Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 18:42
Static task
static1
Behavioral task
behavioral1
Sample
cc24580c93e13e1ee43106b03dd0bcdb.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc24580c93e13e1ee43106b03dd0bcdb.html
Resource
win10v2004-20240226-en
General
-
Target
cc24580c93e13e1ee43106b03dd0bcdb.html
-
Size
53KB
-
MD5
cc24580c93e13e1ee43106b03dd0bcdb
-
SHA1
f3aec84f99412716610bf0ae5af34273760b195f
-
SHA256
e18ffcace800b51cdb8ae198e54a3899f02cd2a554607420c16bbd6b10987224
-
SHA512
d3a8db5b0305f5bbe174f1d9d7c6b0287e36b8cb43ecc733457314fce8d61a87ea0769f7961a8778e190e0be25f376485e6ef998b63794b9c3636777e9c982ee
-
SSDEEP
1536:CkgUiIakTqGivi+PyUkrunlY163Nj+q5VyvR0w2AzTICbbjoq/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUkrunlY163Nj+qF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f345be0877da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000015b503c5e29acf0cfe876d23718761818f281a94919f00216f530a342a894d6000000000e80000000020000200000000f2779474d895ba0394000f4bbecbc59148a0f8efcfa918253eef6b2d177fb699000000046e116ab324f8973ed776ab48bdc5f98d49b20b5ea63f026242cae7f12cd2771219ea14d6e26048c67d21de08516d22be151ef1f37a1c16bfc059097456c8387fabf15d264c470818484edadbe6f0e936547dde9ff119b9431999a703e7e30892fc55349d6430a58af302387476a7f40191a9a8909f232c153729341f04c31a30c9f10f357a42a12b3a822aff7734bb040000000578fb12186e392d8054fd3e85f6f0daf5bdf39b74d89a85e54bac4cb3c212e91600f444fbd80846ef54d1ef30bd6bb49ee24627aded1c4b8b8473ab46999d335 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000ba275d985fcaea2012e541b18c8dd44b1a503b70a36ee511e93e255198c27111000000000e8000000002000020000000eff272a7d4e8fbbd6497a8c4c95d4570e3c74481f25593a3bc736a31a8416e1e20000000673470c5eb23f88e90157bd8d457875a15d43360b8093222c332c9d581c0745f40000000e59a51a991c8a45956b052d4cbd75f7181f45dfd746faa3c7043858420c08406250da455ee21310039cc99b97732167f766e0dc9084b7da26da0e22649d48a02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3C5A471-E2FB-11EE-B98D-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416690040" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3060 iexplore.exe 3060 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2904 3060 iexplore.exe 28 PID 3060 wrote to memory of 2904 3060 iexplore.exe 28 PID 3060 wrote to memory of 2904 3060 iexplore.exe 28 PID 3060 wrote to memory of 2904 3060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc24580c93e13e1ee43106b03dd0bcdb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503a5a6590d44258d50ac10ad210adae5
SHA19e4e7a9ccfe6044a5ce25c7ff8da1806a254b66a
SHA256284ccbda1d24ff3992ed3f04ff6c890b642872f065025c0e762fdff36e362d52
SHA512014c61bd68d70d248f399becb7ba6b3c0cf1e978dd2d62862218d7eafbe25607609c4f11b60b4c2fa2a512582fd2639bd949e34904e43cf7ef01107865d9c9fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa82999c26b66e3761ea26c663be47b9
SHA1db81c6d866015c41c54220f4d1bf4656e2f44dc3
SHA256d6f8bcb16d95d2b20d4e02a2f4e7ff6cb2aa7fe3aa3aadd181f54aae266315a4
SHA51262a1a0f1f24d3b93e4c79e5bb0772ce02d188a62f9a9d3c491ffae59867fc3808297c3719264cf1377be92175c01a28badbce7c107fb8a83480b527d53f69a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5702c283d30f48668c1ace73cf885c88a
SHA183588dc18d0ae8f36db08a8b3c5984fcebaed824
SHA256333eb67e1938ddcef28f615c7c678e9afc1b93b29c51dac8fd378bcc7b29e724
SHA512225fbc350bb9ff94a1f523b23c8f76f57622d047dc3502cde057a67b8e1c4ff6dad4a61e245352a936c2c6fb5aefaaae6f6819dd928f3f49dd4850f5f25c42a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3b695b966673efaceffca57958094bb
SHA1fca5f0024916227b2afad209d379f57273b60048
SHA256f8122b056aa13d9fb174752cc0d0fa11feb020f38f51ceebee479d3e33c71339
SHA51243f7b30b6f650802922374ae06e697776c4b332b95960596782b184749ea26a8097310442a754802b562fdb9e40a714b7498bfe8a3539a8670f4a01f85495c53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56749110db23978d528f73c5eaf4edcd0
SHA1f56cc2030bffd9e1c4f804365ee650f13a8b6911
SHA256d70389374d128bd902bcf9d443d653c2f53936b1a1ab712428c0e163202d525b
SHA5126fc4ae6fbfec64cfcf960618f145505c9939234b3860bd07d9efc474335105106b4fec6a1aa2841090dcc66d847f6f2963ba182b4393548a81b4cdee17ba382c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50db16737a683f2b07f1d716bba477686
