Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 16:59
Static task
static1
Behavioral task
behavioral1
Sample
cbf193f4e38d4f2160f6c790a095016a.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cbf193f4e38d4f2160f6c790a095016a.html
Resource
win10v2004-20240226-en
General
-
Target
cbf193f4e38d4f2160f6c790a095016a.html
-
Size
11KB
-
MD5
cbf193f4e38d4f2160f6c790a095016a
-
SHA1
69d602bbd24e3415c6b5a914602db028b22be6ec
-
SHA256
dbacfec5d347f17c1eba3a611a8a05b77a3c44406c92d61d1a543a762e46097e
-
SHA512
2c4db0bb57570f82843636e01f75868404b44fd23e1d851ac5c0e309146ae89bcf718ff7fd27c563570d538a6916a8d5e94094468cc898eea3b57a4df2e9f760
-
SSDEEP
192:5/ieN7X0wlfi0qbG7ZYbmgpHoA03ibGRF48YHgDgu5tB0vgV4:5KckwubPpHoATbGReggu5v0oW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b42fecf6cbd24c16658153b12e2a3e9804da1ccdf365495e09f629f9970098ea000000000e80000000020000200000003e0093fbac31fc6f15204da3228a5e7cf33d089cf8ad124fd7625e2fe80f1594200000003432a1088a5a065f3b7d496924df3c7260e1b7349890cea6cf931cc10c7c33f340000000bc7473099fbf63b8810ba6070433c4d42ad5f81b7bd06d750b38675e690a06f766d87c8ece2ccff691a679b1a722e78cf6915b1d73f8092c8fed5128ef9edc96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56A04A81-E2ED-11EE-A38F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0eb322bfa76da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ffef8f3774f4af3adb42663266c3c5296991a8bc313b64e310d199e775e05aaa000000000e80000000020000200000008d609b8e71fcbc6086b5e0df535a8980b06b243e6b4942291366176405c476499000000049a2e584df3573ffa302129f2864dfbe4f54c561cd6cb7912c244e146754d2e34be234ef1da3a36f48668d4a6e685466bf219037cc7c467d798a9620aacf88604a5bf562904ecc84a6fb3c3797991fe966790feda8a34cd49adae3b1a3806785076fb7011b31aae6a3e45c26e93cc272ac13e5db5201e6ff63771bb751a4ff42a9baf60bbec63d8b444a09eb71a04e8b40000000dfaaa1f0e9092993eb712af4b7c677ea77567673e956dc765185cf1ab6c629f9ffce025597a8fe72963453324431967dcd0857bbbd0b79bed8ec4e7987f4ff3f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416683818" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2184 3028 iexplore.exe 28 PID 3028 wrote to memory of 2184 3028 iexplore.exe 28 PID 3028 wrote to memory of 2184 3028 iexplore.exe 28 PID 3028 wrote to memory of 2184 3028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cbf193f4e38d4f2160f6c790a095016a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed91d841d21c796f2f7885a5c28071cf
SHA19e39ce384bad17c0ab82f9513c3c7217f333b0ae
SHA2567255b653b60379891adab656de5eaa54a6640215dd0087154eceaa76e0f8f97a
SHA5125174cc7811313b700a35a51f7f847d21ade82f1b084e68c66a80a550146808e0e431d690ae3a7d076c6e5ccfe11a12ef3c7b9aaf99cbfc7c653aca3196f8cd4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5e2c2b61412eedf53bf698e86a4041e
SHA10af28a6d4845701cf4025e12a07bd48c2fad7a55
SHA2566841611adf91f58e959663b105e76b543e02fd0fae5c7348fecf79af2bf4320e
SHA512e0ba20bac8ee631100e603bd63dc814e2ff0847c2502668590050d3810ec87ef5a83832fe6259e2b153c2c9545cd4d6120d9be09ef0f847f63ded970e72f6fb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5310e7ba9d696fc36f56af3dec51e5229
SHA1c4d9ae68b53785050279f36496f0ce5bd3a4839d
SHA25613f3bfb460b4ab38c8c664f22b0744f206d6bc9c0fbe7299c779ec1811b91f91
SHA51221f467ef0fa192c51652da61be9ef1532afd6e380b7e1366e8a9dac896e47de181a25cbb19a9e9db011708f0f93843b7ec993eafe4fcab9e0081ddbd3b586629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae61a5622b6ee17f74b2e76b803302d8
SHA18459455eae1749d0e2deba47f88a81ff709b4f5d
SHA25652542d7e4ff5ede0591e7227ad7cc7253f2514b7f9364995e30fc8ccb28c1211
SHA512bafb680f8c601b8b33b0c7a6dc25c7a97641b82b159950d59be8d217af3a97ed452078161db501ad1e5eff6aa7b29c46ed4d91a57acdfc671f6964e375f2db9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544bf9d3d40697b282db36f90000c2c61
SHA1e39258c8eb51361ad8a142aac55de799872ac763
SHA256a9fa983c3ea085fd55f5b1da539c370b4b09e5e223f43ab4853aaae9592882c9
SHA512d80d8f17340028b4cf525419ad08920a7620462a5775346e8f1044637baefdf2631727e9e6e1b4db74a77421a5150d8d885db403173f39dc450963003020c321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ecd52c42afc0a50061b28978e9efe40
SHA147c3bea8a3b8c75ccf045b107ffbed525ad6b9f5
SHA256df2a54145f63eccbc75909b0da79c27cb3c573ec411a05133f7496f154f29abd
