Analysis
- max time kernel
122s - max time network
161s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
08/03/2024, 03:29
Static task
static1
Behavioral task
behavioral1
Sample
ba65a5bb60b521f79d42b4c4d5e68ce3.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ba65a5bb60b521f79d42b4c4d5e68ce3.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ba65a5bb60b521f79d42b4c4d5e68ce3.html
- Size 85B
- Sample240308-d1ymcafc21
- SHA256 d6d021bdc1c1c056f0347f35db03fc977ec15028c2ce919a6d769b0ab1663e41
- MD5 ba65a5bb60b521f79d42b4c4d5e68ce3
- SHA1 f9f34150dc2561dd1b42921226e3658d5ac9af39
- SHA512 d179eb89ea66ddc3f0fe917c8a4093fb3222d27190d6c381860336fd41ab5c30c81b56f35a725fd036c374e9f012d6c7e877fdd566c6787c76af59ceb1f3c659
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08b54fb0871da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{198EDB31-DCFC-11EE-BBB0-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000001fbc9541872c06ca17025d0e18eecb118f28f4fc1127e7b7d9ce534d8d5336e0000000000e8000000002000020000000a6608a673ebc5a7dd809c658f58a7aff935761183cc18a33c8c3cece5cb7228190000000ffaab948eed0ed1d4e81b4443c90ef6f6052561a9a4306630283fc2e6e9d37e31e20af7fd430a9ca1e8521dda754ff4c9780b062b292eda7d0ac60fe6d9728d6b5f661317b50d875a45f8225bacb2a465ede91e253d9b01c7a327911dce11e72580ba1106c609badd63b8b37913c8237cdc0c41a63548c06849ab8f081302525cec692ffe8fec768d24b1a4a816cd6f140000000e69caaa4c08c14f6fe265e978e69da417c0bb838ef87b25bf5e96442ca3ee129f6cdf49e167b5cb10046f9b162a5aa132edeb82c31e9d977ebd5c49422c35691 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000c0172d757d4a3ecad1b48dc7c6e84e3ec5f1271a8ce741cdfe9fd27d706b6070000000000e8000000002000020000000a8496445ec67e3c02adb3517e7b9b64b0687f4dea3a1c4ca8d527f851b15a6a620000000e3c3b9f8e89ab8ab1efcfef540876b53efc7e84d1aff4fe03dda3a78acbc08fc40000000f29856691d9d6dc7b1040492639a0e4c5f1a594a501ba2fad59935a8ca608b949e7ceff077ee37c4897f69d21c3d0c6f6b29dcc36ca32213f5cb01622e635a90 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416030452" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2516 iexplore.exe 2516 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2492 2516 iexplore.exe 28 PID 2516 wrote to memory of 2492 2516 iexplore.exe 28 PID 2516 wrote to memory of 2492 2516 iexplore.exe 28 PID 2516 wrote to memory of 2492 2516 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ba65a5bb60b521f79d42b4c4d5e68ce3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 be021794ebd63ab4d0afd401754fb3040733ef6eeb32054f64ef1d4c95ac06c3
- MD5 0e8bfa9a574b19018787ffe68b697d4b
- SHA1 3d4d7030a792eb9f7785bedda32f51ebe51e5919
- SHA512 0af66b416e137de16ab623e381bbe15dde60fd8fb37074c4f4c8025b089db2bf2968cd706e41c06fbffcda81582643c2b9971635fa09fbc902c378c33eeded73
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bb5491945c0093536fa23adbd41cbb202b4371f164ff94761359b2178b412300
- MD5 f433e3d93c358a6f4dc8e2049149aaa2
- SHA1 1ad2b9c8d3971ba4bcbc67978967ca96fd48da69
- SHA512 d2fdfdd0e3454843c42fdc4f28761ebe4639a361a1548cda70180954636a8c606407c931ea0e9461e37255400ee7f4d7069d0b0617a30b4b706bde0d50a3b67e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bc4aeb04b9bcb4cdccf06f5de15aed4d3bc2166aed4796a4845cf6426c9a81ae
- MD5 b2a004f89de0c48d8b79e90480771cf4
- SHA1 51c8a4f489b3d75324d9aed6698b0b553c51c9a7
- SHA512 1a9978c6099fe0f886d55eb062a4178aaab96783c656696cedae89c1d846a68051145a25ea27a8095177f9276bd75e4fbb01e7164560ee5b952e697e125181cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 272b354be821cd8659b339af7b1bebb1b214aaf7a500e185ec34645aa9c24313
- MD5 fdd1ee5b2605eb09160e0d74921eb482
- SHA1 076a4c0485387df4b79233be14a3b13956ba8b36
- SHA512 a304e9663b75f5c734183879d986244c373ad2fa75dc3d2e782480eda6c64d2e6a6d167000256f9b2b32b747d6aa35d8e9d39399f16800f2f2c0e07be8228c23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e5fd27fd4a8ebee186cd90bcfbb12c8c194feb6bf3de494893cc45b75419335a
- MD5 f6ae9449923b4ee44e89b53b3616fa2c
- SHA1 109b5db41d83c599d549494f9b46622c7d9bb5a2
- SHA512 467291f5d294c97ce95630f4ca61713176c087cd37c8585c9142f9532ceffe5d170065cbd1785200b3f27c66217842df8efe852e41c7c499721f8ee1ecd0a870
