Resubmissions
13/03/2024, 16:53 UTC
240313-vd8bpsab6w 113/03/2024, 16:52 UTC
240313-vdwmxaab5z 113/03/2024, 16:52 UTC
240313-vdmd8sab41 113/03/2024, 16:51 UTC
240313-vc87lsab3z 113/03/2024, 16:51 UTC
240313-vctf6aca35 113/03/2024, 16:50 UTC
240313-vch1esaa9z 413/03/2024, 16:50 UTC
240313-vcblcaaa9t 1Analysis
-
max time kernel
1566s -
max time network
1573s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 16:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
mjjjj.html
Resource
win7-20240221-en
General
-
Target
mjjjj.html
-
Size
15.8MB
-
MD5
5d82050346045d3c2ff2677436e8182b
-
SHA1
14034ec0db53f3c11cb11dc095398453d6fb95c7
-
SHA256
23421d5681bfd3aa75d1a00bb418d9df40c9a915f7b4e70e3877d5d204e7d537
-
SHA512
c9221f7aab9b1d37c89ed61340f606d219835fc4080a45d5d50b1f3679d981a61e2cb5547060ff4ca88bd9f80d4e9440f49c4b8119b540de8d1eac57777dbbbc
-
SSDEEP
49152:fmDz4cz3oSrcBRlyqYGxGK4xsmgrFsomEArSBU2vIzhd1vGSlz7m+1iIAT9dCHc9:TurinDiUxUYhH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF3791E1-E39B-11EE-ACBC-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000f87bc6e552ffcb43d2966a0ae496cad65494f30daf348d294822d66fea515bf8000000000e8000000002000020000000f5039cef4174f12b62386b8e9a1c38d2c661f8f64e1eb046d3d466e3b21239809000000077baa70f6461600df7a942034406a49a3d99ce50bcd9bba698bcf9a8bffb573779de62c1d1c95dcdb0ebfa72380e322715ad2a2c16b4af6af0af69e8cbe5a4a5c45a4d4a035fb01551cf146a5f371e83844ffecf533f5df597359b22f773a08656d5e7a454ee326011a5ba3844b1c87dd59df85ce86ca6a6e5b56fe21b18ecb371478a29f1f104b2417c807cc8b4cb1f40000000bc43ee159f69b413bb27f11048227140d16e61a0a130a39f9f57ab69e7777bf71adbcca4202881a76d1816b1c4176e5b72578d5e7df7ddd761feadee9553a6c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416758835" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000071080cc59949573171a31c6c6067ac5d7242ad08757da0d19b8f075b5f5004d9000000000e800000000200002000000095c790bdf2aa7785536118b7531d00885605bc81cc1872fbbc3ca897b0e81593200000008cd2a6eaf89acaf62bc5fa76f54454f25d8a8107e98b872a55f8ffc510b8446f40000000c11000e136d227ed60e3677ea6cfa05d9131afad2e76d0afc057f4a4ae1ae960c4bdb02f826509a79b41e2b276303513ee3edbb7ad31989b55cb77d7958046cc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001f0fd5a877da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2684 2096 iexplore.exe 28 PID 2096 wrote to memory of 2684 2096 iexplore.exe 28 PID 2096 wrote to memory of 2684 2096 iexplore.exe 28 PID 2096 wrote to memory of 2684 2096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mjjjj.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8585dbec89173e46fdf9be01b79a638
SHA1a80d12a71d4492a607a63976b866acc286b939b2
SHA256beb52011ff13019a6e7fa9fa7032f5ccee4ec07a33243f1caeb31c9d676089cc
SHA5126b52e9e3ede61f0471cc24079208a00e6cdb24f000ec11969ec5ab60ec656f3891aa6adfa0e2d35d9a4d66019c546cd2b1d5a9f8d90e157cc1b0855183d7a141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b182a8d428fdf2555b207f755c99952
SHA13ce200fc9870c07adefbd9a5ca97435e13994850
SHA25615d1d19c9808adaa689ee2740f18f86fd849f3472f38572526428132b494b43a
SHA512073f3aa71c58f49992350e7740e2bb9a3382e46b1b52e8afe977561a2f030614a70c836093860e9a690a50ec7bb46d843e5c57ed78409bdb37cfa3f8efc2c53d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3656b4ece79c3524cda333207e9e5bb
SHA12164bac4bf5f69a295d6b2f531bc8722e68bc970
SHA256be81774d430c7fb614e13c38f9764e6e0d9b18bd45c89e8624dbdd206a24c73a