SHA5120ce73c2f1a72e027e46dc55b26ca235f3fb13ada9b7ef6242a9506340dbfe8e05738f66f960d23de6071e462ce0678c4dbe999ee966d0f98ff6ae5c96d7b183a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e89e95a631a3994a67bc477523fe9d9
SHA1e81d81fa1ba1be3b70ab9b34e5158cc2c7b30f26
SHA2564fb648da4a5e169cfdeedded100358bf8bd511825dce5a9e6059cd7ede9d0917
SHA512b3ac5405a490e94f43fbe05cb57e6309a204d42fdf7aa45eeec0bac41cbdf0930289831511192e752722b4f4bd3c37185921ed94cb1d7386e3cb208d4a3da8de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ce1e2be998460bcfa17505fdc35c4b4
SHA16fa2dd28e24ece0c9beb16d63d5c903ac10b03e6
SHA2568e28ca51aba781edee7f5b2281155d5b87b8a981f75954b539f6c366fde793dd
SHA51217437361f8ede480fe26e6dc0e3860a027bb3db37270ef57c85d54d7b46f995e93f7486e09b1b3207055d20ec75ac1f717f522823b2982bda5ba2060c55e148e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a647d9708cf85d54ef75c476952283be
SHA13278fe396fc99b3b705afca0e3a41394806b6a2a
SHA2567e2a5aaac384b26f765a70c2aec2bdaad0edaf8adef90687d727ca025905199f
SHA512d2b4bd0f61c15305786ce04212d7f53326551f6a60e0cf0748b26cd0652a5d2cd551cee3c12e60e335a13ca47a5f85d1a9d20a026ea7deb1a48eec45f3522a3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ee26086897cdd794c6ded54136ec719
SHA16c8b96954e46c98ed778d3b1f27dfda2dbfe489e
SHA256dcbc48b2a547e2460dc141fb11bb227ae4b0a1bb8414dc4cd6f96575ec550cef
SHA51224e8ffa6e7e8e3696d6ca8c6c95c473528ba4b55cda8a1b69a5b9683de0886d28fedae3e15ca61118bb501bd505e327326660f5eda693f214836fad544e8acba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a85bfd0371e2643e0d0ac3294ef8758c
SHA13bc952cdbbb50322776b3286fea17c3683852e0b
SHA2560ff572a46e70b053c02d6f0aa4efa515af9c00ec143a0beb6457438294d1da0d
SHA512aeba33c03b905ad9f6b5ca8c0f10f03defc07180529fddc2908d95124586ab71e65d3354ca4cde5b91ad047c6dc9e6982f482b04173a2b4d751f5ece1a1f3386
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559dbaf5106a50929cf1611b519ab772c
SHA157ff76787fd21ea69a62e133c74c46fa792ea192
SHA2561aec9e8b52d83f8f68da8e7dbdbff7e9f632b6ac361c9172bff5059dce8e4c9e
SHA512332aa027e2976669adbb96b9150f4c29f0f68eee24503ade56aebce01413f68fd6ee8527d844ef8f3d0188352cdc5744458f8ab0e608b43642623aefbcf52200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3dcd71a61cbf0ca405d4e16c85320fb
SHA1867a8d64e402cd25a7173a15e0d4cd2a43ca8339
SHA256aa10c7e705ad41fab4d3b7d88b8469af8ee1915fd774a3ee28b64819c879a54e
SHA5127a57f1de5a1b398ed99ae08f6d5114b772918c8d52870a867a9f3aef35515417768036a655181019e8ec705efb2353add30e84ef3f2808e795f26e101bed36e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573f24fe454c9f6060d071b229138ed4a
SHA106a433e7c2d20207254fd93b93905f9544d4ec18
SHA256e12e5aad46746f51ba02c2de68c7c2a52aa30d66145e85774217732d9e85c2bb
SHA51239dea0d01ba5b0db81c7b0a875929df0dcb8db159275d7023f6f0a10a6f5792433634db80688c8af944383a58125b0c15a7dc867b5a14281a1e7d23240224235
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba3715a9cff026152cb24c23580de689
SHA1037632d1be4a538bf292f5d40efe23b5d830d1dd
SHA256ac4f30c3bda28227b24ea5c09e1d39980bd41416c01e980a8f8d0ae70a27c1e1
SHA5125c3af267fb41e08d43c8d760d23344d466ed6737b1165bcd629ca30ec82c422d97962a3f6b545c28d5d8487fdecd168a7c42763a7452816f6e1c0bc2c08079c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7dfe6775a72a04cab755d0d4765d7e0
SHA17fab5e5682d10823a4a2a7d31cd3904141f6fbe3
SHA256a3fcea4d94ba81f2dfc3857e80d6cf06473c9da20d9d64f40dc10d857ab12216
SHA51247ed4b448af43ecdeda95df1f30f11d738534907fcad348aa3413bd5e966be9a2c1a92c0236169cd6ecd64827492a786af81fb423a7a91e04402c05bc4475fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5049809dce9a5eff7239211407af56364
SHA1790bc467174f9c0e381ad40444028b6c1faf5de5
SHA256aa56afa6dbe53411ce4954352c759f0b45f2dedfda6a5a3b759135d29305b35c
SHA512d948c5066af86b16bab1c18d2d6c8318454017c7305ad9d0c409536c74a51eeff5610a2a3cbc42ee3c8f837476df5acf1f75ec13752311fabcb821a73ad2449e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b5bb7abb57e09630f4f1afb0f947b88
SHA1d6861263f467adfdb8bcc9d816243fb62f780150
SHA256dabb77d644bb5dc75801f5f8db5c32afb2de083156b57d8c580455f5d8db9482
SHA51269160412fcde5780a6e6c35237c8161ef621d61692099f0bbe93fdddef5d0753128a476f83b335a6ccc752f5a1a19b6661e70addc0a1830a5c38d2bcf27a01e8
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63