Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 06:49
Static task
static1
Behavioral task
behavioral1
Sample
c2b848a63bc13a977472c033e53bedb2.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2b848a63bc13a977472c033e53bedb2.html
Resource
win10v2004-20240226-en
General
-
Target
c2b848a63bc13a977472c033e53bedb2.html
-
Size
90KB
-
MD5
c2b848a63bc13a977472c033e53bedb2
-
SHA1
46190dfc20e806a8a694e52a4db849ad3a7ca5de
-
SHA256
e1c481eab6722306f0f8a05eb164bb416d4877e40f25cda275c72bf56e2a8535
-
SHA512
00ed20512d3ec092412ca195d1edf2401bf2d644e462a47c16e58dfba0fdf10079e618730fa356e97c4682702de1bcd4d0f0da98879ba395dffcd133414035ec
-
SSDEEP
1536:gQZBCCOd90IxCg0Pr1rkw/MY7QP24KwgYgRZtG2vmQryIA5oN7LNWeNvI58ttjkz:gk2P0Ix0ePd
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000005d857a1b2ef3a2a6694c3c2512f936714108c02dae32cfb5263063823877ddd7000000000e8000000002000020000000197fb50b8d0de7e2ab6a7c31249f30e9696e0a763fb97a4e7cf956d2f770b26d90000000a1ccc873682df4d3e762b05fa77d1e11711e7013f0d86181536f4b2c25d5cb1780c6763fff0b012130cda42261d9a626ab7d9e4496dfd44afd70365e3078227dc2deedb5088c3487d61f54ed8e1a36adf3990f8f8709834f719a860d7e275e5ed87be75775d7648ab52fb268d3717a8eb34dcd7e9efa637f104523db8b4c28bfe0146d7070ae1b62657a757604dda941400000000c3bda2507aca3757070736ea8776c3ce7401b4a9b4c5e105f34c3ff8c765698f0183d4d7e280aa9df1b22072eedf5dcab4bdd22c47dfb8a7fe65841a06a0d19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ce6b7e4974da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416388032" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8622541-E03C-11EE-BC96-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000052876b1428dd9ab48c9bb191f675e0b51a8b0b2989d2eeafd330343d2c563cf1000000000e8000000002000020000000e3159e7f557cfdfbac4b723e39b03136f62ceb0c44a90d007a0d1c99c172303220000000aa0b2722dd0813b1c6f5d135b3ca552e077444da2579a072ef2bdcdbdfe7922240000000a0e42e4434f4859acb947238d592b9fc199ac0cf76995bf84fc40bf0eafbba2f1b41614a36b87f94e1667e26a7d3a7af378f8aec01b7e05cc07e18727ff88e8a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2632 iexplore.exe 2632 iexplore.exe 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE 2500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2500 2632 iexplore.exe 28 PID 2632 wrote to memory of 2500 2632 iexplore.exe 28 PID 2632 wrote to memory of 2500 2632 iexplore.exe 28 PID 2632 wrote to memory of 2500 2632 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2b848a63bc13a977472c033e53bedb2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b329fd7449024dc69b91675cb1e37a8d
SHA1cc511b9b6bbe4019e264529f8bf92572f1cc87dc
SHA25617e009c79a06548fb9fba3d3379b390996c566b90fe9fe2d0ecd820fd216cbb8
SHA5128311bd5401778a8f54986c775e97d0b40ff1ff2e8079e0215df3c60e46be73e34d1cac096c6d09ff241faa5ecec13851c63b5df7df4760ca83b7fce5535a2ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c334c972a17f63fbb291804579839f1
SHA18218199aca737b85b1305047d0f82b0b07b8dab1
SHA256b562ecb0eaf5b35e25fe98083ae6a25a7aea35e4c5d6a7b60a95c7bf6e285749
SHA512dd6ec5e850967f841727cfc46b74de8e31486364df859d27ada3aa3a0477d7f1a3303108a1a58e6155a306bc89a53612c445dde09b71ebc1da47bd3974e4f1d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aee3630276248b65002bdf796bdd1550
SHA1f5cdd6a944b37443c470b5448585c88bd1fa8d69
SHA2561b74db22726bbbd90dbbfe49cb115f9f5b2701f8ab0b613598bfc79fe9e7cd34
SHA512ea45351bff087432a4002eaf24832b662fce6ec62fff2ee3818937f9c9069711c988f57940288bf9dbe1c36f9eddbbc591e2d72ab848ec4fbd433ff0c4b5ce70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561875b1f2d44c5f29c7f1d7f11eb55c7
SHA104a44df53d7ea7b16ab7a3cfdd236df38f7def24
SHA256347d74b66911916e50d9f3bc894dbe1a461177c0734fe027e33e0df252f94f8d
SHA512dcdd2faa17804246336cda6a33fa445285e6970f64455a3c9437ca63f94fffee28ac04f5eba55a6aa049433c1e7cade7d53a67bdb5e172ca934be74103a59e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401be613070a4e575f996f22fb096d8e
SHA10fd96b7661138d09c967c8bf32694a2069d77063
SHA2560ffe43785b9336d6223ab517e510d14766fa301fc18e981ced180497ecb4ac8e
