Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 03:47
Static task
static1
Behavioral task
behavioral1
Sample
c79c24dcf8faca3dad35c04afd237877.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c79c24dcf8faca3dad35c04afd237877.html
Resource
win10v2004-20240226-en
General
-
Target
c79c24dcf8faca3dad35c04afd237877.html
-
Size
25KB
-
MD5
c79c24dcf8faca3dad35c04afd237877
-
SHA1
8f2cfd6cffc79a409b092f926ddcdcd3ef84cf34
-
SHA256
da43a5bb48b2685e00c40c4dddedf6faabd21f23f4a977dc0968b538ecc201e7
-
SHA512
97978ea0a02d98f21bc8befb121050867e76ec4452b501f0a011073d4e0d5088e23f064b246d7a108d15f1cc7b14f6057e6ef782b1753e6d131d01fc180c18e5
-
SSDEEP
384:vdg2H8ol/GwI32xOUtxKTeBfKTpK3DlMG5VLgWQQ/U4yhoy7jfIWrYc51IlSAuVS:1g2Hll/NltITe0AzueNG9p6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000160091280c6449c76c9f190115bb74745eaeafcb0ad6e64265498a03f5ab8d2a000000000e8000000002000020000000492ad2bdfd26d3eba6d686a9ae2a302387aca8e235f1bd05baaba78aa84e8d9320000000ecf06fe124793aad7beb82006bc944997d6339bfc7d660167fccc2b1de036f2440000000cb266a09f41d2a0aad4ebc088c4589ffcadf13d2bf94e5c59a96e59c8d7ea34d98fd189d60a84feb7cf0324c9b9ce2fd0be8cf0ecd5d6b7bbeb815121d4fb6b4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416549939" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b5b775c275da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A118E6F1-E1B5-11EE-B20D-42D1C15895C4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003c6de6cef71b0366ea622b7c9a0b85870f4b9e460cecaef7076c46fc250bfb0c000000000e8000000002000020000000c4f0152e555c2c38b469063e57ec0c970b513d330b9f6a827c6ea84da60ee48d90000000886ff01f0ad784d3d0ce4a78994bab2e0891f8eec59b66f54d60306b88793d9c9faeea81e677f6c3da3c2883c828da72794f9fdf5daeeb6ba52edeacb21c53cd8e0535baf2b9d4f64411c89c023a1e45f8f408678f4b856ac88dd7ba275e1f96097960b70f94f9f8d919bfdc3ce441ba7d00fb88f2346be3d23188701b38fd7c0a90cf7f6dc71fe59cf2363ef9dcecbf40000000b442b33f729e3debcff6981fde70a78ce210a358f1d920a5bad1334f76041c9a937ad9e0f52cced5df0324254a69d54c320eae237103d5851512bd97072eefdc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2972 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2972 iexplore.exe 2972 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28 PID 2972 wrote to memory of 2216 2972 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c79c24dcf8faca3dad35c04afd237877.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589bb5dfa8f0a61621418b42727358926
SHA1134bb32fc7f5346d0920a2474f2ab952e1abf55e
SHA256563339c5acfa17fcaccce1a736c3ddece525f7a0197f8859a9c46fbb360a5086
SHA5120c2fd2f37cc7cde4deb9e5629d682f097e28b0d7b2522afe1f50a75221eef7a30c25aab149a7bf7216c405c126fe617b73daaa778708b2f6f36dba0b56cdbb99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8ed707f3600ed7d2494ddc98c794410
SHA11998f78fe25d9094d3880bc6893a086429c6a22e
SHA2563d20e645ae9f06761a6f1e60529dad4061969b22de86155bb28d63685473f5a6
SHA51224db45425f8efe0a691d0b3586d5030d04a9ca1f4fbe5d22f7c3eeb95eeff7fd69a375d1bd29ea9f5e303d36a161c8f123244b7708afb965f90f43729565ed47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ec1a38620364aae805868451bc7ffa4
SHA1c33614974cf93db94e9f83a5660bebaea0fd9bd3
SHA256b7b873b1ce05551f7fa8ce5a0f0e214ba3c3a4dc720a80eca4888ac70fa6b2d6
SHA512e984fabbce1095b2eb22822dd2ddfd5be6defd47dd844ced8c9ea8a5d67374447c450ea7449b6236947750dc8b1bd50b3feee4b37ccbb5438371f6c087b2c499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb4d011b3d71d965013e6c3a681049f6
SHA17526729eed93521289b6dbd00dd037c075c6303c
SHA256ecdf8301836b238029f7a41ec2445da77e384c80473555d8e15eb1780ecbb5a7
SHA5120bc65091452e6483547297c9bc6476a19f6d846051034164efe976d2bafdda14532748b437b93ee92935754a08853396280da18255cf54b7ec0f7c28b3d5f55c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdabdd0dff92928bc99f908e04d08a34
SHA13cbe379e9d5b1c3d575c9037c0e2ca9bdc54c25f
SHA2560e31e487eea1fd45f169d65534c7e892de6a406327f9e664502cac706621cee8
SHA512d0a8513ed4cd42bad52aee1a33930dfba379caeda18403c36264e66fc3e865ef2f518d764ee961acd47a3e2a212073dde1cb651bb458f5e980d59a53bfe57542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d9ca4f1ea79472a128263506c8d5fe
SHA1bca82158326c5ee5b64b767ac2546f10da83ef12
SHA2561354963d0fa464b97f869443297d93309492825d47a73483fa12df867b6877d5
