Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 11:50
Static task
static1
Behavioral task
behavioral1
Sample
c88b58f7302021030fd6654461c55c9c.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c88b58f7302021030fd6654461c55c9c.html
Resource
win10v2004-20240226-en
General
-
Target
c88b58f7302021030fd6654461c55c9c.html
-
Size
34KB
-
MD5
c88b58f7302021030fd6654461c55c9c
-
SHA1
23c8bb8a08bdac3950abad61510e8177b09972e4
-
SHA256
e8ee50375fe0c63bae0f3f8f06c71826a5628e4fbc1aad347ee5b3d5411c0e87
-
SHA512
c8fdc7fb46d833df1db4f222237be016895a91c5f7dc7b7b6bca8b3fa6959222dd808aa953e9a54a8861db9342e7db3f29b656a0257bd43049b7a71989258afa
-
SSDEEP
768:Cav4Dbtj4zJKd9AJh20tgLm39sbyv+tsHt:Ci4D148daDL3V
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C1587E1-E1F9-11EE-85CA-FA8378BF1C4A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a3bbf50576da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416578896" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000080c70456794ca8379f8f1e1d6ba3e39ff257c57574497e83876931e64fc037e7000000000e800000000200002000000084564cffc93b27c81884432f021388805256b9dd76ef64c22513a04f255f187f9000000082c48accdb5095dacd8f9b4a8d6a5c7113f042012c1572b5a4c5a55b655c8a2f0cadd848f6ab586ed61daa51e8cb03e4fbf9d2f96e7df4c87062922fdd85f601cb9a1c994d315eb2fba16fbad42bc0b09daf794af13db49a71dd1e6981199f955f870a63119e40221c029baec60c81852b259aafac0dbc6d0caf172ae3befa8a3780bcd8dfc7c6d5c4f97832a0cf4177400000002a99507198cacccedb749e91e54aa8024ea0d5f99551bf828be33c24612061816573269ebfb15ae26761943221165a7d6916a7c7163e265d735a7a121a822a4f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000008e5fe900116569c7d9625a662588d8854e4ee07a79db89abdaf6ce1b668be1f000000000e80000000020000200000003d8dcfbb0dfe4c0b7503f6e160febe6324acc04d1006c873f68fc4f0a073a858200000001353c216ae7d5b134055832edc07151ff707d5e4b07075da7a46e60ea85b9c1e40000000f35b9f0aa1cbfbec81f71bab367eb58af75d4b8cf89fc49d28149410614f9754756ea2cf4d73541ed467e73fec97733d7b850f92321aec63c946d4639b7973df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1504 iexplore.exe 1504 iexplore.exe 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE 2508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2508 1504 iexplore.exe 28 PID 1504 wrote to memory of 2508 1504 iexplore.exe 28 PID 1504 wrote to memory of 2508 1504 iexplore.exe 28 PID 1504 wrote to memory of 2508 1504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c88b58f7302021030fd6654461c55c9c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcb12e5bc595973abd8521f9fafb6342
SHA1afd92ca5f452c1897313b21adb5e460660ac48d6
SHA256492721f62d456d72fdc86116bdb6706d247a7e40901676753e461b287bf898e3
SHA51276954f43e455a9d8fe0bd0197490164d870df06a106ca47184e80fc10c09b132f797a26fd3d13fba5b4341dbeff07330876d5240d293c470e14038c61e8db03d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ca92a05e3d0b9d246abcc716a5bcd8a
SHA1f539181eadc6891939c86a6c6c4a44265c53edb8
SHA256f73d9caf37f3d88dcd31d30cad4042c0ca546a985c0f97997b345e0f67299b49
SHA512bf4f92a7678be2f49def7ab33cc744fbc2481b00fb842a516caf435f943bf10b7164daa499319687c0497e623160aff217304520872442aa0f5c0c9173964e11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52336ac3e23998d6eba0a02bead4f8533
SHA1c53b283c3d776528f9c6366810a01acf4b165195
SHA256e5a4478d34274af5267898729ea331992d830ea64d506fa007f89a62caf8fe4b
SHA51278b7e0801a89c9de0593d2af0088f03522f73d975ace5ca105487c7b868c473df0e3a439def91ceabc030eb68d6adaf9bd234abff36609a27ae7d7331d620722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5370f46ae8db9a87e94407195603a984c
SHA16fda39009a4c59e088536d0da6c387ddedcfafc7
SHA256419f33626dc08a65a64a89004031c36665f7f84f4a497d8c4103c0c83839b6a7
SHA512403c9c371a16b12420943288f18a6edaa2534198d7a49d78b5ecf03cac750343018e20008a2d415e11d098d3c2a842988b3e70b749b5616eb9290bf323d94d9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e1eff40e1d29ed7fd6f5a154c324347
SHA196a1c293f27a93be43223ce8fe5fb6c553809843
SHA2569896f1dafabfa56c315569e7eef43631f55b8a60d6c302978b86c5675f0f7c29
SHA512cb0e264b35de5c48586a1d24811e1488b2024b99b70310a33c95e37ac8a1a6478aca4ac2f7446b148baa1a19bb09d5f4d26abcd59566cfc104443f8390e0ed73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fa9475c77c8c578d1f505549bce1ecf
