Resubmissions
13-03-2024 16:53
240313-vd8bpsab6w 113-03-2024 16:52
240313-vdwmxaab5z 113-03-2024 16:52
240313-vdmd8sab41 113-03-2024 16:51
240313-vc87lsab3z 113-03-2024 16:51
240313-vctf6aca35 113-03-2024 16:50
240313-vch1esaa9z 413-03-2024 16:50
240313-vcblcaaa9t 1Analysis
-
max time kernel
1561s -
max time network
1568s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-03-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
mjjjj.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mjjjj.html
Resource
win10v2004-20240226-en
General
-
Target
mjjjj.html
-
Size
15.8MB
-
MD5
5d82050346045d3c2ff2677436e8182b
-
SHA1
14034ec0db53f3c11cb11dc095398453d6fb95c7
-
SHA256
23421d5681bfd3aa75d1a00bb418d9df40c9a915f7b4e70e3877d5d204e7d537
-
SHA512
c9221f7aab9b1d37c89ed61340f606d219835fc4080a45d5d50b1f3679d981a61e2cb5547060ff4ca88bd9f80d4e9440f49c4b8119b540de8d1eac57777dbbbc
-
SSDEEP
49152:fmDz4cz3oSrcBRlyqYGxGK4xsmgrFsomEArSBU2vIzhd1vGSlz7m+1iIAT9dCHc9:TurinDiUxUYhH
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503b8af7ad77da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416761037" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2094E9F1-E3A1-11EE-80D9-D2EFD46A7D0E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000005b6410fb5a809793b4867fbe61c90f364b7c7b0375802766ac83d7539b5eb7dc000000000e8000000002000020000000e4214708bdb9c107dcd05e51c0a899569ca5628b020783c4f9c3448e8ea0b4ef20000000afee36c7d1af184fcbd553ee6f8794ff30f0f558535c2a3b75cc1343a8bb8acb4000000094f5d16ea4d32eb94fd37c7b2180bc737a57ca14c5f99125e342378d30c2ac2dcb0d4494a23c0073cc679fa9fd334602babe14254b44024bbeddfd822d93236a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e00000000020000000000106600000001000020000000fa728eca054bd221060f4fb3d8eae1aba67b6bbd293e6766cfe78f1ea539798c000000000e800000000200002000000047709f61cbe8c07bdafe57701329cfcb8720c07d761a2daf78439cbd01780bd690000000a2033d1ef046047583470d55e4d85d03430a03b838b72eed9006645da6a50bc63613b8724a3a4143b5d3bb3bb6e2bb37ac6e731ddeb62078aa9c55a72aa3d676c170c2ab15db13cc82e0b5fcf49932d01882b18c21c160c5b78c3739b6f15626f117e792e5e9da288697bd7e5d446845ea1e763e3edeab3ca65adc6c4b91dc997c05d2215273c5eb4bc03927d48ee52f400000003f2c6b20eed8add59561e7c2f9d00279de831e7b60687ba7ded769def66518458f61e5dba071fc919f9efc683aa25fc042e424279602add7294c27a92c69f4cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2848 iexplore.exe 2848 iexplore.exe 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2496 2848 iexplore.exe 28 PID 2848 wrote to memory of 2496 2848 iexplore.exe 28 PID 2848 wrote to memory of 2496 2848 iexplore.exe 28 PID 2848 wrote to memory of 2496 2848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mjjjj.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e46def74b10fcf5f8e4fb8ce013653b9
SHA12c1134a6c923fe4739b3e0d8f03630d0b313319a
SHA2565e0ff545e528fb71592c50aa323089382e528e9eb603d0a73ffdc2294a3a31d3
