Analysis
-
max time kernel
175s -
max time network
200s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-03-2024 20:40
Static task
static1
Behavioral task
behavioral1
Sample
bcc19d1ee6f728c7a53ba289759f5a25.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bcc19d1ee6f728c7a53ba289759f5a25.html
Resource
win10v2004-20240226-en
General
-
Target
bcc19d1ee6f728c7a53ba289759f5a25.html
-
Size
16KB
-
MD5
bcc19d1ee6f728c7a53ba289759f5a25
-
SHA1
ff85b022a1873e89a9f398ebc23643c314c8f9ad
-
SHA256
e7d9a02018bfeacaa7ad80883d1a781b4b3b7bf2f0bbc02097fd6ef5e2869105
-
SHA512
8b7cfd111e06806b657ea6615be4d2eafb52e1f43cc25d8570f81baa02c3f89ca28685da1cbe56a0fddfefcdbdaf06636d5a130741bcf59838411f66c0dd174f
-
SSDEEP
384:YAc61vJYxyllJfaRMDqs56kltfORqe83qnKzcAM4t2V:ncevN4yuuWRqe4gALG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50137b526272da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64F98A71-DE55-11EE-8A90-4AADDC6219DF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000000b0566c955873ccc0bb8aa0f63c60be8d75bbdeb248044bf27e3b2819e99b3e2000000000e80000000020000200000000ed6a6ef15207ff9bf19595ca33d90c95c67fc7fa41c9ee7c2fff7214725eb0220000000ea0dd75cfd839dc148b2c8f6ad7278b252189b430427d9723ea1b8d59c67abb64000000046c8d9c40683fb22a65efcaf682bf1910e22ca7142f1288f773c5b3fdc18c1e89b18f684ed808c8714b9c314b1b912c4eb749a0ae7385337c7b481de7bce3b0e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000b42408d93beca48b7436cf21cd132479cfd8f020542ffdf84428de085cba7015000000000e80000000020000200000004da009ca8c7b99f50f23f07ab645b11452080b8d25114c497fcd709bd7e48aee90000000c0113b1e4141f3f0594d6516ffa3e8f09bbe9dc7e65e502c9890f72eba777c6d24a6f4f18bd7acc798b6f47286aefbcb78ee00a3434b9e811988b6a19d00675bf84ae9007e98732798e4f916d923a163a9676e7ed21e81dd87d8dfd7ccd45a10a8b1b534287d0b75e4cbe644e999b4afd25fa21467a26aa1e65cc661d231d121f55248ffc84856a6fa778e71be1b59fe40000000a62ee17df32ad8c8ebbfef18622f6c3905fd76f3d69b36145ff3409bf7a584b68f3efdad49be79533edf47e56f2139826b032684a3512215f6b90b7d01074258 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416178771" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2444 2928 iexplore.exe 30 PID 2928 wrote to memory of 2444 2928 iexplore.exe 30 PID 2928 wrote to memory of 2444 2928 iexplore.exe 30 PID 2928 wrote to memory of 2444 2928 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bcc19d1ee6f728c7a53ba289759f5a25.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564c219728e14f6895281cca22f78ea1f
SHA17dd4adff349ed471c721b661f598ea3c07b13ad6
SHA2567e7df53f5e7f1519519ec20d18c16b4c91aeff5786ca5ea394bf800aa157e522
SHA512e6b7cda8f28a38f7439694753be261adb2df229d62a5c6b34d3c4996c42dabca8253c84d56b8e4e3fc894643701673a0678980554430477a5f4662439caa65d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ca8b7672787fd5f19f90ce4f9570025
SHA1e73dea148536efb4ef1cc937c7a25adb5513dd78
SHA2562362d52a4d23740599ec84e1d07f175ebd6b61e842f31e199d58615d0572a15a
SHA51230e20afeea783d6a6b4a6c6e4e73f022ad4696294179003420ac0ccc8ee7a5e8cc6fd329f9704ebec25d27addb1a4000cebf017b1005b0ef4a43730450fdafe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589e205b7ac859042f685ef1ba5ac6e78
SHA15bb55e081b3d744d1f287a38fe585a066d26b497
SHA25697d03759de273b45c98d11716df0d48706e67887beb31840803936460b32899e
SHA512a73b789e0de13133e9d013cf4cc44c89d5529c5bad20f310da552421b18afaa168be78453569a1cc0a0aa77f5edcfe4c0089442e8bb66c13c65c762ac41660f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535617218648c8e18a4481787f70a337d
SHA103c1833e4053230578435b2f7269d9b2b7219ee9
SHA256ddaa5a72e23cc2fda436f7cf40f72ef5bd6311e86e3ed0ef3278693a52b7fef3
SHA512c69e1773e4803332360c44242db70c9850f2e22a9327650494ded3ed28ce56757290131782535c6f78325170e3b9cd43561549e36d948940ba7bb00eea8f6da8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596a354205421b44c78af0d66784b8a5d
SHA13a549be5481045339ef86ab8130495bfe0c9fd00
SHA256d642a287249332ae7fedfaf691814a47cc02fb9aefed93628a0cb0cc27595cc9
