Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
bf6b33f0766f9aa517fd4d11d097e3e7.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bf6b33f0766f9aa517fd4d11d097e3e7.html
Resource
win10v2004-20240226-en
General
-
Target
bf6b33f0766f9aa517fd4d11d097e3e7.html
-
Size
8KB
-
MD5
bf6b33f0766f9aa517fd4d11d097e3e7
-
SHA1
7a53be7f6234204f1bb60a0b352db30672fb1b43
-
SHA256
7b165703998cc0064c7a1d3c9cdb75b84089e64492c6559cb0211121ed253702
-
SHA512
c7923f9407872f59074c4075d67069fa48421ee0e2a34dd1b2db51c21c73a2b5d00b0418d3fc543ba4c92825870788f78e6e8914e193f2ed776a171ee40c272d
-
SSDEEP
192:PLtC9TkWoa9HuaQ3GJ+6fPeThjdl43WhisXWCQ9YDWmYAG/TU:ztCtkFUPWG5e1dyWhisXDlDWmRG/TU
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b1c0dc664e34cb48b2af153d2ea655fe00000000020000000000106600000001000020000000c131e11d554790a3a0f2dec7fb420ed82647850700c4d8257c51ce1cc627ba17000000000e800000000200002000000030c96ab3e54f75181f6a5bc78b4eb269ae950667bd9bf852c08d1812c396fce920000000d2726b35b04b0e301a381d8fba0a5b4b1d1a964a5b28a0227c0acb76a7365e09400000003cfa811b571000fc0bef70c9b952f67246a83cfe33bbe3bf9857335f912a6f7bae840306b914229e823a8375f289125adeecbf3d38892cb9d6f4b40f7f3f190e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b1c0dc664e34cb48b2af153d2ea655fe00000000020000000000106600000001000020000000eb03a4a4aabd8cb547598b13b7ac2d8352e64a75396d5d1ee4cafcd356e85fa8000000000e80000000020000200000009404c1a06d8ad1892e0922581c0d717a568bc7d885540cc32946df903610a978900000004df8fbe0ece0604c73e0a23262525be44d3ae9d59301240697240b9d40cafb356121e9dbec26e2dfc89e30a10c79a4e64179394a35ebad0c1865d35db4718d0b6b32080a121b3e9240c19b9a1c27133712311f7085baf735eba1aa2431c7101042974ae2fd1654b1b8ca58b5ce7afc9ab5f186da002e27746c23967fe31c46277a70cf747c95d9ff795f986f664d20904000000096cfb0f0b6f81f37871026e528319fe758c423e401240694da57ac2c8be219e9270e9d9e4d1f26a2c6eb54c696cc5d329f8014e1c82514af295e051b75229c92 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04ad7e04e73da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416280396" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B28E891-DF42-11EE-AA09-E6B549E8BD88} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE 3012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3012 2360 iexplore.exe 28 PID 2360 wrote to memory of 3012 2360 iexplore.exe 28 PID 2360 wrote to memory of 3012 2360 iexplore.exe 28 PID 2360 wrote to memory of 3012 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf6b33f0766f9aa517fd4d11d097e3e7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3012
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51a674ede9724b40d89d8f4544604b671
SHA19d6615bbb13eafcd72baf3db4dbb6b9459035ae4
SHA2567969c12b926c1d216661d9050e12d973319c7585e1f61f6996352ea533b1e779
SHA512a9710e02090cfabf5a7444f792ca004e3a67918c0fd1c7c8ae7b9d16277affdd23ba73083fe6211aade9bc6ec27212880b7c0068e2c5a18912343d7966a1bc86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502ffe56256da585a48873fe21518105e
SHA1315367104ec7cccf0d447771cca09e1829b350f1
SHA2567bf49b27c4dfb73ea19b359bbbecb4e8c00b1d9a2f30474b710af9dc258bf66e
SHA51232810065ea64c9fdfaa8b1cd31be87568d9237d32569e2d6d637aa2e896eee908acd18d23d77f30ddafda4fba74d436b248e05bd2ecf0c025e2b513946776f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501fcc4d314b0b45392b3876a5d5854ee
SHA16716ab025df57bf407bad1cd1a54e9338122d2b4
SHA2562ffc80f68ddaa9feb5ac33be6c2200fdb4b3184d09bf76bbe37b6fed571d3442
