Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 15:49
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
61c4db5666cc1d92e60dcc1c715a10e9
-
SHA1
32e653bd740a02242e2515540525e3c8190f5eb7
-
SHA256
c25cbabe6035f7ddb207376f0b94ea479014981fb44f78d74b805e476aaca7c3
-
SHA512
fb51aee35ef2d5bdfdd116327b3045ad64937cae3c5d53285c3a7fd40bb4548eab32b0a9034d25957fa3c7f1b4f13f3bd76d7d57fd75a5a78b8ecab56b621e2d
-
SSDEEP
3072:Si/ssEQavGi4pK8yYyfkMY+BES09JXAnyrZalI+YQ:SivIGpbyVsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C112891-089B-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420826858" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2976 1932 iexplore.exe 28 PID 1932 wrote to memory of 2976 1932 iexplore.exe 28 PID 1932 wrote to memory of 2976 1932 iexplore.exe 28 PID 1932 wrote to memory of 2976 1932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5601c9ea52739a610a8e115787a811f8b
SHA166f7e3bb6bcec285b4ea2b2d352900aae42ea7b7
SHA256a026bd6dcae338e5b59495288acc906dcbd3e8da53a285380d28f939deb8a65d
SHA5127f3232019410f9bc63b477f895af6fe8d25262011995ea56d2e32c0f2027e5c269740b65b81539af9c6560a4007d7d705e4f418d9ab402c49b230aa210f571b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0442119a4a840781937dc2fa8d4b194
SHA1cf8370855e854f33fcd6199a607ef4acbe27c452
SHA25653915a70651b2930a6a2e5dfd770985ef98a0dc022f71b790e17acffbd6766dc
SHA51278702dfd0b7bf15f9f0ec7c8ac440bfb312a8e18d8c7c15c5a44638349f00278bfe9a40d8632e557d7603e2617694d16496528f98350b19eae43effec95be9da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edf9e922cd34700f3481debb1128b8c2
SHA1f30a9ffd29c71998006743eef5b37ab04dcbb71f
SHA256d2cb8a7ff762d1561d246e9edef882a5c33f3c124795bac258fa08f17487c97d
SHA51240a9187ca9e4d92b6e7af30a6407f847383dfadd9e9b65e712e90161b67bb8684bd9b6dc2f918e1748fd68281c41b705ae8d0a0256b03d1bf6f7b8b8426088ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee51c9b30b2191d239ba7377241371d7
SHA1e1046601e1574ef897007f41c8e31fca51aee1d9
SHA256d09371c7e35b744b5ee7b13a775da2456db734fe7dde7e113165ebf40bdbed2c
SHA512cbf52e2eea7ee30883c658e930434a53e9c31a31cbdbf100b06595c2d9299c289e0c564e21529d4bc5d03ec404b8cdf4d0c0055cb9093c5c717fd563077f11d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552ad963bcd2bf4e1062b566bc9adba35
SHA19a1d36ce48c90f5d80ae6b73704bee31980a11bd
SHA25612c77d41dfa114518b8a8bd2aa45ce05a05e13a3fab457f363ae3068068cc955
SHA5126a71beec521c709b7b3635c9608d763cd03bd10a8d2b80db168b12ee0ee1b1731dc2e086fbdec1e717867c00b46fda78e249c702c6ebf8e728f6bf73e9df81c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6334e51d8b0f5a4d815a45b2601082
SHA17662ac947918811ddb5f1863de66b9e459fc49e7
SHA256c0dc5f38be126713ab38e8f53d995be2f909be3201856dd0cb65eb2629b4a384
SHA512c5f5f78ef7e6ea501a8162413bbc7e6ebe4fc03255a7eb9bb94082c74385eeb94fc5de6f241b8d5e1727ba4cfed8d35cead3d7e14e99ae4ada3b0388437e47ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df7dc663b5acd681d07f657a588e0e1e
SHA1db5058ee7bd1240dc92a3d726fb9c87457f615ed
SHA256a4e7bdd11922901cc1e887d258ce52bdcacdc46e8a294deb5724eb5bf29cf744
SHA51277919c385d8fa2dc9133d849e2b2ff4ce896dc7bd1ff2add5a2772ef619e0c7913be9dd0b6791fb1ad65143fd001b93aca2121445a46ed00f7f62a3a522e2ae9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc22fde6dbbd9c6749397a98885ad09
SHA1137ffea191c6281f4a97a3af98f2d4c299f5d110
SHA25654a7b6d033ff8a2a8abcda77d68ec5cc4e3cbfea90381fde143b444c8a87be69
SHA5126c73fc767d56cb31c13ad356845aa70f99bcc80d8c62cea3d4a4ead86114aebf5ae6e7e6e14bdc4af940ac3412824b6ef1a9c2781d6535cc6fef907091acc1fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb9866b6a27bf7a3756f73a7561db4e3
SHA180c7c97d0173b882158589425007ec2b0259b833
SHA256051d31ed739fe3df96192a0b556430a5e45976da346f851ac4ed46d345340b33
