Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 10:15
Static task
static1
Behavioral task
behavioral1
Sample
cb25925e395056e745737e80120d988d.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb25925e395056e745737e80120d988d.html
Resource
win10v2004-20240226-en
General
-
Target
cb25925e395056e745737e80120d988d.html
-
Size
18KB
-
MD5
cb25925e395056e745737e80120d988d
-
SHA1
27959424f4b6fe599311f6b78ef021da4fc745c6
-
SHA256
a21e2e8eab1cc40ce4adfd4dfeca7d77a45d9ee7d4d2553c61db00041bd3a4bf
-
SHA512
fb7c90ed4300858f1d50a6f09f27de8c0bb61d0b9e728092e5188835ff0de5f3256089e07a1d5ad6fbcab002b14d293559567d46016cafefbad7e766e979c40e
-
SSDEEP
192:YO0qeN/EXl98A6CfbvFnxJrVMXTkUaaqptgpTzbOF9TUnCtctCGbOF9TUnCtctCZ:FXlqATq6F9TUCmkF9TUCmI
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416659589" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000023ce57d4acd8864bcaf6af89164d3ca8fa9fb9b999201088f0abd0c07a9aa08000000000e80000000020000200000002099c647ca58930994dbafcbc6719beffe5556d1be5cab6982b76e17a39ef82920000000b76c8ff007a995638f2f9d96770bdd773f49cfc9803475c14780a94121e2daaf4000000054fd59949a07fabb9e34848ab2bb90db1ac61dddf11026a8ab4cd66fb5eab60c275f0c14531170172d4ab62ce273f47b7d41f099f3b86a0b90af84b1f1086e06 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9063f5c5c176da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EBC56161-E2B4-11EE-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000009b455e7b0426992b95626d64d3b2936715161d4d41d0aad52f2dd122fe75098f000000000e80000000020000200000005f49c1b02d9b32b803136294f59f621a889faac56d2695aa04b28e52383d6b2290000000c947d0b41200165c0f04cc965c1805fb99e8e9ef3240fae58c3a09c27d27238236c40bb70d0f4da3913fd2e0f4330769a2060217896dd3166c91549e841073fa5935f5c3b01259ccc498227dbce2ad1c2ac77aa68e35d0bc0fa9cb7770455cd36bb38a573b8d5d29d289d2e0e4e357e40978a4ee3a31155d44a87036b938b3425ff77af9c9cc22dbd0ff389661cad8ff4000000008170953ec132a51a1bcb0e9912bf8d3d4383a60c614836e6d041916bc51bde493d2bebc3d8f45461115276b8a68961ddb362a3aa9b495dd2f9f80464351082f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2164 iexplore.exe 2164 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28 PID 2164 wrote to memory of 2892 2164 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cb25925e395056e745737e80120d988d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c933f4ee534409ca74b5a13ec91a3ddd
SHA1d4b4f7dc814150f411f6583d3fe9ddcc78dd44e7
SHA2562888a8d86333c264ffa3f2033fbea5012e3a39c441f9cf37beb0e5faa5bc1ac8
SHA51258558f4cf96557b3c63481579a3f1fbf6f75373d21fb8e6e8fe86eb4862c771fa3894572c88777c50dea27c5cfd7b7db80b48e50549ac36c3899a7dea4ff6227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d98747f48712857a9ccf733476c8e9b0
SHA11bba975fbc2fc3f02a3ff64c898f26604e1366c6
SHA256b32b9f924a0f766476d5487451c24dd40422bdc3866c18ba4737d20f059ac842
SHA5129cf28c0bddea24bbb9148d9c762fa173f26f4ac2013c0e0edf7033f6911cbbc819c44e3de2042b52929447293ff2417892d0de5d2fe90b2179a4eea638e2e70a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503752a6143344600cfcde2da51a0bc65
SHA1a1f5492d9991f48989a38c8d2a0279c6d4e0a8e8
SHA2562e7f652da8c5d75ff11f3bbaf29f44287b4205c412d3e290a6328c953994aed2
SHA512742337bfe1fea1005d385fae22a3e05d493f69a148ce35c91d5297bc299fc179167300be87accd1c786a337fa620b490095d8d050302544a03819d1eee201e02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567932896d0ac8ee6ba09bae4dd686957
SHA19f0b2bc86cd46c48149b05d23ecfc13c43df329e
SHA25625a2d1745b03db07a27c3e1544f3f8addb4fb9790efb0d26f2eef8dc8b231bb7
SHA512998b541bc502eb984d20a7f891ee146ed1d9ee124a5d224b3d5d779ed4f0691e86c432067492cbbb60efbcbbd738c3347d4e0472f7fde40d6c710772fbbf7003
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9707075a4774f1f46a4ce17bfb3f0cd
SHA11ffb348202097a1693b368c6306c23392b525d11
SHA256e60f01c4688ae1fc28ab12050e9e8d64bed842904cd4cb6132223180ff61a39b