SHA512ead39017d3b7b5ddfb82069a190bf17cf070c874356b42f14ef6b26fbf0578d5b4bef1ac09097946b8c01f980f91e43c43fcc532e04b27d12dcac7be82891820
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521e90217df22a7fdd3f0cff83f37bd15
SHA14a7dd9ed9e5193abb4a6b822f2efb5733965576d
SHA25607a8a7620572241fe2b864c594b24b555818ab9184713d7ae6a7586d25fcc687
SHA512060e89846cc026d4594873484d9a750ae1e09a16c5e97d221663089c2c0c8f7fcac82b63a96bd17098b1b52685e14a8b660d10342a469ff27e7f5b014424b923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb37894ccae26ef6f313e81bbc6868ef
SHA1f915457f8ac946f8357feaa02ef2f054a6714f67
SHA256a455d5f68eadbd5c1236cf752e9b52cfe0fbb021b8ef6dbf89a93b0ffc94d0bb
SHA5129866ac2514359298455e24f254a712cd14601dd6fc9f08bebb844f27f9fb61d0a7ac19861a455c0700a2d1eef92dafc023dc415dbce41e24a11da4f848efc2f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5797093db4ccc3eac2753d6a3a81c507a
SHA155b98e1ca6a1ed067e8340166072439f368cb5e8
SHA25687b1985091300d73875c3291777e29e0de6bb9e8a41cc3dc4d19c9bd483cd233
SHA512122d864b126a8b703fb65693da600e1ebb29737429f22d6921090409ba58c698b8fd88e6e93fc380baba14a0db902d7cf722607ea4e1627085a7287061c3a7be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578405d05c2af555a031515561540fdae
SHA1c7dbfa6d916f85278644a6076c1a56522e25b8db
SHA25645551e009ebdda8368f80a41bd84b4e94561a555890686c326cf99ae87781fc6
SHA512453b70bb7c43ee31625a96ba65e86d91a782971e1c6fa633ea53e7a86d555b1222b98ad24d490a8f6221fd48f97a48ab4ca4d281bcc3d120213e986aef8ad54f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f94ef52e6bf463c1ceea5580626eeb55
SHA110b5ad435bd363b43b72e9e3d7ac6f14018f4113
SHA2567f2879cd144dea11a15417febbba705aa6552bed98e479400999f5f79a817c74
SHA512591172e15f320ba8a66043107da04ec4882443a8dd6661d58642fd30bc8d5ff7ebbc6c9001c5f80717700ed67259776ebc268ab18b82918889709c4b99d81af5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5511fe147f0733cffcbc81acbeec86c75
SHA1a47d1051349cb51a4575abd4e14725ef37e10fb0
SHA25674c2e77bf25d6b12506a420b60a1104a3225c09396d05a8158e3ab83440eb93a
SHA512f6d4a200a82e94c244e064a9e604abe7ed688c57488e6c25550c0e6c4fae0a773aa52e5072ffa699a1d6793eb84bf5f6b64829888f317d0edb4121d435086792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ac166468775928914c0fbfbe70563b
SHA10ee0c0d93bec1678abb84b5972629d2a215363a4
SHA25674776b1378aff0cbd09d2edde4ac20ad0c1332e491ba11cbcde81dbce61998ef
SHA5120a996432605692431ec335ca26ecf22245ce4962793912fe046f6d32f9f414dccc4e17f040766bb571c4b8ee0669c759723bcdcf566e9680bb5395df76b5ba1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b7ed8e7060f62d3743e4cea6b1781cb
SHA1964f835d43c36d1b8765eab25366c5174afd0b72
SHA2569f6dff7f52e9fe0f371dd334bab961771b102e7dc0efb367cd1e8a6fcb2de5f6
SHA512fd748680f1b98d9ca6cb9564ba0ff57f3154523b68ebdfc9983ecba65e0c6753a5261c1370555114d203cf6ca00577dcfa823c8acb51619be6a131e2b0b435b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bb63abda5be3dc6d8322cfb33382988
SHA19f2021c6ba96b8f635c7ccde197b15ae448846a3
SHA256d30035c280e98bc9274d7d773984c1f38dce1d27a340b3a5c7503cdd55a83477
SHA512350e2c9317a02e12ffb4dfba88fd7110d270eeb9813f9ac021f0fb04009753d65f01b24c587060ad885b408802bf088eaea0faf302f74f2804c3f7da314861f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5701948c5902e763c8e99131ced7e4b9d
SHA1ec304378a69e71f8f32632b5bfd2cc12f88e0b1b
SHA25625fc43b041820c114114b030caf23f61cdd5f5dddef8d9ba48f6723b37fb7e8a
SHA5124f3ae46ce11cfedeb5495e12b119386636b803fc49d47c60f96a6be1162f260e1d8c194312e9bc206821d8be22352612855ef7a4fb845c8f1ad102d9418fd50c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583c4c8f7d514564f0542ce5186c9db97
SHA155832892ec494b6999cb0fef3981b11d2f4824d0
SHA256acdceeacfe503672da774ae8adececf0893757f4d8af88f082bce8b95bdb5811
SHA51269d1ddf86426905ff6a4b9a4da05b2da1391bf7ab6304270902e03757bf905f3ae001dcae607a26fccd6435b4e8df427572f243bd83b34be5cdb026f9fae37e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5158bf1e11c2222ad992609b27e1bb867
SHA1ba0064d63f79cb0537091666b98f34fb9583c0b1
SHA2565e1abcc479036b65a1e8b56fe33eef146931df6419d6039b8758a68268a26309
SHA512d6f8b8a1279cfe24b8172c53a2deced4f2e96e21602da365df7d1d86e23154543eed9c07895f12ef698fc76a959cf3581e5b83399000a96dbcba0e83c7aa2aff
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63