Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
c007276b4645ef690c2c6f46ab5a014e.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c007276b4645ef690c2c6f46ab5a014e.html
Resource
win10v2004-20240226-en
General
-
Target
c007276b4645ef690c2c6f46ab5a014e.html
-
Size
29KB
-
MD5
c007276b4645ef690c2c6f46ab5a014e
-
SHA1
692e68dd109b8681dfbbd6c4fad8dc891f4ed1eb
-
SHA256
be5cba91b90b19dca04e8b65bbcb37b4ba4140592f332cccc5005e5b6dec1cb4
-
SHA512
7c48e8a4c557fc48def3ef5fc1145a87bf5b789f013e3d212a17f652d6bf552cb000e6c3ee651fee3a443612e1ed4be25a8d93402945b67caeb73dc577418f1d
-
SSDEEP
768:/c1bpKVAqnd+qq9oxoB2CnHO/1Yxg47LFj2S0Q:/c1NKVhnd+xmoBhnHO/2K47LFt
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2BDFB01-DF6C-11EE-84A0-4AE872E97954} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416298768" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304cd8aa7973da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000059897dea521d47a90493a3e4f7a8c939b0f589c1fb4bf18cf9f32722ff2eb47000000000e8000000002000020000000078b356d18dc11f59725b153dcef40bf81a5aac5974462c541f19fc69569d74a900000001dc144dfdd1c3ae22fbedbcc7d3a750a0bfd1fa7d1bfffffb64b8c9e5d13359f28198889c537321918e4e695e6964cdb8ce00636ffcbf8642500cf692bd378e06cf9913d731b8a8604d8169bda6d5bee6d8d68eab2d70163fa0dafe49e0b265f56e38ccf5ee1faa9a18588120b2fad11627408ac8dad60eaa4df265e5a4de6de1b3c56f8e880b9bcc951fde521153a3140000000671c8825291575b8b349c34a430d55142241edf362ee176d138e43c9ba2abf83e50648ca94131970c90c039f5a075f3e4686ab45ef96f2f62a5ba7b4d8659a73 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000721bbaf9eae22cb317f411b5afd7a5e709b4974e2a2d92b7f332f12955e4075c000000000e8000000002000020000000dddc5ac949c5c8f54bc7b1334c326bca95387489788e3bc66d09f38b2cdd6a752000000072ff63b58bb8bebf37fe6834225706f662d7a5355d9722d945f6a107816ccc68400000009cdea3bd4a879f5cac65a0cc8b5c5c9d056e4426332f1c851a5615e442cc490005752391805aeb8a64cf5460ec9dfb887740b775c82064202e68dde4df9d1136 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2196 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2196 iexplore.exe 2196 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2196 wrote to memory of 3040 2196 iexplore.exe 28 PID 2196 wrote to memory of 3040 2196 iexplore.exe 28 PID 2196 wrote to memory of 3040 2196 iexplore.exe 28 PID 2196 wrote to memory of 3040 2196 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c007276b4645ef690c2c6f46ab5a014e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550aca7cc280b6e1f15f94d33963b5d19
SHA15ced36aaec17ad3a3a5f9ffebb21b15c003caf7d
SHA2564e2d16de9dc496a249dbd82c9657d1d55a450355fe9e78bb95353fbcad441401
SHA5127305950725010b04ed1b8d8ccdcadf7ce580d86e6826c3d5711fb051579e31a7daa3e6f568400c43a86b56b174cd5a02dbccf27a150607eff5d2a86bc0e4d4ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523004bbdff934d9ba14d8542195d419f
SHA1db58a83acc39f44e33be4c70c5f3c667c467cda7
SHA256775c972261ed779b503dcfb307ac535637a0ee7c2c4eb19ccdc308a8aa4bbdbb
SHA512738aebf5bc71c19553e6fcf5c990832162bd0d933db6c62cfbe3816aa24b484c336e68f1011b9fcf5505b8ddb90d5f213658b1ce0ab49c5a330a8f1953d0655a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54695e6c65a19350267c6958108f4688c
SHA143b69bef974e8019c12d40c56199fe77afaa9bc2
SHA2560175e6584ac87d1d21c15b73c687aa74569aa4a9fbc850abd55a6cef9c5ed1f8
SHA512031f73056d0c97d18a7ebf9ea43a28b9db284f23aecbb68ebd438fcafcf868989b97c77840af84511e828bfb0216ea944e63f2da59678d23140e8a49dd29adda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a9316586fb1b556b4a50384a1db6b3e
SHA1f0e9e5a3858983cb3e409afe8a982031349d4042
SHA256ccab9f7ce5b9a8f5f94890ef70b0186fcf56f954eaa63e60bec8fdb1f46e0ce0
SHA51241a00c92e8df236a243b640cc6316669075ec1e0680313ac7c286cdbeaed3c08cfdbd073dfaa6a84380ab75640dd0b2c5f6ee1fdc90f56069188cf4c43522926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ede59bd61d6c53da660012d9d80ec78
SHA1db7f2d2d95d6516aa6e198a95acc8164baba045a
SHA25609416c061c5773729aa275b3674debad0121de22b36513de2aaf929210711b99
SHA512e8bdc6340e8b2e772a596e813e9989930c34ff7d489f556ec7fc74e60c5c17c2f42373c3d31c0315cd8a5933f1ea97bbcbd3e52792968de756b829caadf2df32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5035adf7591c364d53476ea074e360aca
SHA14fc7d6e2f031bfe42f3ec6cd2d15357975de28d3
