Analysis
-
max time kernel
135s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
20/03/2024, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
d76fe44e45a57b232e1abea85091738e.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d76fe44e45a57b232e1abea85091738e.html
Resource
win10v2004-20240226-en
General
-
Target
d76fe44e45a57b232e1abea85091738e.html
-
Size
10KB
-
MD5
d76fe44e45a57b232e1abea85091738e
-
SHA1
ffb6424db096c26a1e89b52a4b93964a83346959
-
SHA256
f0f9b7ab2b479b3ebb154c42831d427c9f3f901db5cac7a5cc872ac8d0bb8129
-
SHA512
18171d715ceb8152fc6fa3592a660c5a7af212a2bfe695141a243dbc38424f76a97689880af1e7572f0b670c73d4a67d39e48134ebb2dceb1d44a2bfb7eeaa6d
-
SSDEEP
192:SIGJ35WPNLu4VDMFVMfBt/lMvStl19YeSt03araxj0+nVSWd+jp5Yry3x9hOc:SI+8ooX/ssts03aC0BzQmpOc
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000038a208bbadb4c4659b9bb2f075da7ac40eefbbf72e327c81582774ec5b9d9506000000000e80000000020000200000008a4f13740b7e47100954bd933f73a68c4ce4ce2202249e5934ff69165d9ec34d90000000e3e35ec7d116fa2aca6ddf65690c4cc29ddc4020c346582cfc412607048ed5b3d8a5244c31da399347f5fef7afa5108fbbf454fef99bb19e6349fdc18adb55c3e1a2ddf227d64f528e3ce58f8978a2d5e27a80421a0a2862d9ebab122a1bfbca319b954c0ebeaded7ed8a0c808bea481ebca624246a240284c0990fd4b2a242e6dd7dc2261872d38c7036d2f9972186840000000897fa9c60a783b0bb5995cf14d274b07bcd985d87cf15e78b1d639ce70bbf898dda3f46e2835603c3a17d15fbb81847ca70fe716d7a77f89d1441ed634155440 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417055742" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a6a3a6bbde41ab2767ad414d8ae0af0845d8785c5a5f787b8a409cad9c43233f000000000e800000000200002000000038235884be1aa7879dad7c764b578c10fc78751cf00d414438509a03f09f8392200000001574f723e699a5e6545d4b61c3cab6685d42c3864ef64ebddfc1dbdfafbc294c40000000f5806a3441f27e110961bd0fbe7394c9001fc8b734544c7ab4ff9a7c259d786a3ad2f9f6008fa2e45b76bf74bfb694c9bfc0f6e50861b51ba8f2dd3d22b967dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6056cf5d5c7ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A94CA31-E64F-11EE-85B9-4A8427BA3DB8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2368 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2368 iexplore.exe 2368 iexplore.exe 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE 2628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2628 2368 iexplore.exe 28 PID 2368 wrote to memory of 2628 2368 iexplore.exe 28 PID 2368 wrote to memory of 2628 2368 iexplore.exe 28 PID 2368 wrote to memory of 2628 2368 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d76fe44e45a57b232e1abea85091738e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6e96c784ad809819a6acbeed48e3d86
SHA1c9b3147134be6fb886221228090a8310e1a96f9c
SHA256603fd89bc889eadb1984c94dc660708b4c87e7992642fe7053b198ee0682c5c1
SHA512d328f0966cd9f0411729d6627cd524f3b78a78a95957b925836a34b54e9e587da562857846a2fe0e47f57181ec939f64ca2257f7314e513fd6126bbb7ec9edd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1f5cb7ca953cef93f39d3a989ddc574
SHA172bbc2949cea1456f98cf8d47e25cb0ab4ad307a
SHA2561fd1ee38765e66ed02a1bd053e2714fcc5a26032cf2c0b63f93def6b327a20c8
SHA512775fbc4c36c8fffac4a4ec48324afc1ee2152c871a15f984456abfceabaa410c4f9ac78cdbc6f9dba1fb70a20a3493ae95d0b8b4295bf847c315d09eca8775a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55dfd65da2f7e8f59000edaca45f9736c
SHA16b4b692d892a7ebf6603a1dad0e9619881aca788
SHA256b9c73ee892f2b90afe101def06a65d45ee80277792f788beeb5f1df55171b9e5
SHA5121bfd69c961058ebadad605a37fd26e0b53ba6e13ac46e952bc835c9bc62872983c6225100d10b67d212db683d717bf51f089cd89c914544fa4eff9108d7a4d63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565700f759a564f635b2955559ce14391
SHA1bfc732659afbf8b2cb966bac637aae3f0e9770db
SHA25699c61ffa97e05e527955e794cbbe5009c409b23e50321b72f79c095de399ede5
SHA51287cd2acf27db16591a5094f15b45141e8d393b48b3ad1543dc6e9ce3dfb4923e4a99f30f19133cbe8d94e03fa7bcfd4ec7c4dae3c9731652ca060a59dcead740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da3de2a72944cadb9f874a42e1eadaf5
SHA1b0a8f6e36fd4cd229eebc21d3d688b16bd6909e6
SHA256cb7248c42b5e044f842b2c5b42cc284d6023cb3cf6f57e7ae877f92b801051b8
