Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
d5c11b00e7eeece8080dbbc57f32f05a.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d5c11b00e7eeece8080dbbc57f32f05a.html
Resource
win10v2004-20240226-en
General
-
Target
d5c11b00e7eeece8080dbbc57f32f05a.html
-
Size
379B
-
MD5
d5c11b00e7eeece8080dbbc57f32f05a
-
SHA1
c73606eba547bdf621b4d98263847daa837d84de
-
SHA256
ac21b0c35fc8a2ee945b0204897be548f332261a9b14cf7926bec5108361bb18
-
SHA512
50acab2d1734c31256ca2d25a9dd56fc57521d80eed8fa572f1f23c1048aae841474f608f73d9cb18db5e500e2abbd555a6d546f092f4fd42e242931458e7357
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0b369acde79da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417001888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7B6BB31-E5D1-11EE-93CC-729E5AF85804} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001d3c2071fa2224aa1f1217dea24f485b0d7aac68204d3899bc50e2039ecaf989000000000e800000000200002000000084e73e1614ba10f8a389cf06506d8ed5ec0934d0fab356ba48bdaef2cb4266f2200000008d95205ca1e0ece623978e8d6d4a5c15f6e5ce26b22c3e789a52afab838c39cf400000009985d6e2f79d67ca3df63eb8a9e1dbf47100dd2c05e7c845739526c62cdd51a56e05ce6a9074514c6d9ca84ad74c1f88477d6253f78967224ee7c20ba7893f12 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ef16ffee1ffc5f747d76c1dc06af5ffeb22e7b662e029ec40def3d9b065c57d1000000000e8000000002000020000000abc6ede5e2b4c48b55f41c1faa299212c1b0414a4bd5ee13942b09314a40aebd90000000493670b4efba3c1217e50841fc89e9c8108ab14849b43fc4d88eb2656b60057db79cbe8cb88b4a69d8547f432330c5f02a9753e9eb18d00514f4776f50ab4f1faceec658858aa2ea44b9412aa626bf5010747e456cc136a1c8994825bde3d39a524038da2ee5dd33ed00d96157d3ce22cd202d05e07c52a2a3a11b78d28e082cbd5274d4272e3399c9f2018a5935dc6f40000000c7f5f193bc109b463231c0235654f2ce449414f37f8da3d45716d37862ae53df0775d8522f3a9bbd6549fe61784ee2b88c604f313162715e9fbf8aac1563a5f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1632 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1632 iexplore.exe 1632 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28 PID 1632 wrote to memory of 1680 1632 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5c11b00e7eeece8080dbbc57f32f05a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1632 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a745016f80ae029bdec8936d55cc3b71
SHA1d60e0dbaa930709a55fbb83082c5fc246d8b7e58
SHA256ca8991cbb9ef8cb4ec963a0ec0e2a41c5f1bec5e5ba52001734928e05bc71c3e
SHA512a29a68bb526d21627b4f484012e1aaa45bec7b87c42eb5b977b3d09758ee6916edbef77d7ab4a3125fed58c1642f82411181500dfbfeed21032d1b27be4eaf70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58587d6083ced4cca6fe3d15f3c0987f6
SHA1ce15c4014bd976e3ca7d4db3785fd3dde34e1e45
SHA25619776d14f26280f59090f1d2dab912058f9475c6b19b2834e0e658b3b8c9a871
SHA5123034f73542e6b8a7a8f93a899c169361ffdb58c8b9d300a01e49bb17becdd520ddeaf3f13fca99cfa82f43d0827290a16bb65ee9841e89feca11f87979e878ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa21464413a3fb0f5e0dd46e7c36f724
SHA14eed7a45e4ddaec91ce858a9665633d80f28035d
SHA2568f77f8a231149a474894ad69f7e7f3475cdf8ef75c0a21194d6a1701c40c1f3f
SHA5120cf5bf414a374504e72a69c8a2bf7ba44dfcb60ba90c061c08ec329fbafa73e5440d81fd164f3c454b8e4e084ea4b23e01d02f2426077fcab13f738993f8e772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a535811b8f51fc0fdcbee1b9089d405
SHA14aba19ca63c46f3f662e3b1ac66f23e1813dc2fb
SHA2565f271602525fb7ca37d6a7f9da10a2c5e695486ebde13ad6377bb0e467ea5f73
SHA512854ce9f134f4a52973f3682e6ee770404ee0ac9b6910023cf51848366c3a00d6017b725fbe163dd740ed5bbbcb2cbed601fdac92be6f33e2cbe49e09752730d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f13d2b44876ce004d5e77058a4db685
SHA1995054542687983d3cb4d824a359bae88d3f939b
SHA256957647786b80ec4588a9fa3f728bbad2743896ed949eb85a89f1b777e8b32f88
