Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
cd95f613ceb7116506ab48542394bccb.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd95f613ceb7116506ab48542394bccb.html
Resource
win10v2004-20240226-en
General
-
Target
cd95f613ceb7116506ab48542394bccb.html
-
Size
44KB
-
MD5
cd95f613ceb7116506ab48542394bccb
-
SHA1
683f61eac6d4e398ed8d374efb7767ac819a7bb9
-
SHA256
e022ea5f62390a540da5f4aadd6e03d2329e7b527549bea1cf644101e0f0d658
-
SHA512
b247b859c2c537d6e45ee1a53dd1f142aa610662723355bef7d26809f303fc5de84d702902a93bad6a97168e5917a36b5260169ba33664da0028b0be59af058b
-
SSDEEP
768:mwS0l/sGVLsk8ejW4mTNn2ofMelgqscs4TA/k:mZJtJMelgqb
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f001ac917c77da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416739742" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000002bcde9d1974f9ea1c1b1eb2abe3a96634009b69d14bccbfe585abf4b1ae2625000000000e8000000002000020000000c7162dbb56a5d93f97e8424bc39fcc904e7474e966a6906221f8766c1eb35bcc900000006bff63ea33986db0206e606a5f524af88a2f980c3d291d278d62db806d2a6b059776d94f61f825f8c79de7f625857a88722869340e550c8a39ea76a79ffb89d348652d02535d5ecc5cf0d6c8b8e52d286952387710ec54c8f668440957c83e26c41a854922b74f57733bcfad3539b63e5c78e84c3b874ce2e839070790f6adfca367b33934c252b17d25cbab3ef4bac040000000de71608be29cbcf9607d1fe8f7faaedd5a796611589ea9a60f1a05d1a086d927c9a5e645959ba47e77794815647962948826232bcbb6138f02700ad5c26c29e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000094d7e3ce26c2b1c409a4145c8a2b889c9c88f9fd7243ed20f5cd243cc4e6142e000000000e8000000002000020000000a74147e8fd91fe7d30773ec5fc44502b2c405ec5a2a7ad36fce7205851e507d320000000e9191801e2d0d45b5b46d4acc973b6d12f507af97e81cb681596bd310f71978540000000805f4703f58f30ae232c7f2e80996d83da0bdfbf4069600b98d90dac2c7af88ee3ab22876e65ba85ca6a4ba5e3a704cefd0f8ac0ed3af50cc583e0e3d5ea39ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AB57981-E36F-11EE-A5A1-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28 PID 2008 wrote to memory of 1712 2008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cd95f613ceb7116506ab48542394bccb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508443a873e2eaa4daa779ed2ced96182
SHA1b450970b8b2d6692c21431fc6d955d0246f0dd6c
SHA25627601251c3514a17bf66a31cd197ea7f7b11478f8591db47837396df0457ac9c
SHA512f491001e3b1801b15e398845f251c1bcff0fbe5cd0c19a130d6177e402b7656297c07b85b754095839b429256bf1106dc2f15ebef5981a062cee1982416a7eb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d94dd6bb85e16e85a0413c7a4997df11
SHA1c71a4d42c5f930f87ae51cd73fcb8eddd684d246
SHA2568e70b63d821f789a250420ba76c7f85c69641af203d6202fda1aa1121ab77d5e
SHA512a3193632209a5a4baa26f091a289c0ca49e9a907ebb1a8d796433e4f1630c16985eafbde1ae2672dcc540681a3fdc375bb31b2cb265d93358f9314a833a93eb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa836016b88e575fe2c360cbe28e4cfd
SHA14261dd417a3a12879957cb572aa4fb193ffa70bb
SHA25689715c6f0c3eab49762a5f80d55b6a411abdfc340684cb3b20e6eb54dcf5be68
SHA512a986807e65322d480f29bde490b0168575bf3191731046c1873fce28176e2c05166577f0dc8da3b8b4bd3cf23397a540e729c99a2a13fee3bae1d343eed1c3bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550a5a89c8ea028b2ff752dd54ae62dd1
SHA15639ca6e8ef1f1b1e9ddc4e8981d5644d3b40170
SHA25642dc2e113ba8621d0f45bcdcfe1175caabdf8ee22b6629ce5c0bd4c8009b6e97
SHA512a80ade6479ea4308d845d0422e596b1eed9c6d97908445cf081cd932b9dd65690de2eac51f5116444e71209aa212621e380282bcee7836f34c3dd51d9a2f800c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570bdcc50d8776dfea62e60b0f6df6f43
SHA180190c186ab2fa4564b7a4a29c0423d15d67ee20
SHA2562f3deb50e2d07015445f84e58862c7d08b0cc4872b08104c7c8a50adbeefddd5
SHA5124475b157e6935cc5c09d9888d0ad6fda0083d39870c3eae403575e046134479d2db29e79672d751e0fa8594a176736e08e94948e9a1dcaea484b5a4e1e46a2ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca2cafbcc619bc2cd56ff574b7e93be0
SHA1a62d1bad09476d93b5876b5b1ed5219e04b5f7cf
SHA2563da9ebc4e2b6df49cc9aee5270d2e202e04557bb45c652e342d0563e57616814
SHA5127f091e1d6ae2b81730ed44a0f35fe56f2a93397be3b85b6e8cbae29565d584efd6a9db40abe35ccd7c24012a60e328743f4648e587afffcdfb4ed4c3addd6160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea081f2fd9d82449acf2beffe95cd59c
