Analysis
-
max time kernel
144s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-04-2024 01:32
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
4aa88295e0d7e5851266411ace970a65
-
SHA1
f9090a015c489b96c45029d3999e1cddfb6551f6
-
SHA256
10c757037b3847e1fa8dc927fc8d681b388f396bc14a2057d2638dd9ebcccf2f
-
SHA512
d98963fcd308c19269724490eb4c83a474b8994b9ede41592beca883692f84c1e4dca9419b53b41bb5c0a58638a59ba1686d15e100eb23297d05a1e2c8c200bc
-
SSDEEP
3072:SZyWMKxY8cpgC7yfkMY+BES09JXAnyrZalI+YQ:SZywxip3esMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C317571-05C8-11EF-8C27-FA5112F1BCBF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50906974d599da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420516227" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c1739cec2544138f2f5464b782ea9494823aef223eb79b548509747852d335da000000000e8000000002000020000000df2a45c16597496e8773812b16a68cc517566ee43270e127f4291b150958c971200000006ae367d672c5035b8d6c9c28e20e9fe147b546a43f80375da49e06a068ce44d440000000443f69acabde9299cdc95d44c9e635650f43617e1ac643d0f0e04d51475198a0dfd60da1c001759f3dbe9cbd0b7d2a29eaac0a3223a1c262060ebcfe57b22e35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000d3a1b52c2f0ad97a11686f7eab777a985c2df12c5f8ff639e81eaab52ddd573000000000e8000000002000020000000bc23348685c1e1cb8b14ebf47d98a947413b6cf65fd56f19f8cb16bf9fe802aa9000000073efa8ba28c1ba4c051980a1de4fdd0e39dfb3eb574acf9198ee8532db320f9df1a13386240003fd808a0deacd957c823c462d86273b07cb1051b6f852adc2e08b50a9462b90a7580aed7946caf3d9c527333e0e051349082ede680208b28b0f13da17d2e479d7a3eda0a7bd97d8f31927e62ccb343a777e7964a76b6c134f7864eb3e4e50593eae1f0199c120d1a1194000000036932bddd05580bad88dfc1255d7c28b37f8de42517ed3770b23c1f02d0fc2b89083a2d7458ac2b7c6caed670a16cbb8c4762c22dfd3fb644f3202d7df9470b1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE 2560 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2560 3048 iexplore.exe 28 PID 3048 wrote to memory of 2560 3048 iexplore.exe 28 PID 3048 wrote to memory of 2560 3048 iexplore.exe 28 PID 3048 wrote to memory of 2560 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6e26e8f13c1b2b45719ebd4bf57fbf
SHA1596f02f07b6b76444ac1596c0c9e6b1522aa24de
SHA256f76b4d6ebc815ea35d30e2ea727054ec122e7d3ec52b7521a75fc418871dde97
SHA512781e4d22f572a0f096460bf87cca6261a6fc3ebcc1d14f395914c5906949ff8c3581a6d5f9d95f79f9af9fcfc7c7b0729067e817339a64debe14c597f8235039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d979eb9c69b9fdc3e1f03c90ea5a059
SHA12ef0463fa388251e80690f1acfa5e6a17178dafd
SHA256d7842a92701d346808572d073626049d8578dad352c5d1d9020affd5207438c3
SHA512521d31f0cd86e2110c2f1b6e8159134ae4c5683e1efc3cf8cd43e7d0dd30ed2e332dd7bf30edd906675b2874e979a5bc0cfdbb2f688cc29df76143cc8df10a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5200b6f82b29b7ebb25d63282306460c4
SHA1364346cb235796c80a82cbf952e8014e124fbd2e
SHA256d0a4dee785d1a06be36e961847465cca90d4566c59ca53573fb19da6d68ec5ce
SHA51296c54fb728a00575d7189908d9667f049ca5783051ba5556388d1168aa6551cbb2088e28f7f2103659852942cb72c0ba721c76cedebaaa5fc28cc6d9c8d31016
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520726a0419a3cfd05b5b9eac755db237
SHA1760434bf4a277c859fcc0fc58f3c8329d2d8b060
SHA2563366239cd4ced4f6d4aa39b0621b005c89f677a8538874ad24c6d30b34aa2438
SHA5126b5f9847bb410e4a1f62233e0c1b4249654b8ce0acc3bbd5d3645072089daa7b1266a228eab2b2f2997612d783383aaff5982e39b859ab25030560556d4fd645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56303254d5222c0bb9f5838f9f809703a
SHA1e16a9cdf7cb5b121d50d4380732ea60a4bbfa01e
SHA25654766a816492875e9811ab2967184612aa3f7a884de0a22ff225eb5ad7c7ad0a
SHA512ea443047715c1bfdfe6f31ee22d75cbcb33891c1d2ed33d0301f480fd6c08b12e0edd9d7a06b4f867926045c283b9e74a2a3865c08e174fab881298f7f1bae85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f26aee74005e1715372ed9c2c88ab5b