SHA512de178120037fa145ea165c17425ff7ce4395a193278f6bdf030cbae71c499180b66db0a13f1fcf40ae65e85d95297e5efa1d7372c413c9efdabb682d2b13f176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf5b4e63374d3667f8a57e0f9a7a684
SHA1ce5b16f80648bfe0b481ec4800d01fd3cf609246
SHA256c4ff5f6c0fa116f9e21f3a4bf16104dc6e8e831cc7762ac835768e721899ef6d
SHA512f78d5632c9bc9e9adcbeae365428177d2bd88c5929877ec8a1f34a490b7f617f12a177181fe5855226b3f0fbebc489d04c41a62969758d10295b169f6599762f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539e1c79c0c7db2c30d079e1acd5d770f
SHA17cb6405eb91312a419b8e94ed93ba5bd6a3fe26b
SHA256c921fde2f3b839c8f75071483a1b32622a73dddd7fb60a5dc2e114c7b20e530e
SHA51264c5129e5b2e9de9cc0daa9375fb1ca8237c05bfdf0b3079d8b5e095459d89cbb9768eb0286f6ec3af1881ce35d2af15a5d83afdd0fcddf7801f1832cec2417b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7f70280499af46f84bc2f59a5c46ae1
SHA1619aa85c0bd895dc11876fcaf03609de5a27a901
SHA256ebc0c95ce3c0e1fd514ca0d387b8ffcb98193f470ec683e4d0b3073f689fd06a
SHA5125dc3b26c5e008a9eaa927efd5ce5afc9e1cea7e7a1d52bdb36246d88c6be3a009292151cc84d76c2cddcc21f475443dc6b21ef06a02a2182edbcd0175547e0e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8c43595e278162330ca40a10f36ff4f
SHA1b5436e841dd64a27c5dd452ef38eb15551d98559
SHA2563636bdc53a11d611087f738d2d34a93ea241aabe6e83fae8f3c5c28307e29454
SHA51207f213fec7f4ed04996139e5d44a7ad3179231f2a66d631fea98064b6109afe236531da9f9c89f63db7202896acfca8e75ca3652a1ca54fd5e7f075dec3e00ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a776982036675f25c4673741f46518fa
SHA197d6428fb7f13a55f8c6824ca53fabe725a16c2a
SHA256a5f3fde7b34fd20505616b8eb52bb6c22627907577a004995cadb07be3a25ec2
SHA5125ee5ac1c85cc8a6c67443fed18aba44d30a9887009d385c35181dccbccedf9d6eba273e5a62b9353422f60b410b8e6c521fa60ed5f9bb18bbd950739e4fad5d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543a0fc72afd89f0ab70213f37d07a8d5
SHA1ef0a2a3136f138527adade15dc27f670cf16d62c
SHA256f7e9d5c0e929c3fbe5b8ca79363c752ef1e73cbada79193ef4953c75362d491d
SHA5125ed5285712bb7745ea869bb821760fdd11bf5e2b08b1287f3c05a62fa9b53caa4038957adb4e79e721a9768863063150730daf7d0ac15da3b7e4352d23934ce8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf65826233036960ac7cfa93b781ea9
SHA10a5c3c91d0a61f87345cd6933d0205e719b5ca42
SHA256ded84baa4c281476bd1eb6dfe7981024dbed6111251dc76400eea0a9a164cc60
SHA512298dc97c89684ad1c78827800ca3d0d326beb2d8d35bb92ac5a8d716d4ec715ef9fb5dcc9b5d5b8511846769b7bb3d394c914dcc116cd65d7cee6c3b737a9243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f392f96e6fc8400729f4c71bbeef0d9c
SHA185d699b2d5dad768f44ab2385fee3308cee35ab7
SHA2564bf6693d6e3b509dd202f167f8c6dd33cde47cf37c7cd96de26b4f5296e671b6
SHA5120b7d1129e04267ac9359dc5f1b54aadfb988d152381f4dd75ffb6122d3ca094c8fb351a5104bece9115cdd8cc496a7efbbd64bb4fcbe324d9dd7e7aed680eaa9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595fa2d591ec6f600b73e6581b2bc940e
SHA123b0c5b31cc6e60e7e85f8acaa24bb5dad27108a
SHA256327dd3e68c19149612d1810d7cd9462cbd383efd1de83dd0712b799e59db3977
SHA512e7714fca1dcc75d9fc9adecf0818f64d6bb039d6afca6e5b2d6775dbc3fdd64480d0c5e07a054c249faa32a34ad234fbb45668d99fdf7d18fac7682bf1f2d81f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8af3f82ce4ce53e18b025e2801db584
SHA1312c3790ea236b06e9e0f5ac00361456bc058706
SHA256e8d06719e3d9590eb34f912740ff1083490ea23c5bd1995ec45d8750e08b9901
SHA5121c624b49bd64a25d6ff3e2c1d091245ce5a01af52c6e2aa604623f74d431bcdbcdc94dac1283f9f51dc3aac5da1858d0f70ed27a6cafaa10d2fb17a3f2fe7550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5312818240a251814d328bf29c79c9546
SHA1622f3752917237e1ee541787d23c3b900c8e9885
SHA2569a86123f4272ee7b23b1157768e73dac589c3038ea15fc247921675e3ae66d3d
SHA512b0a3cf9a0e6bc38341091b140be524b8a95f24a66e59af5d5d822932a66dc638a5aa0bcf73e3db7bd12b1c49812ed6b80575212a2ff1c03923ef67e6805aa9b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d7fd8a585e72ba19569bda9fb82c0d6
SHA1b5bace30b4a0848b07c257392e43c8a61e531cf5
SHA256751e7e1bf519c67289980013ce1e0c658a576eeddbbcac7fc5a794c86c4fda87
SHA512c02d281fbca16055909ea553e870bbf136a39527f5305cfe644e7d5e70a38d8ce42194168805bed9f1b427c5e04e863452c14a7aa140671bc13c081138f3663d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63