Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
c35348f84141c69a5f602af4debb154e.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c35348f84141c69a5f602af4debb154e.html
Resource
win10v2004-20240226-en
General
-
Target
c35348f84141c69a5f602af4debb154e.html
-
Size
9KB
-
MD5
c35348f84141c69a5f602af4debb154e
-
SHA1
3b7e7d8eb6b47956aecff809ad5faf926fc5706e
-
SHA256
05f1ffda9ca2b8cb3adb4f3a9d4eced3e1d1491791aa42cf907288842f004149
-
SHA512
faecd231504c91885d69b7febe6252ee072eb33b585f66fa39faff0d9960fa58e15deff0fe3b86276453c638b239ed611109a903996cc7c5edb2d49d3f844f1d
-
SSDEEP
192:PvMVibe3Q3izaaI8vrMx3dT29WWWWWWWWWWBsemneKdAzNa/TU:sVi63WzaI8DMx3dT29WWWWWWWWWWpmno
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000e03cc0b8471f6b1aadec300b306ed426461c4e0f60cf4a28cb8249ddccf36807000000000e8000000002000020000000f3292980c0198d2038214ec4a6b2f73fa4196c5f0c039c0abb9c8236a4f2977b20000000fb48b0343f0184a8a45bdc7f6fa4dd09d3a36a562413f553a68ec9bc318aea5e400000004cf1805378c6ed73cbc2a7c97910baf82536fd414eabe8cb4623018a15cc8c8343b41096107573eb2fd255730fef003cf4387aa9bbac963f82e3918e8de3070c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2444E61-E068-11EE-9502-E299A69EE862} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100ab7b87574da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000643c5e2c8db8863e03e87371b5effc771fc854229607ba732d80e5a4d6ac76db000000000e800000000200002000000063233eba2faf80bc7f8c92dad6b12cd53c682bcab541617c9a505059263a98d090000000bde7741f2179e3746aa2676b97e702f1f7d7f9def1927d2e96587ce5547ff8b57f3b27c50fdc94502cd57e11f687f39a3c5009e5982bccb384e144c758fde5814faf54ed4210101b1e3077ae76ab9015220ba0078d79510cb7c6ea883ed3a4eeb9e8be6fef91aad7c9b9585a7ca82742a52f526c47e2733a5bed0793855d4b548ec7d92a3b8bc84c339a8ac271ce0c83400000009b951feff0411941b836a9ea3f7b6ea174e09d4611a932bdd7b8215cb8c5faa374ccd0b2b80d2fc3b1b1070771f43798fe4e70c4eeeb6774199601a897003b4d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416407032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2596 2008 iexplore.exe 28 PID 2008 wrote to memory of 2596 2008 iexplore.exe 28 PID 2008 wrote to memory of 2596 2008 iexplore.exe 28 PID 2008 wrote to memory of 2596 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c35348f84141c69a5f602af4debb154e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ebcdbc50b6d232373e9f769a9acf410
SHA1e24e155265247d53a171859bfc0e1d112c0885c1
SHA256718a33ae65960ead41952af784f5fab2e13a41cc8eddc4e48658059df5147ef4
SHA512d5de51c5d720dc326b7939917549cff1a6ed7fd5eb9259a5196b84bce5fc903f760806cde903c52e9f7434d9a366a91706e8d0179d0c1b7e9d7569ab2f4d1d3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1d64ff50ab48007093c85d68864357a
SHA14020f7f9a9fa3f82e2d9bc9a67ad1a1c4a34dac7
SHA256bb9a8ac21afb0a3ca36762121bf0caaa8f8a4e167afc51baf9f9004ff2ceee72
SHA512959178cd9cb64bae679bbbce01875d884bb69874039feedf3e3e505a13b47be94d40e6b4ea31fda38418ae9e8542d1e926eab0072bfed01b8716f908621f8f7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b43af472471c9c8e61bc6e498db4a440
SHA1a4270773bb45f259d0076da43b044c8fd13ffd97
SHA25613358aca5eb645b6cf41133433ffd3187404303e6ae44c453ff2b2af26dbe9f1
SHA512ed6e5d1e768b8f448084c3750b66d73020280fc3b256578a5bf87e09c5f2cc4bc44fcf672871928b4be3a694c5c73c484d208a7262e83e6d56432a8fca650432
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53199c21c5e7738625aa5849c22049ce1
SHA1a31039410e1eb05e473f795925039d76c5ed591c
SHA2564b11edb365c622901de4b40cc13ef6fb4c9469cfdd79aa984e481eebe3107c9b
SHA5120569dcfa9ce1d2073a9401586cff13e890b133dbdc0b1f67aca9cb35931a6e886e9bca9961b7ff0ad0795397b3ddfece73fe12ea4024a5b158e5360759e9d4e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59734f10852046d8364393bf448aa5b84
SHA1732c039e9450aa7580f4c70dda76c317c76e2104
SHA2566e02671945bb4c20077bb33e35b087405af9fcd260bf6ad37caebf24deb462f2
SHA512e992cd7e128bf27fa2b274e18dc94e0239c6a2228bb4e017582217d8b0842e09615704a40f825eb7ed51543c89666b549f744f43d3ae63eb8463c31e52ed3758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588002aae7b3fc7e8133ffe20d47db06b
SHA1ef7a41fd620323bb2b765c9bef6104e442ae6385
SHA256f45e7fbf29f3ead5bd217fded63c4e4fdf21336e5bdd71ef7c1740ca57fda272