SHA5120271154a53862c92d77296b836d87dfe2bb702fab68384c1a53fb0ad953fc7ca806cc999bf529791d8669135b5bbd209ee606ac21bfe3f8deb97055072ca6afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cb22d897599aad4e12a53224c84ca5b
SHA166490c37e256c766bb425e2696bd1ad64cc518a4
SHA25693758b2494c2d0cd7c0d2a80b22f12fdd97fcf24e33d3b4f349dd908ab34b866
SHA512a75cfe5a597d62f8dc6fb833f334653e22d497e85c6f2d038c4c13826d8fea0a1209628ffe3dea137c6f4c2f5ec5d4c79b5b47c166f9ce5c79ed2af45fc6a5df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3125dbe4119303f604b1d236d634d5d
SHA13b61f110a009ffd9bc30841a24bbc75cce5b9b52
SHA256eab49743d20fd4bc5e96fb4c4d1472d1af9982170de99b317653cc958dfba180
SHA5129e689be3a5fb773611d326027f31add3c1fe3ed933aafef267642928b547964e61a14908698d94e1163e80e15d4f571052e1e45f37fe12c4c3d7b6f9cbb48094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56494da55c897a73b3a6d288ec2a881b6
SHA16dd76189cd403ba90dfebc7985ceb291fa278b20
SHA25646c9421479c7692131d449d55d2ad733338b9adbfe804e17e01a161cfde45872
SHA5126b32544e29f1f16f3dc31102917ac285cb24cf6b5cb50a4859031e4313e4633c81cab9eafdb237de9560df1ebe9a8bb305d26dd2007dae6db79d20d199bbb09a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c44cae4a18249e2ad753c31449459c80
SHA1c4cfca5545597a0481beea2ee6a0060c7eb44b6b
SHA2560fa16036b3a8f1c74dfdf237b20634ef13c72c67974f216698ee9b70f33ad0df
SHA512edbbe62ec96af5f32bc63eb0522afd11a7a07f346cf60894e9ffc82b3f1d17c56743ace22920243ade763cd6934af5a090edf15ba377dc5d7b4e060997b22d46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c67944b38f5ec98fc10f20c13ee1cb9
SHA1b2e367f1f010921b2c7dbef21906c12e6ae17a49
SHA2560fe82e6877bc3c711f5bdf0c8f7cdee634779ad1b862dd57f79d7339ed971aa7
SHA5125960742b71d3376219ce66e544e90c89a950e2a09bac1adac79a6ffbcd2954e4ffdb8bec887b4937eca7aa546eae4c5e5ff1daf7e19639552ada4988a5f961d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cff2cb3a2c8ef43b20af26861eaedca8
SHA122d0da44daf885efc4ab4139cf990dcccb1e7ecc
SHA25661d17e66db20582264ff6f36ddff50e07fc5d59e0fb8044dba6bebb821326980
SHA512767331d78ff74c6b38fb64b1039dca1d234fde4838acb47d210666283ba0fc931092e855c79b19a10a3377c8ba7165e6a70f707f7d556e6c9e00ff596df849c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582e293e45ad0839e117e229f62f79e60
SHA10a918367a83a0121d7223ba537c47fad494dba72
SHA256e45f249ed3d98a886c36e3267d54c23984a63d14a1b915f71f54e422d178bf98
SHA512ca46b38d0e49382a8c9678976bd7d21f0f3f9063e92a95686c888219c6b1cd2d1c3b5f0e6a283363c45822d4f3449bd07707db91e7c7cf6e6f121f47a957c20f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50861ba744b3b76627be5a178429a7f66
SHA177a8cba676c13eac24d86f20b2a09c46f8e725ef
SHA2561404a2b57dd6b25c396086b026c1c24d4a6658c7cca4170610656130d23d1e33
SHA512b62457a12ef0c4789d611f8e274481b2e903a26982681bde3bc11258baf720cb63b82832c9a883d24f7d4123f28183426aeff8923d8c1ffdea34761df01072a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520262143d066505c2d530954e2ed6d18
SHA1306519b32501804aa910c945792bdeb6430b68c2