SHA51209caa5addfd04a62baa15938725a4f89e47ed0585b57c4c384b18c48299908689e43f9e029b4baca8dc968e80ae04e12416a29ca008b3586a1d2297f32d097d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb78a1d4c63e93581343d79cd4aaa420
SHA148d6b75fc3cbad62634ef01ac8893961c0c3c24e
SHA256271fb11a4a3d64a8183e7e97c30144dabe537d86b79c406080c05ac190425d7c
SHA5126f7497e16ceb2c94f57f7211e03eb4240db9a05e0262d6d52c042a243d8985cf84728d82e493434a99d7945d1b4901ec6acdaf27647c79a98ca6d22813af3f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500d6385f5a3837573db326b4c2c15c08
SHA19665b663649ae1e060905645bdc6633cc7ce6b6a
SHA2564539e7b9789af5c9a7f9d63527ef6b0e85d595632d1f647acde2c921953b6143
SHA5124bd9bbce2009243b9cc95d841febc9e1aca65f81bd56b860c7e5584b76f56ae35f8039c736c7fc90aafc0999ea254a6858adc667e120646c857d69ba535f9b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5012c66c68e6503c1c9827db6566c2eaa
SHA1228e193e9a575d7dab30ed6ddb675540bdde75cd
SHA2567f6ad2e9454949948e4d401c8288307de242288b4276556da228b95677a5d47a
SHA5120d4d8cefeb9ba89665b5c59bf918d4496c1a312aa6280dbd5a4277651c0216e2e6d9a780da7f0cf38a002eeade1688716b9c8186cc9fa352c5772f48743f81dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516dc77a137b1b768927735f62f268094
SHA13487fa230415d046ecb8a7bbf2d5e3c08d453aba
SHA256d33aaa87ddea8438aa3f1afc18c93bee99129f2944add59e3f49b5c08dadd355
SHA5127baefe6979618ae34cfc782ecf04aa3399beeca5a0723e99a19a7dacb8ea29e2d7566b04386af12d9f64a8c9e236ee10f25541ea59a633826b842ae45d82d32f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5570f1f750399c2d646fad6b7ad8637f2
SHA187925c16962c7acabac9c5d37967c3068d1fc537
SHA2565c2696c8fff714533eeb76a94495e8751b485c40538d24619307edc5219d7ff5
SHA512335bd7f8f1daec20f11e475943a63166145a11a89265f298cf86af43a57b156aa341131fd1baa7296bd9f39c89780362abb2dcd74d4057216f9591d826002034
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d58a4ca0cd3182a5bacfe76c475c0d5c
SHA1b0871c5bb14f4e8d455f84bd3681b28461ac8d90
SHA256c84c8f9855b8f074cc037a7ffbaaea1589dedf3c93f57139a2e7f42ad76a59e3
SHA5129b7349082870f27ad5c42a5b9477efee64efd82d26194418be7cfed7e63698a7f8de3c7cb9d26f0856e9457e7fa8e4b768184df0e1d2b141cf2bead029f38414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5799ce4af0750ff999fdcd6e14a6edb02
SHA14b0de648a965b68341c86cfccf677eaae93b79ae
SHA2567ce171f26149e1747b44a8d7e63b44951e0592c2ec4479a9b10041db502f49e1
SHA51202aafbf7deac716db1fd710df42ae7b7fbd8d643b5d906664e8dc0d5783627904a49ad5a960c4f6d67fefd93a3a7227f45874fadd95dedba082ea0d33b5912b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5ed77387d5c57356dc501e4823c4622
SHA1697af7a36ab1b6f8d37e4f0d8a8818dc38f1ffa6
SHA256dc9dc70cf5d0ef3a03f5d0788aa1b6594a5deebf88c2b0e4a1158eba38d62953
SHA512ae7f76808b3f2bdfe58fef68299dff159c58d0e54fe68d57b6fd8d3873d873b13f9100e89edd84c78b66dd5c53ac0ee4e6a1380f075583e3bb98f78a128ec839
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb329f5ea1523e39bc5d642f65455252
SHA1b4cf6aa342ee8299c83c6be000f72f40ddb7bfca
SHA25699d818e1995ac6be1e8bbc1d1ccf5a7ff4ae2477a0581ec642360aeaf90605d8
SHA51278470fbcd9e2d6ca47f7b21c83dc93224de7db3bf80c1323e7ccc396485be08b9ec2849d45a322316288070237171af3845bc3c16ff82e466cfd840da2cf7e01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddda1b6ba0f7927c57b54c1bf633fa63
SHA1633499b26d6fa30886975a7d14a54f10e1641185
SHA25684087530812206030a0a48c69319779ac2c6114d2ba6f3f5f3fb0e2c9cfbc2c7
SHA512d6c2d2ee9b89c3db36eec30fe2a226f08cab819a7deabad48926febea56b4ec9c58b9e55cb15bff8336cb7cada91b88ee420d8b2d843a1405c47c46fc708e628
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f92022f410d5f58fa7225de65b88de64
SHA1859ecd4bb4793ed63dc90154746e12a85a90c758
SHA256acccf7df8cb3fc256b62e540e2fe254ae0719d8eae75f81956593ff43d0fc01f
SHA5122a8bf9b1f0924c2ef8ccceed6529ee0db88c3c4572f1ce2a7fad7f6149c4e2f84b5eacd50d8b7071c1dbdea02057afb538085a257b30001e213ac23a58d01347
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a