SHA2569d266108a42658af494e0914ac3edcb6aba6312b7b22f539c71867396955578c
SHA5126a7dba105f53ad97af8975f89382c05325ddb50ea92997e91616535aa2a8c1cad37f709dc3029b1660c7002f7e9d49ee625254612481d2116052ebd29ead5c32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594f45328251cabebb41f3cffec4a35e0
SHA182be599250522f19379e2dd90c011ae281b6c782
SHA2561ee687c9bf900d6af48607344fca57cbdda9e02ff11123202c8a81face9960f9
SHA512116ab05f1128c452d972f36903ec199f80e53d0b23b3081622a509cef0838219e2bdf365a0afa1dc601c4c2a0120fdd287dd6c9e2b7471a448b71d69259e171e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbb7ec0776db06a37f283755186e3242
SHA14042e8fd6798d272b60b259d06679af059e6797e
SHA2568b6a302cf1cf0e04b2535f632c9b1f63ab149c6409374a05be67f27fc53e2180
SHA512a9451f9334cee11955b3cd3967a151ce269af19f587e3b5bac42602220ab5f167ab4bef711f1c9a945803b76aa88ffa2912ba14b99fbbaa25f9e30f9faa20b34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f6187a1f9f3f0d92de667778e5bebbf
SHA141fc101b19959b7265a070a7f38af48d47d8d606
SHA256de71a3664ebbe3ca03f7208eaf69897d2cd411565958f72c9fc893e037ccfc50
SHA5124d9850f3fa2022414e1f926a5123887df3a24bc433968f6d5aef4552d24b5ba46b7ed4117bb34adb2f9c70ac036e3ab9dd91b0427b1692ff0cfaa75457938274
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516285735111dc1f3a037560c6e94a9f0
SHA1c264ee88fb775ae65dbfb2e40200fff23a7634c2
SHA2569c390473197ef274fc39a475020591ea79dd56ac47b29f0711744e6cbf76a79e
SHA5126335bef40478684340a9571d55443746264dfa3b9b78a6347d93d2fb778ecc2bbde472cd2055f544d293c98d06845539f240fba2bbc186f5e78853cfba7a7324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6ea6e1ae3e377a12ce2624e31dace3
SHA19ba3cc6da1c90dc055927ba0a55abb0718671b24
SHA2569b44be7ded08b5c40908c552ca8f4ec318898ddc9e1867d9060d63998a0b05e7
SHA512657d6bbecc2b1e560c09b5613c2435be91170885e20317f4f44f7cfe3819e13be9f7b24665f37020e93769aee3bcb1549f8df6348b5a621242c925a848bcc858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6611381668637c3e6c37da8d19c3051
SHA12f548f4599245a97cab4ae9814cce2382ef627ae
SHA256f4d53191931c2e1f594debebae28d2355c4abd4976d045a1c443e131df300deb
SHA512ce7b28fd117226b9f27347c7afcaeb063903c151bda9e1320d853bf4ddd98769e69805e407200dc08847bd5d5997a6a75e3cdc48398bd6a6c219a58e6c65e33a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea4df853332147d0a65299bda158c6a8
SHA194c5f381e3cf7133f98153b174a12f0d01b77373
SHA256ea18099fa569a62ec65662da106a4ce9717f73153c061add75954eeac50899c7
SHA512e08e7c921e152020907d452080c8c898855671290ae4d9ac3783de20e62731732f4ca1e1efcf55094fa47222befe9d7bfb873275eee03c47bb8782d83d8272b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df49d4af385107bb02ef462c6900d519
SHA127e34c6ea0935e983d622555fa3d82fdc2469ba5
SHA25632025afab3dd6f3e25eff73882ec92cf972f385c2cd823bee11e5d0c7ca2c0a8
SHA512da507c20fffecb4004d269c4b1fb0908f02c2eec90f966feb52fbd6e6b5dbdfbe22d62856992188878f9e6247b1bfd068db495e380099a2ff1bb4c6b6a60de35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51191385c6a7365b66081d70057d74b3d
SHA174023c259c4f9826d096c29f19cac6c6c89ffa56
SHA2569ee16d8f6208a7985bd630722925ca6ff386db5c883c6b0ced5f5986c8da95be
SHA512f31361ee50fa17a8845bceedf43e8d9b41d8f72540303c0b3526f8e7bdca571a0b3c339f820d60c8810fedc7f1ba249870adab4819369d4156475b6f4a1a4dc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c6d0460d491a8f7fa7bcf466ca17ee
SHA159859b27ab2b2e9dfad54dbdfe182fb6c0b5c14e
SHA2565f2f821e9ec4fff5314557fa05e60b567389885ea3878a7a58bfde460d13ba46
SHA512e9d905ec1ad6e3ed4505d4659f685b003879f9b59f44f7afd5651c483da7aa6bf56ef0dcd0638a186a0482053bb9abdea834a7958168b4648915223e8dd00157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521a38cf70701a0598eeae00f2df60ce2
SHA1a2a2ed95dca69f341af39a39bb0ffd42789863d8
SHA256011b6789fa8efaadebcec97bf1329e1ae5c6b03dd8859623667657f8cc5523cf
SHA512b1c16dff2f9f2c58965822f78ed0c369c942e9782614ce890b1c64c24ca3a0b0b9fcbab31ffede0cf0987711a72f4ad617498ac79a201448e823ae4e0c7c7d0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e11888af9e72c021a204072f6c96107
SHA181608cf2566117a9b478e68a537cff2d2a4b1a65
SHA256c789844058c549f51bf029ac1872a9a4b8227d462d0b00755aa4d2115dcec592
SHA51276a327c84a24a56711d1c0fb3da7a256484545246ab4ea18c12eabc14e0ca7ccb7f759500ded2f278136827067660ed76c901494a5828f9ebee5c7ed482c0e46
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63