SHA256a09e6016d07f7680f5767d58f64349ce6f752d72427e9186aa8eeaa6c26daa0b
SHA512721499166c18968d56968cf591e97c85a1be88781d1cff5e9907a6bc5ec934b831d4e0288ee32086bad1e8a5b8a7d6100fe4105f25e5ee0ac1a50f14dc799d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c70b7abaf7a4d472e63a34df594c0701
SHA1b08db2f27cb4a7dc466bfb51be5c9a08a4107817
SHA2563b6739dfc72d22acd79ac6d3b6b39306acd30ac417cb258c0ce6599ebe742021
SHA512832c7f217b7e1229e5b7d3969138105cc53e89b3b76c1aee683ec5c227f061c1dbfeab6d0d07ffb00b715f7b38ded539402cb2c01d9201418ea662d28dcb7a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae1b623cf95895bbd551d043b096f11c
SHA14075ac9a07949b03b3e29b342910713744bc3df9
SHA2568de83e8ffe33082c9dce43176a656caaade4e390f27f80ec9040a452259a348f
SHA512447bc88119674c6af5afa8c9c8fe46a544266ae80a95a65c8bec77335ea51c89fec1014d3bc66d08557f863e596f9cb3534d719157222f4515f7119355007c01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b78704419b2eded777b1ff20579a0037
SHA180da13eebfbbb9d5610316917b18202c80d529b3
SHA2565e76c40db0f3a11cccd2428547652a8276dd56c23e5ff66571de7f08b0e5aa68
SHA512ba3e42e08cd979916387b77ad1a85230a214bb119d2f8239756fc2799d40843dd7cbb1e09f5ea51743129a55f814bd65b26c3e0d82b57dab41e0c988af7281c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3380ebc689e2a312e57ec7c004058f6
SHA113968b4d32fdac06e27281dee21ac7fe1bc70bd2
SHA25601489a19dd3c83a223fcf6dfa02d6215c0b39ae73c2616253f68d2a59b08dd0a
SHA512cc6fd6d559783fd7ad1a514ce34afbbbaa624d2d41fb5eb0363883d8d58c1d43a81f7c6201a7ded3d1f1976a9a54f84c132acd5f4b27eda080874a9e2f317153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f1fdb3ba8817b8a74f693fb6cab3c13
SHA1a01850790a4df708aeb7047723dd60fac3d7e2a7
SHA2564c9dddb28eea5b81c6d5adb6ed565ab11084c77f26c9103216509cdfa4f1aabb
SHA512c9778f8b78a6e8da157a196fb7bc87ae147706d0fd5ac8cc5bc1ac103db471bc444ccdd7bd55de649af61e0875e1cb58b5c746cb15799844216685d004b0cf8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0ac144c3db445a08088e2fa42192978
SHA11ace1b2afb380ca7c08b817bbae663207f2bcaa7
SHA2561ffd6f6d73e7d5a493a5236b5efdec486bbad5af954d4e51cb083455bc4644e4
SHA512faa23752fcc9e5370810ace12d67c40d8dd4382799a34f4334ab237bd76dac74f1dfa6af755f42980a63b62116fc4a1d1362570c8976a36011c288dc6b6ac5e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d697996b17f89adbf3189a58b87668f2
SHA144bf93d5412a5cd6c09e371f9f038934edaa3a2f
SHA2562ae8952509bccaa8f98b679da23fb482eac2fa88dc8540d6ab8bd36b6d016eba
SHA512eaf96d7e3ac038867bd129b561e0ceff6cbad146a5f03c544da83bc0d83b94c811666e6e935b6217a74351d19bd12a303e88e1452a235c94ba558f11c95984b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea6be42332653f0f104f4a39dc46d563
SHA15a6f3030ef7f16ad75895f1d6531aa7a5c61d1c0
SHA2568a06ef61b8430a3c1cef9e8d66b8b97bbcb4957c539608403cfb010552568f9d
SHA512963bfa19fa307656a6db1ae83e5cd6820ec48c36609893873b641b7d4f17aae53a0bb88bd93c3578b9241db771e11a14bb084242e1d3ce599687112b662897b7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63