SHA1dcfedd6c00352197cd4bb3c4e98a9d6bb6e4996a
SHA256b0316518d6502eb1948e53df31f02ca5549964ce8ebffc6ba33b4c616269b5eb
SHA512609d4bfcc66fe9ae3f19838ff3bfaca33b12060ff57ef55b1d49e339cf368b2b11f1d1df3b796cd857f6cedee60a8425e7babb43390f64f2a04e9ffacf03c07e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed8b27d4ff8270970e7ab0626e0bee0c
SHA18c13a5e6dc9d0e81ab2465017e57dd7b317fc01f
SHA256c266f843b611e35e3791907594df6a8bdffd4b7fe4ef694d21cc2c43e1475543
SHA512832dfbcee14330be8a38c80ae98e1e0669b688dd071c8e6f75e9331cb7caebf48c2266d618954edd83e5a82d9447836ec361171c392c027770c9d976c19fc248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b69e2d12f8704792cd98360f19bd1b7
SHA1c832c28e5e267c4884f2adf9f816a01d90155b92
SHA256f3dfc0c03fb5ace9fcaf152f7405bde590bba94a6d4b5bccc9ff2e0b646518eb
SHA512c1fbc936470aaccb5b7f1e7f87c0bae04fb67b300ea6be2ddf5c2985c4663c43005975d0fc80f678c1bbbd03286c995956a2adcbe9dca963769982cf124e726e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5613609c8e0bc8b86c93f930b534e7b2d
SHA17b15e9d1d416e79bc07933a10c20baae7e21a5eb
SHA256a166a6d4e9190b4678382549295f9b37cfd0d09c86e733b0d789d40a8b66344e
SHA5123f92474942c6e3341d46fbf8f8f1e3cfa48e16c2e54b81aaaac04ba0d0c813432791d06288ad9c7afe10602cd604ea6bb13db8fa7833ab29489a6b8b754ecd40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5898deb7ecef5f164ee545fe4ab078fbb
SHA13e184ffeca1d5d8d572945e07e46c33caa746ecb
SHA256e67754fdcda80ecf052a7cc6e1b5df1fa8cba223295ff54c467f4853dce021b8
SHA512c223ea829e17245700ba5756c9c1aeb83fe86b44f6f84ca75b93a731777bff52714008065989d25c3e12b32b7ab63d4ace9e6b95c19b58d4289cbc9ed41437ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54192cced0e43e89afbdba12b2956745a
SHA1ac033f48f5c5c53f4766eb5d7fa529113fac51c1
SHA256ff6885f3ce2d549cc41d7adfbcb910e747c47cf445e234a6a879c31da51acbdd
SHA5129b8d2b9e333a8b697f4b3e225cde0dff033d93cd0c8b84a7baffd93dbaca56d5903dd017b57184248a601713ff99b9f82bc9a95d4abfa9b3ba322a6e382f28b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53df76219e363aac35ba9bfee16f072ad
SHA189ad4c24e4f4d78010c5503fe3be718da800e647
SHA256a007bfd47ca2ac16fb2f3d5fd47e97f017f6ed09d56326442f040f6d6bdf22e4
SHA512454814fa7cd2d1e1a348ed153d651b291eef58ae215d455b610839b3802b516fa0a2463aee6a12d81ea0db8cd64935642ca9b6cc9854d0356fc26ba7e0fc2772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb0d3ecc3f983270e2ef5de79a2efd28
SHA1a756f08f32957fe7630484cae40a59322abaf000
SHA25627686007dd6e591ae9394f74c9822267dffbcc930020a9a92b3334c393c834bd
SHA512b39720ba08a68d9d4d827bfcedb5e058c1e64b666d0f5dbbbea5cab3768ab4d93a62fd335942d05e45d204649c17f2a471b62e2ecafcffb0c91c94b0abff94a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a609f6b6db1c4a09a14204b38d38205f
SHA13aac53573129bd6507ddcccad4e86d63f4bbd78a
SHA25635e2c083edde26b7b5c959cf070818357251866f4275dc79839a2b924eacd343
SHA51213cbd67a90a6efc452abe8e1234b9cca4e28f9e9043bd4e079c551af6f0455cd239349e2c4be8e191d2184ea444bf92c2c0fc98850c19a2a6312a0d877eb6789
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ba3882728a0eb1ade6d9133b7ce7715
SHA13ff232e5bd0a784e77fd50c256c090170ab74ca7
SHA2568d2098940dc2fba552f1c5bf62bc6136de8e957875151b642ea6c397279f18c8
SHA5128752acab1266c29ac79ee7c2ba4c89a1f2e1a2e28340bc1731009074f8ef9affd0affaf0c0568ef7d58dbcfab366e754d3c02b34509cb98dd2e6f8daa96ef34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5276350f6d4a100fb9901c132b2a53c70
SHA16df3200bb6750dddee0b42da6ce4ba9485532e40
SHA2564456aa722934c37c92416ecf6aa7090d53d0329667522fe881edc638f9ba20c3
SHA512048b7311ecc601cbaab07c440947ad72746e69bb46a9fe6f42d13fb431b3c08b850a15add435d21d878e1dcc813253085bfc69a31a0244a2989875109206fff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b4a3db061858e559f927e130c58d375
SHA1bcd7ab24840cf261f22311571694662e9a667baa
SHA25651cb87b5a679ea5bbb3c4fe36999b992f3b400059b184bcdb02ed439ab71e4c3
SHA512cf278d420136664c6cf33ba8fe5ee9087596cdde1b016364318fd184ff5f5e5f628a8d81d722cf58eaf9e410ec6d446f12fef2a2314fb198dc4ccedf3385f81c
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63