Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 08:57
Static task
static1
Behavioral task
behavioral1
Sample
c57996ab3b5224e83a2b9ebbf73a9143.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c57996ab3b5224e83a2b9ebbf73a9143.html
Resource
win10v2004-20231215-en
General
-
Target
c57996ab3b5224e83a2b9ebbf73a9143.html
-
Size
5KB
-
MD5
c57996ab3b5224e83a2b9ebbf73a9143
-
SHA1
84a04e967d232169c0ec25d37ceb1a6e128b7d70
-
SHA256
13705661a0cccf6d8a0dc7afd18a33941c4be5f715fd0d06ddd361d9bc5a7198
-
SHA512
9437b9f90ea49581833878aaebc8915882874fd8097d864199a3f3d8a83bc3558bc06bebcb507baa484f6a320b412ece2da9b1f647868a7427405145e3810f9d
-
SSDEEP
96:/hGvwUyJyHHlYf4GhpstoNLiQmtPOoNZwm1o4iQXKIfbZpZRqmEN9NO00R8C:wSNWPjNiYNZxpD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000d2a69de8ce52f74d35d8924dd0675a5f894b1e9a8078e9b66bb943280dabcbd8000000000e8000000002000020000000a4a87d982c69f9e5326f704def20e4fc29e1b7a82ee6a44247b584a7712db37b20000000ad748ffe8da5454d1240ef90179813e523e6b98342e876f7700a3cd1328765b4400000005e6bc99c1c650941399aee7721a454f42232ded439d3359a2be1cba42ae4ccfd0777a6213e7f1b1818f793b1ebd6a90e068f4d7e44d51f2890e91dfc220282e5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416482127" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d4678f2475da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA3D77C1-E117-11EE-A920-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af60000000002000000000010660000000100002000000002c203f4e1ca6137afbd9e6fd3fbeb9bc6c477eb87c1b29898a60f9c6ac2ceec000000000e800000000200002000000077df7c95c6e34699973036ca4cbcd45c7ffeda09252752e100b9253da57cb57790000000cb8711fa20f6c44dababcd419d82713c61c36a7da926b0fc25ce08b98cb85ececac1cb75d55db2518de9519f80e1a580bc71c1dc40439567c2264633db46c63c6f904d588542e6d68b14d2d29ef31a2940466ab9ba847fa768cf7d89ba461703a73de64935c52626f6f842a2a969e2c8449ecf0079dc95e56c575f2659be905ac779ceb1c2309800fd1136874b6adc47400000007e42afcff2a722040c5754e0acfabf77dd42845f6f6efe88c90540c98d05a58d3f6dfadc13cfbcbc0a2b4519d54cef9e5c71575c242830dfcc03ba3e3adf2f64 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2340 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2340 iexplore.exe 2340 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2348 2340 iexplore.exe 28 PID 2340 wrote to memory of 2348 2340 iexplore.exe 28 PID 2340 wrote to memory of 2348 2340 iexplore.exe 28 PID 2340 wrote to memory of 2348 2340 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c57996ab3b5224e83a2b9ebbf73a9143.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b969c49101401626385735eccab4cbf8
SHA1bd3e04d6a9376887ea4c946e9f205421015257fe
SHA256a309c9701d4c4eb356203d4d80cb76446f6c1164fbf6c9be4a2db1cbed6c782b
SHA512ce1e9242817df06b17be28943c8c08f405d80ede5c3474518998dccf552f5e16e0c2efc0f020b185aa690f099ed6f81a548d131df778fe1da72bc31b22e8b8ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea477ca8118151cdd01c64c344c612b
SHA1bdbdafbaaf8598d6f64e78e200e7a9fd9de3a5e5
SHA256e61a02aea3c082868919442243cf9fd8d0811ff889f39dfde5cbecde9eef77c5
SHA51241cb8d7aafac1b0d5526725b541fa27cbf29ca86404b3b7d39108202f34123c65d97b724789b1898a9b488aabe12a113b8622ccd2fbb2849f5da6c157f8d16ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5842cb7be40d2b180f54b5526687e991c
SHA1da5a9aee6828d7f917f74596cf039b8e160617e0
SHA256ad9a3e8ee10ffd665002eec4ee428005c1adde2d99183ad599a6df5e7395d362
SHA512c779917ea4d90e5fc1c145da19d4d6f5fe8d87a543809caf91236d5c337148b125cf37ae36a58a02841cb91c27155cbd7f84542e560742849bbc55ef41a70616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595a0b01f4d1aa4b1a9273152c6a88eb9
SHA1039f081bb609694ae9aa44d2ff26d730abd82e4e
SHA256d95d42043dc89acb44d879dfcbe87a9f8f83996e031a23c74c2a4ea33d67a9bd
SHA512c6b7784767037c8d50f4c5bcda549c44fb0f5e25d1eb076ff41dbc706e3630f770e3f0933c4f837c807974b692bc3b53a42c36f95d370e0b6c8387438b392381
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dad48751207f8ed7bccf7c5cceb6696
SHA1dfa6444bd139ba634cecffc48505984b43292c9e
SHA2567cbe1ed5da8a12c616dfe91f5532e9e88364e299ba1e3fb0f9c8a3cf78e6ca9c
SHA5120ae4f7b9b62e03e2d51cf9b96ad771ec6fa060c514648e8560fb183fdedd809d2fe759540cf8c4079a4b32fbab32982da20e984019140f2897690303bf9ae6dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb475508d167ed9eb2f6e560e3049279
SHA1982b6aae5eb7ef8f73ace18e3995317e951baf4a