SHA1cad43057ba6364f66f51082a6fda93b7a2bb8039
SHA256239dc13f6f33d4782c16418cea83cf118e408ddbd96339c3565701166bf7ecb8
SHA51272b79ffaedd80e5329c70e146eb409d7bf00922cc1d0c7a1fa1ccc70201ab50108c5d0303fc49ed62fbf97a8847e4b302fa9a20d6e979bfdfc87877503b27a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd40af83a6baccf2dbee62fd50d1ab52
SHA158c9809ca446acb4ff624be72a7d34e3487a2d83
SHA256046448ddeaa5bba698903f0be8287f2e83b6b4d315fad8a608d4b0e25d5dccec
SHA512d8d1063fac7b7b25d3ed105619027992aeafa732102e81cb0101906cbcfcf9331403ac00a1101dcf00e49d2300434826d54eb2623631323f4560f06f3c418303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3944dde0e2412e978a30538714599b4
SHA1eaec8a7ead7ebe26da521f19dd77b2a1def7beb4
SHA256885bbe04aa8dcc61334f4cf6abe6b0e592d3e86412df3dcaf22435dcfd87016c
SHA5127fcf41bd3ad5856d1d001abc086f5338028c9be3b81dc80e328aa31f07a20fc6a7e8485442b0668b465d0e18d2beb128fc3cb24aff532d464b76330fcb5159b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535d8ca362ee9e7cd99c72a68abcd7a02
SHA180aa216cdc326d230d5c7b069099415465b75259
SHA2565cf0bd152a6c19d2a8d2f1fd23630f6fcea6905942f40a32b16580595f3b4664
SHA51202b0599678721af465893fd9cb5135a6761574456014fc1fe1999c38ffb4dae7ce22257e5b8b0ef80fd00047e966112526a679d7d8ad7dbc1c2c4abbebf87691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3f2161f28159d27aadaaf9c5ff21aaf
SHA1c420e5ea482894887afbf86787ba74b70fbef5d1
SHA25639cb522ddc2298ad6148250299e6f8cdb6f6e1ebac77b4f857e9a33510a666ed
SHA5127f3a661fa0d5f37385b0a1cf86c0325a44be752a9a179932843fc4e15b4d4025ea2b522525bc61225dbf1c5f2db9505899d41bb0326d314a3e667e2de94557df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c73f4eb7e695d747135a6b13be7d920
SHA140c08433bd8eb4e36860d371716a8a1364be9489
SHA2563f27e93248385cc35a67c3fd5d0dc71232ae2179a51d46150dc2a3628236c89c
SHA512eadfe682dc24f73343899fe8b154bde830aa42df499ba5d025d85126198cbc8f50e7ce0dc2925df3733373a29819d549658cd10d93216c1ba24c10eb95c5e280
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3b04f406a3a2c0d551b787ea8acedad
SHA17bbf045499874133bc7753680307582747095b35
SHA256ea2e1c71358c4cc4d07e35a708f984eb8847012ad3949d2aec2bd636c251b98d
SHA5121977f9b181858e7d4084a19444d994f947d9a5f58b767762bfe12e7f14b0abc11b246799a0aeb755b2cd81dfce9d4588a4ddb52acc7435b74a666c43ab0091fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538b4f0acad796b7a74ea5714a7f42840
SHA1d56806087c0d564936412ccdb926258429a550fd
SHA25673237b6db42bd7c80c8897a2f1897e63c79c135a557d9ca9e5c41bcd9040c1cc
SHA512213a55407ef410bd378c1d22937e3446b0cda80a0642b0c3bb0a8b8685451c0a92afaa2b6459e10efb33986e57d0f1c35a209ad42c0565e245f8eb951c3f19dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a7d2dbad33c731dc57a1e50cb37969
SHA1b5bd83620f82afd1202bb1d304f8baaf279548c2
SHA256d385c5cd13a6f3de289d83d1cc1d22724707c9a15dc84704e95039d8f1ad2cb1
SHA5127000b23d41cf3436e7ca473b03d6b19194e59b795ab56dab98a270816742101df88ddf61f58581deb1602cd3b498a9f508cdf69d9ec81fc40c11edf1d5d11739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4cdb5d754f616ab424228d903c3009f
SHA179494f91108031bc699394f13e955153a176a01c
SHA2568559a2c8c3aea257058216b296d88fc28df723ad190724c1313c9512eada368f
SHA51282a6f900ef6de1fea1e402210b5e635500c40c2c5ec3cd9905a8789908c1d23b836b058c1affc792cecd7b79bd7257ec31cd093bca2cfa432aa7064aeb139907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c261616d2dfd305146539a87be656dd
SHA132f560bec0c9ca1cb11bc9da73bbdb7ca54ff815
SHA256d47805616e149e5e13b68938eb81e113316fa1e8f1b2e0ed13529d1fd7bd3df2
SHA512bba74da60af1097293b83ea7e09144a48a8494ed030cfbdb930bc9d6ddeda18f4c8a5c13158ec805b7ccc65d90fc8f47302e8acf6b45cab8ef67de07bc1fb8c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e9a5858fba9eb37e455b51ea6a62c1
SHA14a48b8b37dc0cead01ba8f6fc3a746da412c0778
SHA2569ac67d431b0e5d92f9027a3840fccbfebe2b3b8d9ab8819b56974c836a8b0057
SHA512e6f34c6c39936b9d9fa3dcf992ad92032dedfc3703dc87c74aefc75820624da7c1d169c34ce492da87ae9cd3021b34853168331b879f2b19bb95f214884f5e0a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63