SHA512c8cdb11a9db4111de46a22267c469df480cd98819aa06a9ea873635e956f0601b2e371a14983d741d877477a59aacbdc2180faa75f39803795b9aff056066d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a415a418f4c74c94fd9df49b3290a9dc
SHA183c5d447deaba6a9c5e1835a226d8be6c05a5b35
SHA2563f72d4d01443d33231f431300414a71718df48e452884d6e05fb72fa236d9545
SHA5128679f21fa4396d609f7046f71c9b08c66d4dea16024e7b8c8f9f2aa61f23bbe73b9890a4d38c7440080e39753da8a814fa2fe096310493574a03b60f93f7f149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aaec46209cf83cb5e03ee08076bee97
SHA1da499ad038aaa00fae0aa6227dd32225b06da19c
SHA2565494433e9c503f4faf374c03a8bcf5ed0707b02419760c4e661658f30d91a118
SHA51214e42e866817d334cf769464237be8b406f885691ec0ea7ed13ba8c3389de3124763745e52c247db857469796fbbe36eb0681e80ab90a631c106328e8c01cc5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f25f4842abf58bbe4c49c1c4f5a1bc
SHA11a4b1cf9936480c28c6faadf8478a0974a36c17a
SHA2569a3058bc5cd5a8c85d8020d0da4e4e2dc6aa37815ff0facf08a576a7b7c463e2
SHA51294feb6b563bd4fd30e48cc0e81552f0a57167c9f56e8e11a785eb602400d7ea819ccabcaffd131d81586da3ba04f558742d41c4b5d0fcc723b7616002d9d452a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509dbd86508635f625b2ffc4eeda1e70c
SHA1ef86da4458b2449fef386cdb8cbbfccd4bb3a431
SHA256743944952236ef2f269d7549447a03702d8718d6f22dd8edbda20f8300670837
SHA512d9a7bc62b91d080fc3873111dd10f9e9b9ee00bd1b45617322856e052d907d4de5d289f6783a7e56da457809a285e37c7e03381a04de53c81377a3b9bfcaa138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571ae57f79b1fa366750834ddf095027d
SHA18b35d8a84ce6204b801b612cd45dac728d3ab4a1
SHA2562e24ef3cf036f6839278a34fbe7009be2bb2ff0117727b3cef6db2695cf9c023
SHA512449a38fe561caf5e5d279448f44a26b5f8f72cc9d95d397a8235467dbf9454693e9d8b520880cc47b9ce80c5cacd294f05512573c60dc8ca0b0547a9d16faad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b132fea1d3b2b79d3f0d58dabe932fb5
SHA1351cbbd8974cb02c266a91643c8f0b756b0427dc
SHA25656107547cb027d19d851c3c5058d6554961b3844ae8aedff7580c57bb7644a68
SHA51288a0d5c3147af2fef43c4105b4544d730b3f6dca6d2098efcd0cd389112e79a84e2985fb8802395ae9f0d40e3d0415f2e7f5e15f3c95a91cc5bd75fdb7fb25c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57df9d8c98607082888ff7c7f01b93fa3
SHA18f1a74b123cbcc9b4f9e432f26d22c11e1f92f23
SHA256f29ea873761bf1fc239f084fcfee8c95eebd905eb9262f1054b48faf24ef500c
SHA512503fe08cd1e58afe695087011a9f860223f285bb3b5e3d32f775cee723bae7031984779413f25d889bb11d7d62ee5650e3f05be145e39cc8d08f434c760c4612
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53da797c0a5f87d1df7f62df0b69f3d09
SHA10a399da3c9e40238d27e4428b6fb509a2af1d249
SHA256a092088caaffd9fff3f9e28da63cf5ec8efee85d40b25b78b5f3e23dd20d2833
SHA5126e3a98f1f3a666bce2396191f4d9cf5b3cdebb1a1e08b43a5907b70b962e2d9338886688a0a202d26cadd9878399289c97e4d26f1d97e103a18ab9731561ad68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51decf207325dbe2af0b8c3b888a01cc8
SHA11c6367fa9c4f7b102648c1d1a3df10f2d1220d82
SHA256bee661f20c6b4a67c24a5eefd7ae1bdc0eb358bc9c0d8dca37f3886f6595a1a3
SHA51224924c3d6d4298da46218541e82661d173e251c2f8e673d2081f1b267ec9c6db98b06f72840ec6146fb105208c415e97c05f2593f5a9c7b9fc9f9902c694797f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5708da9a7ab8914e60a6dd7d025277be3
SHA1ffd1c1772f079aefeb970d1cfbc343aa091a1d8a
SHA25605dde983537dd76dc32bc378d17d8392dedface896afdc25feb05c2b30db7933
SHA512fe38225fe3a19cc42584ad6e1117c9dd193d9dc9f6c63b8886708a485ae89cc62c2326a15872589c6da6f5480f32678001b87e1d76606fe617ea42685de9df7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55724e04497d0ee4664039cc09b14f0f9
SHA193960f0462933c1024cfbd23fca121b0ae4dcf1d
SHA2564649e267ded628d0c8ff232c3ed93fd07c5ebc73df5949c7e45d1d465b70d8b6
SHA512f83abce73b2f88304b5582ef0ba2df1a086c2d65dfd0e0ca2dc732a10a5eb9cb6318acef50b87a4bbf3d3d21e225aa1404cfc9cb50886b2fb6c7bdb70dde5856
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574a3c6fa1feb1d78b731280c29b32dd0
SHA1387a731208af40e462e3461999e3e4f358650c03
SHA256c6b7c47a736fee5193cecd697d1a13443859dc8eba5f7a3c7b7e1a66365a6f68
SHA512d2e2594ac60734cd2fc9af488da749979e27c2a53794c159229bbd07795f5ce769e2e56d49eb84341f0bcf40e507bcebe1e96ecd5fc05b56d6989c29c97526f0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63