SHA51214f910e97dd2d7d75e7bc35a35e85ca36ae192f302409bdc7e60154d432bd7e0572577a242611d6262025dffcc6a6fa835b1fdb2e9eb9be81e50f4478a716df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54efc515373bf9adaa6cf1a80c1fdf722
SHA11f53742dbaceb551731dc7950c85a3bddb39c386
SHA2566a69860ec8ffd2d07dc4462d394ee88a648bfe527aaa0fc8dccfbb844921b89a
SHA5125a5ad7d1a4e101c1bd9ae91aa4ed4ee5169d14d01d639a0003673674c328de540fa728f9ab95994728814722e4b39bd167a98c431d121503475cdd9edc56a89e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50273bbb616255709c513c2113c6e896e
SHA103dc7ed14ead0f0d07f202032379966a7c154e9f
SHA256fc80cf988b94e2d74e83a61cd969df14059108ab0c9a9f8bb6d6c2fc16673fb6
SHA512f15bea081e9f9cd68694a1392ccdb83f12a5a33c074295dc466c13e265f220018652e1c181a4e4ace965a4613aa90c641c9f2e9395d5563bab006d26be98929b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4d0f859587a5062d1efe4469238bcc3
SHA18434c52b243ec996684e0d1ab7e4010cab4d5305
SHA256ca3ec762b096523503e619239a8138489cff226dcabc5b771bc3cf204804dbba
SHA512bb6eaba68b2d23e8ae7dfbe1eec07a8314b1611729dd3f6a903b030aecfe9617d55dcc4dec3b745e7e8c1c87c76e2a13480d770e2a91e78cb4e9936ec295c280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5864ebbf65f99379e6f84dd24fc5a4da3
SHA1d05ecffb9ba1ee59b45456101cb3709a14540c39
SHA2569f2703e75fb9afcea1dd8a08a842fcc06ce0ed414e78e27aa49c60e6c356b83f
SHA5125f8814be06bad194f31710201de175e5abd07da6973316f189cf027cb0e6426146fa37886f83902e5e2bbcf3067121d6b97cb43ab4254dd7ca9a355014f2aef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594e7bd55fc80db5fe71af597c3ed3c1b
SHA1688872b9aee5d44ce99e941b427b55e3b1c59eea
SHA256c2d3662ee8b8a070716d55aa65617f17d846f3588454e77a43176c9ea519d348
SHA512572eba0ba02daca625c58bb00dbfa7cef97633aa4761e108e832333119471d9f8cce01813a31b95fd2130a7b79c9bb0dda4d070f0550088d132f0ae33ef345f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5016a23f2063e525a450f17d0be3f2aff
SHA1e17f1314e0c7fe8cb4665c31d5f22c4577c13beb
SHA2563554c45cbd3ec7f1321b6d6b6dcd17c371adff09140d5eba126151a198b54a1e
SHA5129e19440c0ae88e2d36b331578232943bb4c48a58c00e061e84ccd12e33740d7706c2d2cfe01cd71db1597a16bf0c5b97cf22743826363c1e528b5654f55f41ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fa35bf1a1f9fdf437da64983819ab0f
SHA1c6666bffe64927a5d4214dfb39d1521f53a7b78f
SHA256efbdd9229b75e58d645ffe9d68f1db73205424c5d9360053ac83c8a96efb2679
SHA51297419933191e6b8a27b0ddbf2ac55ea6d1b27dff6589ce95331f4cfc160c370bbd350daa4a285b524cf49969ce5148a276a199efc20ca36ca124df9b0c6f636a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0225c3dfa9ca1fc22e60fd449a711e7
SHA1bc25b80420c1286a300fe8d14084ddd4b311bec0
SHA256cd3ec05fd4b414b7d88c5ce3fa867cdb92468ca7f295ec13036a6e0dafeb6920
SHA512b5af6ab2b6fbb5ab775979cb13befc8638977107a7c58324f3a91e0b16cc89399db710cb3b2ba1d05ba6086ad245d3a77361b05364685d7e9bcf3581873fb39f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53431357f9f55ef2c13e17a330d54acd2
SHA14154dc566c0a751d0e537e6e684827b6928b224b
SHA2567e3e78f62c65e332ee888b15bc73ff26e9b6caf5f44b400a455458e28629e8f0
SHA512b3c58e058e425d1d6226ae1ac979f518f15e0327b4b414b749c081af5a459c42e5aa90e067c269287742ad5382f05aa45d2042698e43fdd092dcf190832e7343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbac302d2f5407ecdabb98b48cd749d7
SHA11c75d12bf5d1fc3a12e546a97d57caab3a88d302
SHA25639baf9bc0fbaa7ca4a441c163b13ac13b5a505ac4615359f5f2a5322d40c7077
SHA512b8639f48d04a85bc1e6bbf54811aa5e633340e674c0b6a73e97d691b1b09c661b1f05d2f9fb128964e70e2b3be8ca40b4ffec587d8dbfb8d19a55bffddc9acfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574691091e67cd798893a608521c72408
SHA1045aebc64ab87af82d1dfed12f84f2eef0cd0387
SHA2569d8276cf330ef877b77a5e803d3c309e664264858e14e5f0119b47c5f494073f
SHA512c078f78ec51712a97381163dc517d1fa140147f37c8acd7012fde28408e3dc991a1d745394048ee9f01837a775abef7723843a230c7ca91a07ad2161525607f1
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63