Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
cbf4178a60bba730dfe0ac8218d3a570.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cbf4178a60bba730dfe0ac8218d3a570.html
Resource
win10v2004-20240226-en
General
-
Target
cbf4178a60bba730dfe0ac8218d3a570.html
-
Size
59KB
-
MD5
cbf4178a60bba730dfe0ac8218d3a570
-
SHA1
0d3b24fe20b715f3d4d6bc97cc41f0a2e1d521e9
-
SHA256
7906fdd98cfb105ea35345c18ba009b200d8c04763100b0ade2a1a30eaf3e592
-
SHA512
e07f1e129280500b6c74bb67068cabc10b9a2b9e2d8235ff4e1932eb0c2002c50c6defeaafa7024b127c9a21b5c0e4227bec289f99488bfd06e0b0806be82bf4
-
SSDEEP
1536:SwVNpSUUw/gTnLQFSg5WEV8U61AP4PDQhMbCSXnmO6c5OCkTV/iOyEQDfsfY1JvT:SwVNpfUwYnQnsE2UwAP4PDQhMbCSXnm4
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000054b2e1e92a0439f4f06d99b06d21419e867e642383599c7f046e89c5a0037fc9000000000e80000000020000200000004206941bfe5be3c4aaeb7e5cc1089318ad2fddd7c394889adef1b5c03e8d210c90000000d26f7b514e3f60c7259a94adafffee6c48d1cb7284e36fe4dbb919964fa8e5a948416b9c36dccc0febc47a4fafd299a478c5a691d1e4c2b1564a84ab388668166986a16f88f9c2e20539560e92154e389f8108fa9690d1dc38489b3f353a22793c243fe208e43cbd6d459dfa7542ed593edd586f0889970402492980a5ef9a5af7dfbc8915eedcbdc6f4e4ab63e6b6784000000065bbfff7395dfa4eef98cb37184c0cd68b45af33c72e7566d0419ef016071b5134ffbfe124b964465d2d2877e963028b1a30de2673c46f219b3ec18d7b8866d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A211E81-E2EE-11EE-A8CB-6EAD7206CC74} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a33df5fa76da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001f623d114340eb125e2739d9fc3eb3f879a9052c07a6460726bdd71953fe17bc000000000e8000000002000020000000d1a85e54e09c65ec6b0c394f8d4bdf7203725ce28bf069a2c71c6773bac7c02420000000bdddc11df6a8bdc0db9151db1e32f51c1cc665ff32d3d07d6407a2c95cf1950a400000002dae076e0fdbdcc6fa012cc6c6f7cd9f42bee0e6e4a2c37c1dac0ebf56413b29eef593b0ab489600c84d877ecab42bdcde75418c0539ce5008de73c5897fc63a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416684148" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2092 2360 iexplore.exe 28 PID 2360 wrote to memory of 2092 2360 iexplore.exe 28 PID 2360 wrote to memory of 2092 2360 iexplore.exe 28 PID 2360 wrote to memory of 2092 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cbf4178a60bba730dfe0ac8218d3a570.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3b4bec64ebb71eda1ec4a5920bf4038
SHA193242152dde0e547c2cdf3d8690d47b51f785ab9
SHA2567888d9d5856cc6f218f7395dada1fe77886d57ad16102f6523503da7ea3a92db
SHA512a52ab50db5a46e5f42838b0dede854c4508506e5a2ef47d73e3e2b0c3ca057e2619eedd9e31dff22feda9ee86283f146cd77b32adc9be712a9f48b1f4054e06c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd156f0f580d0c68bc691676546b0585
SHA12430329eaf0deeae4c55dccebc54b7e5d30b1ff7
SHA256696124cb1910b125583d9eceb3db7589f990d7f5902f52f5ab58aacd7bfe2dd9
SHA512354924e58421e4110e2ae7a7d9a53e9a4ccac9bc1c28f1ffb6991aa53dff849b2a33f2684aa6e6c8eeb0521df491356f0b8d28ab6c90c12f575bb66027904d76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b94e823122c5b525727182b9e7f6383
SHA15951faf4cc79350e8dc567fae89a671fedd1ea0c
SHA256e37c03e30aab03596896f44a36110562331fa7883eeda2b091e4c9aa02bd22f1
SHA5122082121343052bd6806bb914ac318597993bb89ba7549fe89bfb9ef443007fb8ab45c5d9107dc7cc00c9b991563f844aa0781e4f42f9c248805d9ff02b3399c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525dff87cfcc103e22493abbfcd438a80
SHA132c60acf8aee9e3730fdc26e8a7719eef1091ff8
SHA256921e297e024049790040213ea7aca298556a3080e49c2258c7ea80637f77e6b7
SHA5128df224cdd284f543f750551fa288d6d56273e1fc35f61129b12f7690b1c9abcd7afc50758098b80e6d637eba83dc89bef176e1250f75176a99fb1ae0953df661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509aced269a2c36bbca0d6a283cabf321
SHA1d9eee471433ebbac94280f52ab3cef80df5c3f4d
SHA2563d8debbd6d077f9bb27b1f8792b8b0294cea38efa1f64511b10d816ee4acf6fe