SHA512e6d4dd4d5b0c5e1ff2c4c7e60ea96266ba866e7357fe4b1a4db04f4192f8a9d017ea730674cee5b87e00e31c2e8ccb03288b8894183cfdaef0470a6a1230c0fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1d818ece3fdd4bb331371d5965dd18
SHA12e2fd4047eb58c17ddc4138f214892900315b429
SHA2563056d519cb6d1694f3c1ce22b3a123583e37f263964f87b16d913907cc659b6a
SHA51203198eadce40f9fc5394415f49600f14d5b192bed1bf28d02c59d94274b117ec1b0916db879c24d9665ad93231f729976be1dd734b9b190e6d6a2627bdb724a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec8b21b7dcdf06b955d77f726c58387d
SHA1d215fc630877c51b6f701b8aad576c1829aa8164
SHA256e06b682bf449912bff0ce29e75c956c5643e6b95a9e31bc1c32da49921aae83d
SHA5121945c7052924d23a51e52b50336e0da28deb212410a1591dfb9f6a44529e9cc1797235b6c27a9a2b57ec0126a5ade8c8ed4eda13b3026e06ab5ae1b4cd6dcbd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aba50f0e5418e2d2ad8f167a5418d4a9
SHA102b5d57d14697de41b602606dc94628d05825b3e
SHA256fc278fa21fab1c91ff75e90782fff9f835fc9fe45ef1e87a37af1d0d8764a0be
SHA512ec2a8a2cf1a5fbe5f3d6170ac754a37d79ec52543cd619eaf86c7204133be2c74023e5b62c64c15af53f7256bcb3cc8b7b0513db2488bfd1b127d4462dc782c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb044d8987a53005ac4fc4e095789be8
SHA147a31fb02e659dec40ff647b9579b84b25a0f077
SHA256c137f72ef83fda01d1a4545997e4b0888b4231f18cd43027746f1e4cbc6cb0f1
SHA512dcac2b5487ef61cb18f34983926d531c66ceda3fc3ab38e195daf8bd7d1e273e75f035f2cda22e67010acc03c953c444996f2eec5129f46e40445fb7fc2098c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bc4408db505a9dc758fd47251f05a02
SHA1c644a7415226fa486e577e65cc86903cd10305dc
SHA256a353e70c188c142783007b1d869921b0b7a9ebe8d7be3de840506b8838f75df0
SHA512aa994eb5aca0c5494c19dc7949ec10711217d7042923d12e796afcd05d65c0ad966727298bedfa7382fc266b777886a0de4030753ee93f6bb331f5b9b53a68ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d528df870ebabde6176cef5c98046f7
SHA14ff37b8614c8855c637d1e9ac732c8a9d0b05504
SHA256d890e4e0f6ad3a15dd9d4ca3efdc2283d6aa580838f3e72167b3c84c0d8a0f6d
SHA512a2dee6f2fb1c242e39fce872ca799135b4d5d37d83b9814ee08ba55720af1e66aa511ca1391140c5cc1c943febb3f6309d0070d8042774a82541148f2841107e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dacb714371a0082e301378f8fecccc38
SHA1961b122725c2334de826e93aef02d147edeb3163
SHA256e55407b3e179e680b405765a899b2b631d26db8f5dacb887f5b816baae26627d
SHA5120347bbebd52978bb48932717854da54439f36a6c101bf6bc562229282126a769259330fc80c012767229762668cc304055783707aae9090c6d0cbc63b9344c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d810307917abd421b93cc347b43ad92
SHA19dc16801263c6ef3c7a63e3f64ce0ef9f167c4a8
SHA256dc75db2c5e78e58b8a2fe2833096b0139a0d02d2eafcc994f14ee86c5c39af02
SHA5129aa6a15e4211345a970ca9294309f3ba4bcfc375f089c1907e59e41efa12957987fa683ed2e14cce04bd8262495c913b9835136ceadd4eaf3b724b6f92a9e770
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d596b9e3bb0f595cc6e5018950947b0
SHA1e14de0c497e94a0aa92ca5d404029971500b82ac
SHA2561a3bbf1d1b796bebaa260c733c24d16aebac8495d873c4d7a7ebd1b60fb5a149
SHA512d6ed66332a98e433c47915539656b294ac93fadd687a1d19ed3b2a8240b5e43b1f4b40c5a68626777f7d50939ea60809431dcec32a10b16bcf6e15e474381c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1c05a785ea540d8913b28686933acb6
SHA114f13a436962b3cd7f44a4b60c7ba1c04d8ed886
SHA256c3c9b29f317f62c364b2f65276e98ac8bd9a0fdb11eb0dc4cae9a4109b234034
SHA512deb42bc643fb5386cb1de3b5d655f7ed4b8b30fc292c0e558cf364824f35c7a4a4d4f53a18561cdd4e88368b76788e2d6f72ea2f086cceddc82b1593abbd5f89
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63