SHA512b037319bbb4c94dfd863d862f451aa41969191cabda49bc0fed0303287be1404f32dbdc441d387104c2eb2a610c8678d2144099ecaa3b32a18cc58d574f531f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b29b5677b6563041872c9a5e6c67bbd6
SHA12f3afbb91b85bf989bad8d3f40bf3472cbc6e703
SHA256fcc35f0934888d1394b41b5e6dd133054c2573fd03cef417ed80112cadcfcf40
SHA512a7fe45eae36bde0196c46b7c61124568951cdd77e78f33ad47174ddbe85cdbceed5d89eae9689b6b4f486aa674952dc80c58375d9373041fb999b2877406582d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5727a8d13157bcb4bf604b1660cea1012
SHA101ac6b939d40309e0914f4a6f9ad4eb287ec6d9f
SHA2562cdca85303ab125f7b03c6cf68d4be5dec888991792786af71cb79d0f5f02fe9
SHA512f820164ce082865165fa4e09500d8e300e12bfcc88e02fdfe752b24edc05a01866e76a8ad483ccf75addff27163cf69b58f6cd159aecd96abd42ca807f56d3ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d3a6ce0f43539453bd633e99b246322
SHA1f1b6b5b129887739b3b7214bd42f7796bf1011c4
SHA25657dbda7ee5b377041f4c43b8fbaef4c11996e07a663bc387496f8b6b8db57dc1
SHA512fa5cc56aee1366044b3d36bfc87aa12f8c8382ed3e6d69fd16883fbcd409b80a3c49b60c9aaa60e5506ca193e3a89bdbe3336230452322e266f264aa71761cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5936ccebc36d64e2f8b495c079f78be29
SHA1bf47325a139848bb2d358fabe660826cc5f5b39a
SHA256fcc97c76180f6a3511e431f3aa94b442dd4166a8a27aba52160a927159528a7a
SHA5129c4c4362d463da3fb814e7baaee8bb23b0fa4e0e4e3ef8751d01d4465bf170aac1049e1bc9d57638389afa65012b888a5bc44465bd1cb5c354a19da360f1c91f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5defe367b96c274ad230bc1bd4fc40f0c
SHA12d473d4e3b88b96ccf646cb4af7081bf8d89f2a0
SHA2564548b2f4334aeaa89991456c73cfd4b0ba075a78692c4c3bc4e44ed727b1e436
SHA512306867296ce2e370fe572b8d97e05ce38ad0b83f7c5b743ff8b78a005ee073d364094ea41cadb8e672a6af3dd0953694b9c8e5185a3f7a35c20c19a2851980b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5033e488a3a6468dd8dbcdf724875b9e4
SHA18f374f2c865eecde660006015c4f698b90f02f4c
SHA256a4a0fde2cf451e4ae4c6ed449e11dae4fb94f0b20c0df84b0aad175a2f7beb67
SHA5126ea04b211805a0d9e63052d83a5c5c249f9cc78cf316d332c54c57af25536285f1e630ceefdf2d00ce6436db1160ddbbcf6d46e115cc3a3a7630914d32f2feb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e978b18e45b1f567f7157742148084b
SHA138447152bfe6cfe2920cfa89b813a8798519dbb6
SHA256caaf6b16fcafdd0c14e5cad4b2c1a9dc2bca7683e6db8a133b5e2494e5eb42a8
SHA512b73470794dc1f2ad7ba960b4b279c1fee92c1f0e638563a2c8e27ca0ee069489dbd705ad759569fd9dad70c506e9dcbe81d4d0c831357104e7c4b2a558d1aa87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1a592db1e1e7ca18f674348a6ff42df
SHA14c4c2a7fb48254ce816dd6b5cf84477453faa3ae
SHA256ba5771c0893a4e03caa35a4129c441813a9c8ca12efb4779945b27f4919a6bbb
SHA51206823d1ea5b812d43ea48dd0a0b242de40d566a755cfd5488b7eaadf9a2113300ff6136ddff3a24549a978a5139020c4d15c8ca830f7a98dddd13c514ee70002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557a0fb727fd260b795753f6bb407cb77
SHA1fb184133138b72be832ea8bff7aadeee35e32020
SHA256049adaa104d9b8f44b81426c5af14cf4ec3e47359d8f7deef5c838bd8198476a
SHA512bcb6ac9d4603a5749bb6bd9b0461d76dfae700017d0c7391128e82a5416ce4ae292ff1e11500822a420f2730648411c09c8a951a9c82643e1516ca7c251d2ac2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1b398391867f0ebdc8f5cfc3f2bd6ac
SHA12cc3a688e55834cdb0b5a6dbfc0ce300aaffd364
SHA256ddfeff3830c296c9df0d8ab132f2fd46135ade9ece8aa4734f597384073bd782
SHA51225712776eda5f593e7f6b86bca0c8d847e5ee1c1519fd4f3b41912d5ee37af8f418d4ace973fbd2ccfc29f4dd72814f0cb11448edfee1182310448dc03ce04c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcf2e4da46e90f14ff23513b036e1f8a
SHA15101081c416a3f2d6959216363c662c544c51884
SHA256ea6c20202870278c12ee8a00cfa05e67a21286de138f901b3782b5afdd14e124
SHA512bd6ccc104930523f309098ed1338f11cacadb316be56398c10bb5c95d651b28b248f2d03a65ccb305b0949e08f38085e7ae5af1b571c60ef5808d18e70bfa72b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63