Analysis
-
max time kernel
121s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
be8733fd3e54809093c92b85c0bee5cd.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be8733fd3e54809093c92b85c0bee5cd.html
Resource
win10v2004-20240226-en
General
-
Target
be8733fd3e54809093c92b85c0bee5cd.html
-
Size
50KB
-
MD5
be8733fd3e54809093c92b85c0bee5cd
-
SHA1
4eab0afeaba9dacee0c88e5cf35938d9d6f21f7c
-
SHA256
88b77ab1dfcde647cfbbcadedf3e6f0194d3f8f078251761ad4d0b8145ff5b47
-
SHA512
134fa998c09204e817e8f1ac0a0ff8dd4f95c89ebf250b0268ffc87add7c0481ab0fd9c581d8553d2403bb1d07c74a51edde8eb039b87167e8ce4e5b70de620f
-
SSDEEP
1536:CAAVa8yKEGLUQ78BdwaPOdIqQqxqOqHqbgXF8htUP6k+vmakBG9jWLI:ttPdpOM1Ct+akBG9K0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B06FD1C1-DED3-11EE-80D9-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416232996" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d47b8be072da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000005d8da047e5dfb21c41ecf36f28b6e85f113be43a80710a444215cf9f3ec2b9a9000000000e80000000020000200000006668ee1072810cfdaebad94e384b442246912cfffe9c403554c047c53ef62cc5900000002edcab951d722605a06c5a211061bca70958c41e5451b05409f6d8fb9ed447e7f0b6dc72e7723fa6b3ab4072a95bdeefb75d094718ac66b11962639d3298afbc57098337063d8d27d7a3b67bb4ae6a25d045fde041890984f50dcb52cfc9c3bd8737269e2f6f81e40acea83ea3bc5a0e23078d224f4cfd248c0ef13c2a8578a9dfc31dcfe0888739a0d36d679c9bc6454000000060d8126750bc48fa1765dfe2b7a8de4b49e914d7c0814859d0d202251a68f573966b5df9da8f5df0243b784ac0e67e29de5bf4a2420259a009a0fffb5ff71517 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000ed6cc4637e1dd161d0d823a3548e20b1f4fa986edf8c0d5b5a1185c347abafb7000000000e8000000002000020000000f744ab1c3c0a3977c50886b25ecab03f1239d5a603fd505117f1b3ee1c26118120000000a5fb6769fbf813c092d4fa54b3c4d7ba05ad4d47e619f842c5ac2a87af69dc4540000000f6217df7a4944131c32bf7779efeefb97b634dc99a3f87c5242a29aec634b53e0052b2772c08904bb59969d742a24114927ca84e4281fb8e86969fe1141aa34e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1936 iexplore.exe 1936 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2532 1936 iexplore.exe 28 PID 1936 wrote to memory of 2532 1936 iexplore.exe 28 PID 1936 wrote to memory of 2532 1936 iexplore.exe 28 PID 1936 wrote to memory of 2532 1936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be8733fd3e54809093c92b85c0bee5cd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513cdbfc093917c0e7a7e5edb7b06c834
SHA15201f59317fb811f303788389e4fe50ec59c8386
SHA256fdaa118f96d98ad24a014730c860e8e9034ad281a1ad53c51988a8774486bcd0
SHA512ada5fc31c10427cf861c1d314f463688c76e9c2e18eb503ff521474bcf33945b307bc448a682322c236fd7c3e063f23f4e1f4bdaf927432c3ade06656b443af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a657739616f7f7e3fb800fe6af424e75
SHA10702068cc6759e547cf05461d629e589bc0a39f8
SHA2567fc44edf4507141f3868cd2ac3983a7df64663fa6eba4922260414cddb79682d
SHA512630ed8de8f94d3a2e9275adf9d4edc83bd5e7270ecc70d9c0a8002288d012e4cfbd938f9107e3915bf3cc47ca904555ab3e3f8c72e386a17946ddebf4060790a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be85be1ed08eb0771acb92e257849537
SHA164fbd4d77c16d93d5d2077a9d0f8dd1c55502acd
SHA256d95f6f17c17d831d1fa38c6d7abdf13ba55e0a2ce72a8c8da1bf23daf277b3b0
SHA5126d737c0d28b1e689203ab8d470191f4d432bca90659f491f5530ac9ecb020920bbada87123fe37225eeac44042aac2a497d038eb9fc1e27411bdd6f19de3b98a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5727050225a26b95a13d46f69ec0af3f3
SHA119fb70068198641fcb0860149c55a7e555a7524d
SHA2561d3a68fed0ac1e115781768c19461a5dc4b395dc68806752d7cda9253e4f4e00
SHA512dc06a7907b18470047143bd9dd601fe0a31a55ed41c740647f44429fecd2afe888250db6290f68a9b71ef3660d61cc59595242f21accb9f264c0a51ef46fb755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bad58047f72aa979478a92a90514107
SHA12055b96e61806b863d25f7a6c525b337426c3b94
SHA25676e7900f0d62061200f2abeb84f3f4cff64e9b5366906e78c79d52db3976660f
SHA512a2093b75b0bf49f33085567743833dc1812e410656c8db87b721f3847584fb89ef25a180b940086fdf8ad0dbe38508b24adfc1ebecce0a2b19a6af59cee34ca8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572ba4c7880b3a7e0cdc61dbd63d02be8
SHA10c14dfbbc8e1e5f4560c8bd14973ef8b641f7552
SHA256a4525fbc1177aefa0eb04dce3aba027e975ea0eec26200c25dce38213c9d7d34