SHA512f28ab140a2a145b52c5a5af6e3472061655e8da85e327cb0bc2367130e4341ea3f9ac3c4d918550cfaebe53f6a7eb3c14d5a227a2ec140ccd39ebd26d8834e97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b29bab1d9a3138d9430fe96f2c1da858
SHA14b4de460b3ea7cbc406f7f7e54e315da562abf74
SHA256a18c9a5bfef5e0c9c1aee98014dd3147d8661dd2fe107de7e41d0afb2daf2cf1
SHA5124fd90cb0b44d65b0569a3927cc1b39f8d0b8414d72466487aa3a404bdaa9f474decc1cb9a26a8597ecfb99025fedb8981a9483e457abff2cef9c51601a08b9fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f56c99b8274238f3c375dcf6abc535c3
SHA1b057b9064a1b87160bc2a6784e1804447c9624d9
SHA256dda60c26569a71948346efbbe6a82e1c3d4bb10c37e95383cb1ea6d1d6f4cd69
SHA512e605a4eb26118ab5e1352b6f0a35c34f2f97b8e7cb749079e1fdb3d9e31224c2bbc53aafb7972311720e6a1739fdd62afb062ab32d5ad79a5f7c76bc4528aab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a171c63fd4a587650f9d4f54606eb92b
SHA104a2548801abc24402ad3466eef58a9d07c0fa72
SHA256450780a7f952807ddeceb4bc4aac25d9fb7da8f4f04f130a6e87fbc6c6231a3d
SHA512c0831ae82e8a88b44a5e8a4e95066d98a2e51bb07a5203d8c7daba7787f2620289327f9b003c515ff1bc92d3616ed29920ad9ffc5195816752c7e9ce2926287e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53414dad301b5c0b6029af9d7c54905d9
SHA12b991fd42cd092d83c82ade70b8bdf220ce291f0
SHA2562db1ce075dfd4dccf77abc171e29bc6a7a4f2554c0e15b89a167b1ae2a0bd95d
SHA512d126e3596ec6eef414b606680c409489b8ea5ea6e4ae487aa95e82ed4863f5fc8b3b92dc8fba622f213524cedc1c3532625cc909413a515c7c59debd966a8fdd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca911e46214b174e93699e5988730d5b
SHA18fe0255414b7771718baff5b70fb9e0d084d52e9
SHA2560a9385c034bc24ed3766a03cbf39e183e3497041f4367b2f30ba55d12f79e0de
SHA512737f09a7d60e2ea769569c83fc45c35478b95e6f57397f144ea547744a27a50c27fd50a6514b9de17bf0b821cc8ffe8bcf9fb97872b0fc86457eb70be416cacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5293c45e6b5891747b8f8b05a9f094c8e
SHA1f17cf0af95a14d686590834d826943cd6d086582
SHA256ea329b64935b2398a81b6867459c155cf7273c4fd1da91d1f2abdbec1be6bde4
SHA5128e995f6e491e524373d58b0b2bc71d953324e4f1078eca6224de13f577fb422f272c8ce6e688a0f7b1184925d7d56ce987741da44f42e449d005e3074ff4ae80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dd748be3514442d624d52fc122fe97a
SHA171ac71ba69017649fd339052ad69ff9d526041d1
SHA256f2f6b1798ff95f450daf8c335d4574c035b3466140e455c7fdfa249dd65ac5f6
SHA5124236497f75bd0747d7a514f7bcb2e17b643bf8274a757b5063e2c7db160449a5c8a627ab4afbd71cb84e05aacd8961fe6d9c17d6a8b00ea1afb50cf9befe47a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eac2fa62bd59625c7ed66c60ad1f2f4
SHA1b12340c225a0ba66b094cb74d123f122a5d1aa39
SHA256616e100fdfcac57247c240b3e0b33ac17d9ec70386ae569ecd7ce0f6cdc6ba1a
SHA5126af2da27967988a0fc3c1c31a1003af38eb6189a2dddf36dfa992dde1175c4170c223cd16aa7702b2eb2dbd554e3fba1263583b1fce16b1b8d115d1d057fc4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787cfce4b5303766b1781a7913d51712
SHA1707a35df2bb5d0f750c4d6180f0003225288623a
SHA25644638ae0e6cc7d40d73b735c881807aa8e079d968bde0acc98034fd5bf29b9df
SHA512761146798b52eedc07a26dd2626d14c2adc00a0b0afe34dc56594ba1af971fe1d71f85ecbbd3aaba9bb1d4c4b850057a52208f24cb0de0f4e45f8a88c6b2d8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2fcd363e003433edc5cf6b89757c167
SHA1eacb2f0624bb37f5dfe969cbc8c2f7f46194d4ef
SHA25657023121ae6edc66ace6947186330643300c5d1e918897722b36bbd7bed616e5
SHA512912fe743058322072fd126a7308cfa8e5bd424e59172120de764694710021977060e342e2230d1b11d42eaa83ed654473f358a8e6ec1d59fb65ab63662df66e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c07ecf84a8c82d957fab27452a29290c
SHA1ddc1517e87a9900c4ecd0625dcef5d53aca50991
SHA2560ca03bebbccc8fb2dfe5ac8591f5e79a1f33d9962ae125b56cd33e8dc4d979d7
SHA512822d66a99065b11ab5d2d9774da25b15dc5092c769fec6a96d0ea5cfc916628f1de61fdb65147288d57819138583fc69ab3300ea8b2c49212148d620ad49ad91
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63