SHA5123c597d2181d382d3b4617124a4f69ea4815f78ae364c06ffcdec94473d1479077caa36d61fb19bb535826ec525bce1fec5ab7cf53361cbf93eaf58a66597a4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9a5fddc0e9b55afc21562c79fc60bfc
SHA17f774f27f918928260a2dcbade2e81e439e6a504
SHA25659c6202f0e542f942aa1e342a088f01447bc562469a0a53f71b42ebcebad3527
SHA512205fd49143417152f6472cebdd59b7be3ca187712e9b15aa708f843948d1eb4a033c6d5f503e5ff5e33b0a07001777f858a19bde46ca0428b5b97d4d2895085b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5263cc0997f44b575b9255079f29ccbbe
SHA1d67441fe556dd1221370d84a910326659dc2d3d5
SHA2565352a6691cdbd19298ac9757bf9145e8aef847a794e5c1811ba4ae12d9a9cb90
SHA51231e6e3e3bae5c0a712085e3e168a87b29542d74b0e09339f65a5a4e6c08be39446c7161e8ceffbbddebe79430642ec009d9a0f1850c690819d9793005aafe7b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50008bcb45c1874fb05682c9c68a1bd9c
SHA19a1f0b024a7f69d7663828ff8c5c0b6c7bbb643f
SHA256b412a4e7b576a7b8a0f497debfd1f4dd983968f8ef7b68454408004aa9a3e234
SHA512e580673bc2048ae3f4ca616b5b5b28a937ed47aafe68f4f5314ed788352a744ad3b7d73697611b2a0ea1d0ad9542f6a200a1e5e741fd0a7109d86a78c2324755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0d240ff20fb2832b09b27c4c0498d82
SHA1f1867ba23cba5daf2100e3857cb0ea029d11142e
SHA256792cee952262132ae4db71d3b39aa1824e3e562e973a89402976bb9ee160f60e
SHA51261915c433a1db3effca8da91eee81d77d57acc295b1a2183a9002025f26f42ddb7b253598e12cfc58a05fa7fb086b883a35d5f9a9727f65aa30279e64ee72e8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe93f71dd321ba9fd34f92866b98bee1
SHA1e650d476eeeb40392ade56fb1b29f804f9ee9765
SHA256226b4cbd5b54750cb431525347bd49f12e7bab85adfbdc3f3009054181f4278e
SHA512feae63b1a0d69856b24cf07485a6084ce3751f0b181e0805020e3cca91cbb0cd0f04338c6bd0154bbaa821051186e7f1acbe9a9817b22d1f94cf013021b3600b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aae1fcc7860f3298e134e60d7809777f
SHA1385c0b26c029ebce071686e95e568b960b583f95
SHA2560121ec7d5e0f0754820d033b780b13c0091154629fe6f67eaf787bc0be5573a7
SHA5128324f441b77e9badd4a718ebeff624a5008d0366c71919cb66d8416477a7cc943f47326229a15c5389646b305e361bde67db01b26e55e113c28807783897459a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582e5aefde5658673dfe4ea00ec293cb5
SHA1dd3d0bf0af7f8d1dde9594e730c6aafd35a8e94c
SHA256633d9cdcefefea39ae38a2d19a0e6a406ec1548abc051beb736deaae1f6363a9
SHA512c749e56bbf4428b0117fc739f5da121eba7edd6c7df8f2fcb6405c052acb85357fd8a9f1474611099ac0d065e5896661c34e33b8caa002d273c7b9f05f1a01d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d09bbce8b2f95151d3af4779571a6b0
SHA1329172a4f0d637eb278a31f8b42f5687d9a2dff2
SHA256e8c1b0d7f36fc97c8a0744d72dbdee48bb7e5cde68becac1315f91249deaa64d
SHA51297444975cc8c5db254bcec1e5ce22e50d1b6870237207a9776c45dc8caff163c801dabaefd39008b4412f95c5ccffcd3471dc489bdcc599270142bdb113d3edc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59988f0875af4b4545113c759ddfd7600
SHA1fbb97587ad1211b6d4764d12537b509c25dc5153
SHA2568d37f86e791e3387c9d184f11c65a8dc86543aa3976866b0be3294651e5cbfcb
SHA512083f01b47fa4e3d1bc04ecba6e09a70815fce15b0ca326332cfdec86933251a4218e5241365af35830a229275227a504685793cd8edb4c9d957d0dc266515fc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548414de438a2d8a0a07d30d7d01ab0f5
SHA1dcabf72b2f940c81011df9a213040366e21c6b9c
SHA25614ed7f8e30873be719884108697acf4d8963ca4f81ec8ed7b404f46048125aa8
SHA512b1aecc1f98c94df13b269c0aad1998f2606cc19a9ff82758955154143d186b7eccb5bc5db4f70e8f942ea1959dfbf45c19a055956d350fad5d780612dab11015
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5255673c7b3c1223f2e16705064744ed5
SHA195a84b6281cc4a0f582b3d1de270ff36815fc50c
SHA256033e36affa98ac67d137c4cef609411e955b30a20799dde04a167afe96283941
SHA512e05ac48b70d63fe07a07b8636ba8d017d7f60052c2a06ca8c88dd760b37244dcb68f15d5fc69e8e57fbd20c4bd8ecfc7a7bf8c16ec2ddf6ddcd237721a937b2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54495fbf70344f357ee623a66d86cd759
SHA1e128bebcec9535d99b6735e2d87918365f6353aa
SHA256f2452aa7ca3263e44e493338988d7d555a52fff10e707548264d079d9c6494a0
SHA5122b4601b30163dca308471bb3e98a817cbf16c6a8de059aa2203458ce376f746ae43b829627ad9eff9a78faaf96126ff5bcc830f740dcde6a5600f61e924ad37b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63