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4de8258164c79cbf86353c2705c8c51ed8c27d99bf5b906029db4abaa4de6451
- MD5 e83d06594b4b03f0170dfa0bdb6b2249
- SHA1 37864500b0b9198c441ca7b8615d8ad75ed32eec
- SHA512 326e2d6ffa2eb4eb7caed14348fd0f08580399226d2ebbe35423e6f97a8c68eec5c761cfdbbe626e2821b073b532d3798c4dc9fcaa53ba7da2df68d3bc02e782
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a25d1b8b700d47ccc21540a542138cd8032710b1451e8934fc561fa63b5bc385
- MD5 0fe202fe45db59f64efc4630c53069bf
- SHA1 625ef4fe64f4fe3ca8b5a0a82d5c3703b57816f5
- SHA512 919a63b9ecaa1922353c1df69d0252f04694ad2c72bba316da6147d36c277d2dc60c565f168abd548a7bd2bc3793fa100e07a2228a5fdfe5fcdab725ecb98d41
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 10aa073d9be91fc32f6601ed098b6ad7d82c0a12d814b754406e0c16e1cfd823
- MD5 d09f1daf1b7a63625ac562f09a0621de
- SHA1 985dc1c70fadb13231eff2d0cdc5a6c4fb511d3e
- SHA512 53339b0544a511f7079022ddf7ae0129df728d908f4efa071dec69bda0d6c199edea4ff4863ed61fc703d9ddeb39d1488f2f50f2c96abbf021b57b00e09687d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 84f09f97e632deafc28a3409e073587fb3886a2448fc8208a388ceabc898d890
- MD5 9900934e21c0ba077973da5f0e6d6829
- SHA1 a7f684611853c9cd822ddc5bbd53ceccac79cd3f
- SHA512 e26a2506361cd3b2774a40b3288c18055ff4f344b6d15b66944d30afc139b256fbff014f80095069803990e25009766b7da4f9dbb60c3560fec5b2e4abb5c6da
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b10de342f5150e747d8c84be9bb3d7a4987af45cfe228174efa32628a73c82de
- MD5 f30f7e9ca5c781c9d439d126023b2485
- SHA1 a6bd10daaf7b07e2bf70d9b4d8fd64a05ca5847a
- SHA512 5cfae2c36a65a1a9cbc642dc1cc6614248f2e68757100099b0d659a4a1de4942c64c5dac13fe099e1ea5227093783fe32710e002de769ee461a42ce3de1486b3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 186dd5564e017edc8c761e35741e5f8bde6bc47b0a1a7f6612dc9b5a64f868ba
- MD5 d8654dab402b78341a3e5fadabaaf2e8
- SHA1 c6e8de8de500376c3234f6ffde05803fda88a715
- SHA512 33c425deb0208295805031ded6dceca23190ff647ae9eeb3ea57ea143cf09c73c38fde2d460c137cbc0f72dad03bb79b2a4d67d7afcd2dac2323549f355dd532
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 82e542c772b55711a9ea422ec5e949f4c794fc59a5c2c80d7f8e981f9af375bb
- MD5 a85cac705e5f14e6ded5eab8b8b05d42
- SHA1 1b2bbfabd0abd70875b83784d6ae8a2bf445e2d6
- SHA512 fd26d691e90d7fe233d9c36b42f3689ee882ddf89257c2e15146fcfc5e6a377e9c954186e08fd8fa91a276cff2ae131f958232b3f51241b2e2023a7f0a7fa10c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 f513fb4bd1de21ae092e8a4b677ad0e208deb2424085c36f699da6c6b47e0efb
- MD5 b79f46054218f525e67613454049bf1e
- SHA1 879d33dec647f27c60384cc10a2c0e7debc51408
- SHA512 f9f1a4cb2e141190aa9d94a9c291877fa769982c0603f9ca733f918e9f4262a15dc25be644b4fd579e2d0d10f8cb4f1096b5a94faf3b0ec0e49ef1957a76ee53
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 1ae9b0f76af570b4d79630615fdb7cc6f0f480483cf8256c63b62be5b2b3c682
- MD5 1802e678f2b6a130aaf9e8db7ae4c99c
- SHA1 e81135cde7a869d904629bc89823597051ecdd69
- SHA512 e68fab6ce2f0c7e5c0f1c93d994ecbd9ef1fb934c4c7554436f423a11d50dc764c61a7a3bf3d33886ef94375ab6f5f5cf48bf247df71d890f899768b197b49f3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 f2b1c9837acc3eea663b9191a4f4fe7353da898ee036085ba2497cbc6b6daffe
- MD5 75d95110fb64b157b81b6a12cd2f6a58
- SHA1 97cb92e627959593cc395e5e84c0f99e4c585fc7
- SHA512 2388b6d400cdd7add73be4fdb54a012d07b48eb25b72698a3a53848e34c6305fed35fa603b84cc3620810eb0204b89b5389dd489f740cd3b015ba53fc6e9079e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabFBDC.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CabFD2A.tmp
- Size 67KB
- SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
- MD5 753df6889fd7410a2e9fe333da83a429
- SHA1 3c425f16e8267186061dd48ac1c77c122962456e
- SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
- SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2E7.tmp
- Size 175KB
- SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
- MD5 dd73cead4b93366cf3465c8cd32e2796
- SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
- SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
- SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP