Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
bfac6fbf030301e299faea7869fd386b.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bfac6fbf030301e299faea7869fd386b.html
Resource
win10v2004-20240226-en
General
-
Target
bfac6fbf030301e299faea7869fd386b.html
-
Size
23KB
-
MD5
bfac6fbf030301e299faea7869fd386b
-
SHA1
a8279d9711438ec08383173567e0375b8751b580
-
SHA256
da08147ca5b634dfba2a2556b903f597386cc63f4ee932af113ab1e652b30915
-
SHA512
48e8ccd68cb2cbeb85f964a6694226093ef296010a28cae2754d3057551beb46b50bc4442762a65e13cb6bcf360bf098bd71883269b7919f04d7063c67d65d0d
-
SSDEEP
384:MnA4ywrZ6pvQrRn+ztvukeKXXTuWwehK3sP64WvKL24UTpNyOcn8tvG5nTDuU5e8:U1hZ4tWkekVls314kKc7wV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3EEA901-DF53-11EE-B804-569FD5A164C1} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003a371ab3c364efff7b30dd4dcb7d49bc569c099bdbf1bfd1b1fd06261d72c00c000000000e8000000002000020000000548917478d30b4a22bc6159b3157d0806798892b464fc676731f2a5116ac0060200000005f44f096aaf3a9ad113a88b7a275693f6047c0b9af35c015809d224f36e8952840000000afdb000bde5e0527b52d3181abc4931d4441c877bc16e6800d0e199532218714025d4e19e50daabd8df6c84338ef545bae9854955719fa6cfb3956cf4301763c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c6c68c4860c8604c21df6d88cde94d002e2874339c8b5a71a5ab4b65f3b3b5c7000000000e8000000002000020000000d586cb6e49fcb50a5aa2917c109443ddaab14356e28349ce8f76855a04ac5865900000002d1750dd3ae4d975f41ca98d8c884492fd9c16a554b518f22e6d83d88affa50d26873c3e9466ab8a673c8f157ed72ddcdc4235b24f03c04036868c4e7e0f2d5f43132fada6bcc1f82a08fc4ed83aa833e8fbd8ae222b86ad8da9c452eda020ccad2a24c683b383f54bdb8367e2073cddb5c6380db35b918a8493bdf0db080d6002230a5d9ff674c40e3c5c4256a33afa40000000adf2a265b8dcdcfb4922fb63bb94152f2e0eddd7e50bca519fa9e0cbd3a48a3381b5b02d1ab91ed32ebd6757cd824b1e35fc2fee02f600dd3c16817acae75734 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c0bec86073da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416288087" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1652 2844 iexplore.exe 28 PID 2844 wrote to memory of 1652 2844 iexplore.exe 28 PID 2844 wrote to memory of 1652 2844 iexplore.exe 28 PID 2844 wrote to memory of 1652 2844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfac6fbf030301e299faea7869fd386b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfb262c4ad9f1d6cc0e99d9b41a296ce
SHA17e3cc3a661cf5e3c4221b3813ba24f2ea56ec5c8
SHA25676e2859a2a42d6bf286859c44ff198206bd7f0fed53c1289886dff2cd1a4f16b
SHA512072836b6424c007acc701100d93f5c03369872f562f939eb18ed54d0042c1f32604d925d1a72d4e1215610bff3016c22af8cb6ee3861a90195dd6ba7eead5c9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5732e765bb130d0081753b4d442747734
SHA146b16c22e4c1c38191aee59051cf2449ea0f99a1
SHA2568c62f590b99a8f34d395720bb8d1a13270e2e7abf5f805cbcf720f55f6a74363
SHA512a764de13f788da7528841205fb892520cd42408e4db365511af85bd1015e0864a0004e46cf725f3ed0efed65d79ad98b447a1f964d062c6653899ffd7948a9cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088a744b20f4d69b397e693ca88ebe92
SHA1f7e920f40ad8ac69004a5181c3ab71dd51fdeb31
SHA2560a27e84030bddd7dbfc66117c1386308ae7acfc35bd6f12b5919d7be1ee162a3
SHA5122e5289ea11959ac0d88eb6137f50ec4f11806f5ae62baadd74eb933274f7e5cbe4cd21f6ad325ec18d313f3054e79f8e996cff5d953fb696c7f18eb1e7879fba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ef1a0a3e076d4881515e2ab961a61a7
SHA13f08ec37fdba2a09eb70e95e37c2940c52705b59
SHA256517ed93a1dfc67e80f01d23796f3eb470fec65e00534da6138324747335f7ff8
SHA5124c47001a38383a37513cc1e23d6cc2063e676e75ba55ee6128a32c259ee6b71cc0087ef6a182d244c59ea27ee45cf5c2bab67909c8acea37006ffed0b5aed957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf6238b28294289866fdd206b0224923
SHA14561d9a0be29e80dd0934cb0eb531b6250ca2296
SHA256cb447759e45d28618cdf0549391af0c1a332c62482631e976b79983a146cbd5e
SHA5129cf1fb38f089e9f9b2559935a6f45c708c3544b88d4aa63b917e8aa195b7366119b032fa24bcc547f74990848298ab8e9eb3b3fb6974b91aa8175e58aa588169
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55719710252ecf7f8fa88d74e67e3b6c1
SHA128fbfa21b92935eded9cfbe308daf3ffa322562f
SHA25632d95e8524f1667d7e4b3ee5431db5bb38f86b15fccb58496216f15b825c5ca6
SHA512b99fc976b0941fe0562eadb068a55dbb051722ed8e6cd3da88de694485a3a5529c2af3215114c31049edae9444ef6649306ac2ca0bfdc98a65a39e32d8e41388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bf52f3a2bde719207feb8651e8843bd
SHA141b1757af71b2c9c974f67ed50e6669a471354dd
SHA256f2e90aa8954d9e2b9b20997040bc725ff97eb98a88e80d1e0260b333c05a165e
SHA512747bda23e14349bc9bffb129e39db0b8ca08808ff9a3226e83c40e4e9f5adcd532dced39541dc1679fab3094e236bf8dd26f21cdd579bad680a1f8b8ed044265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564cb04a82b87361e96a2516a881c00ca
SHA112ce7e19a187d9ba6d170b0b9f6aa3686282c95e
SHA256e20014cf6c20d300032530c93b24515dc4f04dfac856ef1ce9744534c65e7945
SHA51264410143bffd12c6e6aa5d66d5b054e2b282319c28fb2575ac584a361bc2c98865205ebf4cfa47d47f7029d4bb1c79afad05a0089327f95ca8f8508c099ec380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5530f919a1db3791d22035c5813172315
SHA10cad2f02165552462c32582903de5aa2a850ebd2
SHA25681c3387d1685db7deab87767284a4cdb1cacee3201ac5c3bb29a83226ce37c8e
SHA512654e7e9b170ec3da6c8361701e73dae7e2d829e8108e72917d81c1c3d732a558d3ffd2b775b5332ef6cf7e66bfcdcea95d663a48df897d6985842bf1943d6a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5674a3c36d2c6f1c1090e21df61719a
SHA18f7fc2ec96fa1c1e5a08e718492a6174885af3c9
SHA2567b26069ccc43a41a23e4406437fe239b283f8c9318029540d58494a6d14802e2
SHA5127e46635a6339115182b290124a65cb0ac8245e5151deec4343b255134bc5aea294bbef8224704ce5ba40bbd1c6df1ba64e8caead6acfa5f1fc258d7d9df98f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5085a10ac1ed6046e7617aca458ad16e2
SHA1427cd9ae2a1bc4b44210f5b6057c58ddb912c6ee
SHA2567564bf856077e9cc12fde787c34bcaae550b7744beecfcd51b9280f251aeaf59
SHA512d2f7dcbbcd1048e968a1bb07c5b8886922b88224c520965293df5697d112ba380416831927856b44c77bfa186e5d782b11455fde90f1cc4b8d16b5087fccc276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf55387f81431aaca04c6ca01c00d3bd
SHA18f87f61807a40ed49ab4f17a23a6768ae67d513c
SHA2566ae348a7d045395e498aaca455f49c681dc1fcbb44bb92784f163a95871c1fa8
SHA512660b051c55b3693d86d4f75ab48100eb41ee29069511532a5c3a054dd9a23f9c8af28d0fd31984ecaa76ead04666043a81f5c02ecf18140ee986c676fd5c0855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc6e7f194e94a3dbdbe11ec7680cae92
SHA1112bf43e7373c088ef06828b07579f2be09cecdf
SHA25675e8d85672850f296a459b3c3c982e2db950b1689fa371f21ce3571bbd7db888
SHA512566938b08c5b0438caf7e1cda6bbeeecea7e49ec5ea451515dbb557706526814aa04262106d2ee6c79103b36efdcac80d9db4704389bdffe9e9f6334229c95fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ece703c8bb27c14f46f8c53ce27fb04
SHA1dcf820f91cdef4519b04ce2116abfdf78c3c22db
SHA256ffc847de08d3abfeb78cbf5d86986fb12d02930aad9b86abe0fdf9727cd8dbcb
SHA512aef816e21423317f0cfa768ce5de114c101cbca2fc17bc84d9028d0df1f6aafec2b498b45e1b57648cca45e942eaa0eed98a4ae325329b6001b24203e46344e3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63