da49c7f7e43bee4e1dfaa7d30db619b7377facb412331536a8e0a9d0e7f739d
SHA512836a1900ed0bf7076b11306150c764d7e82416b34a6f097d7b921bf1bb50cc12a56fffed381649428a8b0e65f999b138a6519a7aac35174ccfec7dcc339b39d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553b2e073a1a60ba1523ee48698a95001
SHA1ec0f04ba7e57ed16562de5e7abd42d0e32bc11d5
SHA256762085c919f9484f184e010c4e0f5ef800b8da83b0042d38668fbf0fdeff68c4
SHA512596ec6962cd2e58ee82a0c3e62b89c9cc0f112785370c56ce004ee5781e583d94f795f4d5c0aec4b46993507543039f1123e45166a06d01e0fd58097161c4a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577b25b5198b9fe35232873206d382a3e
SHA1d50f8bd4071ab9f671fa78213243ebd78cec132b
SHA256e75d82a32c30efb52316c272384e7b80a08ca08ad773eedb453c624f5db23de9
SHA5129c7e96d8cae84e42ed76899f5fc8876895675d96e7cd06b0703e5e89a4ceb37b56177a9f92b99fe2538cfa3bc2d379f38782a9cfdf5e9991e9d21842dcdef182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7436ecc280fe5d3da1916d99ca8ef76
SHA1cca99c26bb8d7b9f8403c191b726de4f711b6074
SHA256648b2658d72501dac930f42e6b771d6c23f4a61bcd71751e338890a57b7ae867
SHA51202b9727b386e2be463409aa0d350d7671b9a0438402319310e5a033d1efbd01f7009d7a1f997f01925ecc1d3faa439777a43a139553b82d773e88937a6dd1bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5372a0c026d1b161b3fedb17b44622299
SHA153f1b3d02feba303243ecd8ac48f3742e1100e59
SHA256a5ad20223322efb8d5bc18e5cf2d36a6332f84055102554c16ae3549a95b9c29
SHA5120d2121a0f86f90fd264504101985b447883c91d293dc8cf99fa24374d895180ddd28c8cf65b59b21b01ff0ee0c69039cbe34ce57986ab5544b01d2edf4e59a94
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63