SHA512bd9580716ca35534c0f9e69c27dbc31e42b9486476a3ff7917bf095095e99bc0ca656705397ef242294af02818a8f8872040bb05973077366fcdda9151d568f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a3fe5a8479404f3f3e85a1f4c91eaf2
SHA12f4840d5e3ede0df60fa5480fe37d0a58b2a864c
SHA256c85569f9363c797f293dee3bee45db1794a2e77e79763120ef7d1926a2a62ba1
SHA5123b0c1b776e2a438113c33f074a2059de486dc8535acd45d8fb29b61667bfb2e699658c019a08eb55fa9588664f9723b261b8e7eda610cb6d3ad916be6af96dcf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50524337a18211eb90bb56f194442799e
SHA15a6f6efa0f69f8f11d284abd2df9609652e6a1dd
SHA2567b38fae5ee734789a949f5ac1bd856a11905b86437c240d335b241d954c87f8e
SHA5122d26c81b6be704fb57ced524eec88c6bfe684a85cf0ab49e6fc28642c65464c8f378bb71543e7c6cb5077a3b98d837701cc97e160c05d63ee13f314006938bd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bee143f85dc9e2498170daa59bdd4e83
SHA1af6ee9ef23660c8f82a441302700377cdd0fec1b
SHA256c798fbf49692676a710d25da51f28de3a5bdf4f916870e97e9a780df43617275
SHA5125492f11a50f76735e9d59855673b2b2b97a02874dba12f8cfe3ddcdde02639210cc49ae2d219f8e862f319593102d1f003e387f328bceb706ce6a9e36b12a08e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5661338b46aee3d4da48066a11b320e3e
SHA180de00486f1529324ddcc2aaf3e47f97dec4cdef
SHA2567c12f4de6a54d0cb2a9fbaf8e04e62b05d86e57bb98d4fe76c516fbc2203c970
SHA512de5978a448706d1036359f18dd9215eddc2674abfec2b443d76591a9a0d76d4a668372e27bda1970f166ea35c435c7948a7c5f487d9c1415714e4567851c9beb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51412c0e7fe288f4ecc14b69372040f8b
SHA18e5d06bcc14d4e334c1dd81b345e6d14a296c18c
SHA256cae84a2ad0b95a5c10509afbe9879efb117b9bb7f482c267ea9a048695d1a561
SHA512c4d214286f8b441aa667b6803ce138f12371dd12430cea66a5a0c1aec2c3af83747e24b86448a080bd719ab87ef7977c2d0b128accf9af2760a36ed776ffa9a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56961b1b155b05d99a698e26d0c7a711c
SHA1a912aa75eff6480f63aeb9fe32f4311765326005
SHA25645fe566fd7b2064dfad9363dbb1135f1defd12279c0edc90bb9aae6479fa00e2
SHA512c509c0816efabd81f5976fa38208f807485adb3950f976f255589b6d89bd9ded9859a26eaed2b8605349d1dcaa3ddc60a4bc5b940a3a1d0d0b2a2ea57ec6de90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb37692ea1b6a77b04f3ffc20f7fade
SHA16247acf02f97a71c4a93e17adc31834e4fc35bf9
SHA256b0a6dd2e41e0f12d515ed6fce69d25c2727c29a4047df16a6a4e70dd5a879882
SHA5127ce568feee3314d4ff26e462de017123b2da09f43eca2cf0918700114e7570ca83666b9d3b1886c9ea6923c023d167a9fa6e81e38a4cef6eef96b41c49b11083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ab5d1919ad0b5e61dd1cab7e4dbe096
SHA107a3dc17500cebc356fc5c948ee33e40bbf1a216
SHA2566a1ea929b9aa60c4877d85492e20d7eca279f21f152b50bd58c4234022dc9a62
SHA512d3171c028fd7932abc170a96d4afbd63115dd79bc22ed372b191ff7a918a196c1697db00925929ed5690c32b2b9ac6350b0f5221964e1a0e86fd27baf2068797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efbc5df69c17ca1a1ef75802bf956531
SHA1e53cebdca085216ff4241ee97c7e693febb264a1
SHA2567d98c015201c222f82331cd64b2f75b9a45532fd10f188644db503085faf21e8
SHA512c436cf1076a54d7739e9cc77489f9f97760832dbcbf74bf8b982759f59a312d697ca4bc242d2c9643fb023c6c7cabde8f48ac20fdd6aada1161ae6ae6ef89500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51ab1f99801f9b6155873379489f332ec
SHA14e90a7200ba702ceac3645e0181b541521d770b4
SHA256a1ea5f9dfc9508233a1c7c527c41ce7afaa719f04f97b4d8ff6b2bdbf5aa6114
SHA512ecfc2874eca43c607edee2b976b9206ed4604c4ca415dc66c06948fa263488d89017d6cee918f718cd1616a7e29a51e337e6a5c3b68414b47bf47c19fd707d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63