SHA2567183cf0d534458957d116a136c0974f2615393335772c6dfd0b0c18a7a45a995
SHA5128b97454306966eefe0851230c20aa6ffd95e0848d35114a841bd560f814642df9390e200d0eaaf380d62d1f874b0c94e352a9eb2371faf84454a97d13dcf1347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5b8fe8961f9a6af8d5b7261c95a536d
SHA1957d2c5632882f5d4bf3148d5d644bf6b61b1b45
SHA2566ddfd47aa219ddc156448918d48e62a226a576d8c1f0c5fb43cfcf1b5cdf6f2b
SHA5120ef9e3bb7ca1346c9406d29d74d4443611b1b7e948e0099ac93bdea81b3ed5ea06c477f25b5805d6b2dd81cf8b9c3b7fe04bb5da405777d9851013c91c0d5b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5990bfe72e5dbe8a9004b879061883c85
SHA16d93fcdc2d8dfd89003afdc350edbc4003b7d2a8
SHA2565d8ac93d942124b7a630f2bdc8f4cc5b62563967db50d34050b69b9ce0404ab3
SHA51272c4c44c55438e5338b1776d5f993e5503759fb2478a532fef3099739fb1dc7d6e1c6f286a956dfd4197362cbb7bb47fb578cfee9172870ca8cb91dfd494a65e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b90ec13bf715d77f77048ca52aa4e529
SHA11e50e92417dbd7b7c8999d0807392cc316c966e6
SHA2560e3ff1acb25f5fe7a966e67bf72e1919602587942cea2e9bda88fab96b069352
SHA512f09229747c2ba9fbda6586e0f0ebecba7fbd3351eaf26a0e71945da4fde581c9e937598dc196eb54cda7e430ee58632c8f234fc394d73319840ba4ed73391b28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5385676c69c8b88f726f5b9b6db40613b
SHA13d39ad86ae05edb84416d2c4ffdd076cc5804f8f
SHA256497fafba1bf561248ab58e3b489704cb20f09353d84d0dcdb9279d10e2d05357
SHA512031c65cc89c7b11445a5065437ba858476aae1e904079cf4762d1835a67e7139fc1d56d6ae502b8ae4b1dde2223bb9259810d984d495668cc920663278dca78f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569672a477128eb8b8fe1c826b511eb4f
SHA10c27e592edd8fa24f695f66c18a6462b49d36bcc
SHA2569aed865aa0f2260ca77258bdc41128da10907944a20318ce2e5ff7b9573364fd
SHA5129001a9127e065063eeec091842af54e82e9ed8670c416968efef8627aa36f181115e0733fad56becc99ffe02eb598f689f87ad5980688397afa48a4158885c45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f75f0ad345b964c91039ebc73c819c
SHA152f3e09163cb889a077ecc06046222310b40ca6b
SHA256677d2bd978287cd5ac0a76086df849905802a56bc15ae1ae6da5943b2ed4d5b3
SHA512f874450426468f17d8063b10df5d37c69dfa292dc9235586cda5f440f6226f7a7e0b881451816683c8df504530bb6d046753e9109c90761a10d69e83e50186e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554bb61ecc595be7596a9e6f0d5890861
SHA1f5eba6a9047403848d53da709599384e50aa387a
SHA256864d9a1cf7d4676acd25883f62b481a09fb2d0f511ebebc35733aa8e7ea3e25e
SHA5129aebb72c617eed3256d582726680c3c6a0cb37feebbd7b88f4ecfd7b10e9b33eeba30270678de92f98103607d9ecbe3113c66eb6c706096aa7909389eec17138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2e0995ccf46117c83727304ba4bc4d0
SHA1dae956f7192c4374a766f16ce358163555c754c1
SHA256bb2ab99c0d41047269c6f089749385038ff3a25a16e5904bdfac77ba8da8ce5a
SHA5121fa2c6a13f3d9ddf1f06be60a0c433462740414e9a440a785df0f7044053dbd95c13ed3129c2bade7ceb68e89435fbcacf93d6c9b9b7fa545a9d2102133815a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a016d5e0dd8f988047738de46d6ccdd
SHA19aab55d87f7bad7ee7beff2a9baf97f71ae6a974
SHA2569fe357212343014d7184c0149e1f368b83f4a5abafab0fd52cdbbdaf4ad1a4a3
SHA51205067da0af4879ca577944129bec3740a2f072d43033040011360c50aa61e283fbe9eb4b19566a39688cb7a998edad6dba9dc9143b361bca19fda85b45b4663b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504540670a4fa18cab5dc74859a6ab58b
SHA13d022b62bae9df4c9f3476f37c0f32a429f22c90
SHA2567bda51a4af2e38bb337a91c9b4b774548da80b6f06ae90a338dee4f800d7dcd8
SHA5125a7f31d2ebbf520c878259e27be79a5b274e619cbdc428e8f54ee2e5f9eb6c947fdd2aa54aada7aa3cac958b927473eee269a21cfa429a9efafb7e25fb2bb41a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e50b9d3e9f6cebcd66351e10898a9eb
SHA11c9051db785cd85b06d966ba1a77257b9725254f
SHA2565032e7f6c25089e726c84d40798d7fc116af5a4d3e728cf0b0b9407004c1ca90
SHA51277f140b6e883977e5cd0da7ff90716d04077dd4d1e3b516c618541bab4f75941ea9ad601911d9066053d8cda732e9c47d3bf11768626268d94315f172cd1dd59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b274f3db10954b6f6d4c6cf18ea5dcef
SHA1e3955130e7cb80bf78027b8a7c8a28fe76a7008d
SHA256010e20e2e715eabb22952f0662d172971c76b3c46c54781c6461ee6c7fbe866b
SHA5121cb38331a20e4cb6fea8a61102148ab306d170ecef4c4d12400bf4db8fff3ec21a776130c2151fc7915983dc76b78b7f314bc57e312fb4b24442915044a0fc06
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63