SHA12cc8d247055fc8a7b19fae7e1796cae0490f08fc
SHA2560964f53db7b29695f6beff157feccb0d7552daccc538a3739a5131d5e82141bb
SHA512215a5ed3b81fde2b0e89a24aad156fc5a4615b180eaf108c6873aba383780be634daa5b5ec6a2609b5a29bf8991fb84e9ffa6f3fd7b1c58769256c0f031caab9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b66e6fc8f2bb184e2240901c8304d8
SHA140ecf7d42cc0a111628721ce73ef8f5b8f85e3da
SHA2567e8066d718f41f33d8684a395d4f2ae334d63fac4fd81796c15b557d112c1b9d
SHA512acdbf3b0071ac80cdbd623c7ddcdfe44683b6f157df074de17e2a83782b66b5f878cab1a10f20d89cdfcafcc74f66f80db631157cff955b413e712ce4a8dfb84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f11b55359ff2ed5900c6f06e8e43d154
SHA128d9dd57b34ef59d9f1a519ed1228b68878f327d
SHA256a4d27cb50b183f70a249a4e8670b6faa7479752bead0a0fb8095aaaf761be631
SHA512898bd39114621a584db873bf12cb0317a0a7a31323a1ba580d7f0c3b7e381d9c33b26ce422d2690026f7f0196301b5d6066d75aedf4c56ea8a132450599d4cdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d336f130b08d0c2ccbeba6315f5784a9
SHA173494eb4eee800c22558a39adafe17f920753b1b
SHA25614a35068cd07440fc6fc80b6e21693611e816e0e47d097d9fdbed4d2b4d0aa4e
SHA512e2828750f29b4bb0d11a71265e2416190de48bde7ab125134d37e49de52a3642cc09564a7d2b2f26b476bca210e1bef8b0fb008beb1ad454d5adfa10467651a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d041ca2b0df807a424c22a3e10e161c
SHA151772f65a32e88b19693e2ad6474ea17e9a3e0b6
SHA25683d514d8d7e53fb8c9a663ec48bee8b27079aaf4e8cc8a6e8fff9f6189f97ce5
SHA512386dc91d9df1d8e2cef5a941a40fdbb1e204974b36307576a6495251cff167388c2a5ebbfad98e065f1ac7b6558630429bee3285afd2daf43d0ee1603d8937cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c00c111adfc34b6913d872ad2e564c6f
SHA124e679dd1bfa96cb7ed5d6c19837e99c28d8c827
SHA256655498391e38023cf9476579fac6830596375e90d644af2dbebcd49c4e394153
SHA5123bb83f8c38f737b92828b38caee0b5e47b42258402e4213e221b90e23ea159ede05b3b66cc7c26f0cdb5bc6915aed9b943252bcd59ef018aa5895daa5b675a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5095de6e85a463c619ad3a8028bde80f4
SHA1ebea1d32131563f89f70c96e13f99a951dd9ffef
SHA256a83a9e83295298e6a084255467206310a188024dbdca1c615b870865236efad0
SHA5125d1f0663a8ec2967481c853538b769b4a320164e81eb9e6b42af3e1aaf547c4b0c6a1a84ad538e427e8d7d4723a4c5ad1bc4e1572c5eb40f82b90d7dbb7e7e7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532c0591022d671117b98f9f0ae77c88b
SHA1de62a4b3150ab4710b88fc8f7dbdc810454acb1c
SHA256374795408470cdce30cd10925a45f7f98618b369da4088bfc246852f4f335325
SHA5123afe89de136de482fedf84ca09d1c07936d85fbc034dff6dee803abf3af49e692e3846b1e2817bba021bf940f817466c1f35b9a2e1d0868631d8a97fa6555ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6c3343e0a7e41562b14b4e859170b64
SHA18a8516a5eb8608f73727353a8fdeda927ecc0c38
SHA25617bc2e8599be13a356037f760320a6dad5ed6fd2d928ea4e8d1ea487c6422e79
SHA512ce68fa33ff58919240e3f01bc358a93fb43cd7f9f08c6ab75d9726d5d628d569346cb92785c0b99574b0ccc55607810e8f2d0fe63c3d6554278bc798202e7153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55458ee4a0a9845a46ec849a811c8bbd2
SHA109611ca87c1a04b62824e9a6870abeabffbe644f
SHA256ccd8111fd29fa3fddb56780f3e437353db2d4c4323d6f79819141d1eeba192ce
SHA512f9c4b28bb5ee2ab8136ae983edd3b0f4b747b59f2871dc22debc30e1ccb4f20d05632c163410b1e6b82f805e75ee9f6b8f9d2156ce86869b2c0d4c058b50489c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ee745de283f0bf2bd43dd5808dd5af7
SHA114c621e257d9520020f0a9a0183eb598f3d929af
SHA256465b6d79c78f1b5d97beae70498d8f4cc1df436a767ef1565d250dbe4f43dd97
SHA512af9dad25ed1e3cdff44ad8c4972d098d06e8f14bcfd71b7c83ff38095137f1d06d6b1590d94605640cac30a371ba407729c8b8ba4a6b8ef432168b97827cbf1e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a