SHA1c42cafeda0fee654ef2f874e95708bdb3bc8b5ef
SHA256675eeffa32b5a4f506e772c2326b9115acea4f4f8109e53a3ba29e5653876947
SHA512da30e00c7a75be71fc4504489756c9c846afe8e04032bfa0396bf83838441c160213b2f93b2270f6a18c1623f09c5654c90e537c8937d9fce538ff6c7b6e9492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5addd1d6d6b98e8f70d0ac0543b41165d
SHA14698a541491ae75320df69896b503db87144ada0
SHA256b1e6d15a583ecc2484b796a3810a5c11afbf0bbbcde48026cf915624a228dacd
SHA512f9c2a937e78afb3fa6b6d98d00ea48e5a0ecdbea723f6131eb0f4d3394d9556602b5bc4ba3393f42051d1f2fa8e097b9e6c4d8842506d8c6944be14b4643f845
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfdcae07ec28550a73c0494771ded31a
SHA192f7ad9b0feaeacab16c6dbee8aad634c40add60
SHA25689e8980209c01bdd8d6ae64a755d71c263a5535c5b88b3a14aa5c724c5788560
SHA5121a87cbd5d10335becdc912fffa9d9c4b06be45acb3f9d04a69491dcb4a56c7f5b7a29b411a4ca827cca34ba00fa4d185446bf2c446ee640f7c73cecf8b3e41df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593ba5bb007d4622918dada0e7383f5b8
SHA1af7edccb49db46defd1111e06ed73b8b57258078
SHA25691f190a093300462d5c4c3dce02a73c27449c612bd2b4c06468287e0999b150d
SHA512801252b5457eeaa0496e5ad2c002a53b61727f6fd902d42db9b25049b923f570ba22f7e7d5a53c7243c55843b73d87096687cc646b9b90da4c1206390fada88d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc9b1be4608915e0367b3e1db62efa0e
SHA17bd8b790d6758292935abbf0d3b2d772ce326f82
SHA256ab920062569f284056b162240b904c12d2d9cc634210a68dead1d89cdbd0b22e
SHA51233323e8a05175e87d7189bd125dfca9264087a537960c719ff9d18eadd3ab74d1c38e35b59b5fed7ebe9eaae88cf60b7eb30b3d508bd2d792fefaa4d98da0f8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ca4f125a0ff8ef5598e86dd54384fd
SHA10c5465d3eaea8c336f20235836fc1876d8cb6b06
SHA256184b1b118f6fb79d740859d01c9585da327046afa3246e12d076ae4f336664a3
SHA51237e588c434ff107568dc6bbe0ad39457b61b985351a91136a36f2ef8887f28f222629c99c44eb09a329aa306568cbc9d55d895f2df7a3ccd9e61a6d3578595a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e840301a4edf223e451d989d36dae9e8
SHA1fb3781515daa21218207e3ba27dc13c7de4501e7
SHA25630a86733d15b9717581c5e8fc488f4aad9b5c28a36a161b98f289d8044465284
SHA512f47905590aebc252c5c2346368f60dd70e0302928d6a9f452f165e2653122e6b76f49b0dffd463e2a37b42d2e18a1453d8927b16010f7c8a56012fae8db7a0ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a6042211e588b87df1847155d570d89
SHA1a11b6b1fe02eb2c9094ae8e639516cdfdb5d7635
SHA256d60f705e60c4870f9d3c8ab212c8606087d36be18869e712ca8a95ea8f604dc2
SHA5124357b6afca1301128d6871ff1edeae9c15dc13c19d449a2302e39b0580117e6d34ba6cd3f91cfea108f0ea891a870b38ce0a4f70b5aa9dea64b43953b617d6bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50821a67f66c4786bc03a6aefcb7081f8
SHA1fdff124d085df995d0c7b73e97c95c9ab2f58f23
SHA2566bcbdba90d1b7f3761139d26bf694872efac762559208d2434df65a038c399bb
SHA512c466f01a8b2e62b4e8ff3f3148dda86dbd1d8834c887b621416eb95ef63fe6d099c91b73e093baa69abbdbdd51db9c1208605f85b644bae703eea53480239ed8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56487f576bc8f9f5077437f8b34cd2793
SHA156a2f508ec6969d98a70228ba110f0f76683e821
SHA2561af879631766422e0e3723e4be466acaf719e5ba91baa0bea1cf10bba200d2e0
SHA5122e9d9bf01a0ec7b7d603bdb236b2b266f18ce11b05ee606c02399a447c372b78e41572c7cd01c600fdfcc447165c92bff1c0f27fa6870e29b9e8ebba488593e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e4ec24c50d20ffbddc121d0cbb93f0
SHA112518fab7a2eeb23c2663d3c75568c8b3fa47baa
SHA2566a03b40d8df4bb2bc52e5eec842967c6feb3ceb6c18b2f159a5c2e16d2655cdb
SHA5125297044b86f05d0690cc69d7083f9f96b8b1cf6557c0de7ba1e42340cd6d742a68639f7bc98405df23f67b5a3f285cca23fcfee3325d0b52e6a9c0da7ad3ac74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52df6b63f7be1c1f5718ca8fa39106c83
SHA180f19470f3279f65df09ddaa2341dfaf1175386a
SHA2562852af25d9d8ab55be1fcebbe4e4e627e1228d3647bd2c987f5073342fb2ce9e
SHA5124289840df48ce9946bfd46403fe5771ee70f35ff978321ec8551ddf0cfe00c6766188a79a7d3940cb9b9b2052bc85352f5cf002004b497c045ce178ba7b49d68
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XJ0RD6PK\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63