SHA512dfae84585a4e59b1f3290fb76f20eac4c23372026fc1b82d58ae48ad2c880728f19f1a2002b619627b4012e02c2fb52c91568289f4832ceb2e0e6c99c54a5ee5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564b4e328a2e694e6427df4a8aa3aa2dd
SHA119f667d9af6ce7e4daad26d8df2ceb22d63dc87f
SHA2560c8356c8c816e4a9de9e0cddc3319c1a4c2bc148b39bdcc9596e68f732728a69
SHA51253b983bf4d0f044984068c2b0c3281bf453bf4ffecda9dd78282a7907b13867e359f0be0c226c659ba7d7d043c057ebc1038277d9b8f2296bb377de364ae7898
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cedab1b7beca798cfc5d2f6dfeeabbb
SHA1072c0cc4a93a265c1f7751da8725f88aa1ce37d9
SHA2565dba7f38f323b4d8181bea2bef4106c15d12483d8cafefe806133788b9894e41
SHA512b715dd4260f23efbaf1ca1b7affa6ad5dabe3f6ebadf06d06a44a2fb0a7dfa9f8247e8e0e8ca3414df72405a25a41718b2f24b1094985137a5e0fd8a39ffcf85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a23f801c36dbbe0e63c1def123fe391
SHA14ae4e342d2f4824819e6d0529532a109f6a5e79b
SHA25635333785ca4b428542bb2006228798f9a78eb97351859eaef1cfebf6cb4a6f58
SHA512efd9f778d8e8b552d800927a379f38aabe04e12c6dcc6554004db07d9cdb6a9dcf9cc58291fc75720a7c805130e2b70d782a607b039db2b6b6701efdf7d25103
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eddcfdce466c3b1af2e137f393139496
SHA108e8808a82775cabd35a933816f70d867bc88a84
SHA256bae82d8ee460eaeccfb8d8c3bca5cab14dfd524181598b46ef3204d53b84cb1b
SHA5122280a32a810d516b6706abe24fc1b0c1dbcd1b3d2a86520da107420c0fb9c7c29beb2dd4876c3beab0d4e8874b25eabd3d5aa62b644a91bb973e8ff0e88028fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1222636553fd677393a124eadfe59ea
SHA1e66e706a4e9eefb44bd571ac6a6a95d582e92d6a
SHA2562aef701247049ede6e51fa54b8693ee98d4aa196b8daacecc226bdb8e8b098f2
SHA512350a48080ea6d865a39bccaf6ab5ae2869272f8388bf45bf4d9e98b93f8a6b4742ac1e55a282b6cf2fafc18a5d39e36b05a1d53fec9c98de0a3d9cf61cc27a2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594683e315ab5f0e61fd9573a74e26235
SHA106d72064f9e19a536ff4b1000eaf2fbc8a315191
SHA256feb2790fb8cffa49a995e320fe49bf7ff9230b0a86eebe7d7cfac6e108cc495c
SHA5126e239ba2af96b29b4ec2e4cff3829cbeaa1ec25fb8db43a0d6d9a727af9a9a876a87d53a71412da200c48543fd964df04f3150cdba11fe50e54615efa04c1346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59878b333be74519f04453bf938602e5a
SHA1ba9af6c801097498315772ad50e3a430c7f36cf1
SHA256225500e88fb1c793427ed32622fb1ce7af8f69d4d8f8fb287f820310f38310a3
SHA51249eb9276b0690b56f6308a8e94e1ed4c6d63974e56fdc4fe0f4ef668a188c37487d11de9d3a31fef5f5a950332bf6c2dee93a8c385f10e3a3daab1848bba20fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd53e10cc35db4bddacbbb28237d71da
SHA11a1079a45f8e486d143a3f995b3a8cb9b566da1a
SHA25643a14cadc9d4090a076d0d6b15177e6073c92b901954d3807f1bb41976b6acc8
SHA512f853ec9bb7d1681e2c4e8c989d405776074926351539d1c0457f24c28a43d925b8a0833c5a4ccc1b17dc77e65deb33229c86610be704b1d061459ecf100df42d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5317b3d520bef169cd508c185810c6d9e
SHA1f8987afb5457f52c8c7c66830fb424ea26ad13eb
SHA25638e273670b08b8dc467c01b01e8c36b457e389b71033a84d95e7fecc0654462b
SHA512ee4e3ff02a2b52cbb0741dd83229c65e647ea296e69452ca7483a89a2acb23df02dc91271877b92207562f355e32c03d17ad4ff3319de4af78a4e6976202a517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f8990fbf26bb513c8b8ea8ea55b31a
SHA1f5c94c6d6543bf46129e1ef6ce58f1523c47d537
SHA256ac38a5419e1d044bd38a8886d68a7c8a8a1075be071cff2f6da4cf5376112c1e
SHA512b4afb83969d68d9b7b79ff26adefe9fa893fef80b4c655f2f50e68696d4ce74d096567ce8325018c0ea6e690746740572e68d6d144c700d02da4b09d5a32b7fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51972da8f90e7a9f1d8eab9fdbf63762b
SHA15db823a944cff2861ffe419ac155eb563a9efe50
SHA25622094719bf4836fb9bb0ae728213eae87e9a16f477070903ced08a067aedec39
SHA5120f8339ed9257cd0af750dada4ef22c9609a4f21cb8c68d63f5f5c2ac39245257ebc891f67ad7018e2a8b735d92fb5faf869b21f28b1fcf2d218b8f076fd1e767
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a3255dcb521d2eae95234ea4c691923
SHA1e9bcd1c9461063101a703ce3f2a40fa1c6b8908e
SHA256236828627adaf76cbe77c24589bb314becea61476bf02e7df2d196f2b998d389
SHA51230c41a6f482dceb37495274c4d4922e326262ffc961988b75127c7e91ac3b836e69d8819b495eec933badb77ac6bfe033d7b3d8efdd70a93c2c8cb568e3a5959
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63