SHA512ada77678cca2de0ff473e975b94377f87ef1e1cc1fa0238e93ee9a12d40c6aea2d1d9fbde6ab6bcef1841f62e3f132f67c05caf2c6a0185f02b678114902300e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5617ce90692e0c69651f4d15efce9152f
SHA1a9520e1cc5dc6c4b9ea2fa864e9b0a6e720aade3
SHA2568371a49f6c175f1b40bbfe6b231a524f7fee14c97656a91e96a14605386aa948
SHA512946798d3869930ccc84d4c376dba37c34e559ed490601f0ecb471bbf767e320ee99f17841568febb80ed8143d83143851fb94068db14c1effec8358bc00c2e6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3d2bd73e8d127dfc93f78d7443fd4fc
SHA1d7596c057b59970c5e70fcd4965dee4f72ab9f42
SHA2566c81caca8c33b3fe8b038f95acdc83032f3baf4eb5504a80ee5d08e99e290c89
SHA512a54724adc324080bec928cfba80dd5be26b527eaea68dfd6fcb90cfa32a7ec1d94ecb4248e1e835ffc069cfb1a654bfa69f107fedb7e3686c3f5d103e1228d07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dc01b70ea1a105044f46b400494e228
SHA15f3c729caad6d8a4c1d5c893531fe0801b71fc18
SHA256bf7cf322ed1bc6d4c05fc84b307b1c1dc500bf26cb059b22fed084c09c636680
SHA51225e14eda42a34e852b30701fd4446361234f53b4d0a00839e382db21b6b9169e4b041da4d5770057c3ff4ccbda9ab4ea22e8562131cddb0066e562262c25ee45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c015936e3853b2500fbd4e1f32c90d73
SHA1c1957a65aa570f31767e1a5ac9092fda097e6134
SHA2563083d5c841bfbae904dcedb0a9f6ebc50c971808ac4b6bf2cda1cebb1844cec6
SHA512135f9505b0db60a66f522eae87e29f38367181b49fe223406a2dd2b08c624602106441c2d0167bed06ea56f84c3357e8eed0f2ec0ee2f634d17da60d8877367c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518eed0ceff9d99e929e7e7124fdfeb51
SHA188667f712dde40ed13fb126b4a70ae902faf726f
SHA256a6eac8913438b7ece2faf79235ef25964ceaeee41764ecedf6bd9dd3eb6bf6f4
SHA512b1b8b4d708b7f0307f3b5e6f35a0d0bac02d2f7ab41cfec7f914e746fa1b4ff62e625df1cd830b853b5babafdb1ae4d3d3e833f1aeaa34032f072dbde9167976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b999259e07926dbd614865c03ec01b2b
SHA15cec9637eaef0813b5c59e93f3bddb817ddf6aa7
SHA25698ae23aa8e459b8730acc9c2ea2d4cd0083f5eb7e1dd626534f26f4b8613cadb
SHA51222b9791fcf05084262fbcdd35e4fe75cd7aeeb047cf7e1a8af5ee5a1aae6e070fad0c74abae10c773a5c5fcc30fa2b7b874cb82cbbfc32bca83144915cb64143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53067f5113283e8a9b50afa5c44c3d282
SHA1a51d50856fbe449e829d5d0b132d113efb5b529e
SHA256e53703ece42e265cfaae6b09253af628987b7d30c832cf00b54e099e4a9b1b3c
SHA51250bea4b0ac3e8bf66d68f3392dce91aca50122d81a092e5cc6e2331762f04441ff030296fe5563b1152d9dcaead518e8338915ff67415e5614f1313e39b8c89a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da60ca38fc525d5c4be816c389466069
SHA1f74b78cd1009dd2d8cdc34eb927a9a597de43bac
SHA256bf1a37b7f40c263646d0a0e3554035f87352b758ae30549c98690d23847e0a91
SHA512b01f038b8f78301f6a18317dfc69d502ca08511b3cae93d79506b23cff14d3c56a25f1ca9532f8b203f86b084fb40e67f0ae9126ba62d6611c4edb3b58c6d040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f15d4a0c3e976c21e6c24e7c2baba599
SHA13fb1635a27c8b0f0b14f805f4406e2fa0605add8
SHA25662132c06369ca4f286f76258fbbb7d07c08b65e0775847ec91553e4eb5c00165
SHA5122157968061885f0701a8f5ac751c3f068297cbc76aa9728e28e9f5fe154312642ab5a1ffb293b1fab3242dabb0387c5d9ac24614bf354d69bbc6369af2c280f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e594dbda97b02f5dc906c4ebd47017c3
SHA125fc7173efa149ebce8cc8e675048349df63fdfc
SHA2566cdc14db65f57e11b5a4c029c8f1827c1ccfe46ca022a4e16a4914328f30a99f
SHA5129145c325d68cd55d368c9bd6c12378bcc8a35fabfbf3d415090c2eed5750fc45e6ff076725cef2b26e245d894ea62ec046484c6d7f4037969ee78f94050e6c2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e869b9917ddea1a40895683b07e8484
SHA16ea9529b2e38a16719047f1325dbd727baccd55d
SHA2562e8cbd35491aedafb79ebdb215a7b204633215a42ab82f0e2f757d63b80116ca
SHA512bcce7a1ef51e27bbc5584b41c44a1e619013c584d358ea7967c5baf96aa5ccf2c678a3e0c749b682bad7015f20e931744d8bbbe0a205617115d5511cee460141
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63