Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 11:06
Static task
static1
Behavioral task
behavioral1
Sample
randomprize.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
randomprize.html
Resource
win10v2004-20240419-en
General
-
Target
randomprize.html
-
Size
162B
-
MD5
b6a1a37fc4ff7a4133530bd086b1e7ca
-
SHA1
67b4ee209cb3c69b38693c5884a8f5267c7407b5
-
SHA256
9c8c654fe26ffff624d54b10e91c30938ac4019fe8c64eb6d739783b9b5f10d0
-
SHA512
b572fd77899459294e8c437f5cfcaf092fa1021558ac8271e82cc57b1012c1c198899b8b303518c5910144a81e7f008524f8cf3b95bfefcc0f750a74a2e9b05a
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom\ZoomFactor = "105000" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d4fe6adc9eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003a02115b6bc2513f422c79ed113c104ef5ffe756c7e9b6e8f195ec7ff73102bb000000000e8000000002000020000000493fd07b91a58ef52a80873a173443693658f30a25df52412349d41bb5491b18900000007b22ba64e78abd4d925c42bd6cf7cba3501b6bf5590bd96939f09af61de6aff20548631f9639acc20bbd29df1afb95da25877eee4d0e870aa3a285f5976244cd021655795733f4eeec5a65a1ef66b65f63eb2c91d92aedf8ed66cb70ea8fcf6c78e62bd933b2ee205b6e437413b2ef555b8bbf315ee65711b381584ba7e113a0629f53b086b61e8935cfca39846407b940000000c59c42b1d0746c2081759990751a4a21b3d69d7bfe86d09c70686abbb1dfadbdac9c8a90e0bdd9b48a8d26d846fbeb100bc699fcb7bec3fd9c23f3baa666b7fb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421069084" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000084444b80475fea651a25ff80b3957e3adada27a2301a207185d76dbdccb512d2000000000e80000000020000200000002744edd4c2c727931df9f6bc2dccd989bd2c6afa70013c1d853661c53ba92a1f200000008348cb99b75252d9229faee0d1f113a7a22195b4cad2755bd0d299e5b335cf57400000007a84066cc12c7fb5fd2422d8e865c7ec7caad2a4f036c2ddde3ffba851739717b27030171fae23a35f399b29d5e1155d526226cb0590dece3a34a889f17dc386 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9691D371-0ACF-11EF-80DF-F60046394256} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2900 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2900 iexplore.exe 2900 iexplore.exe 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE 1564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2900 wrote to memory of 1564 2900 iexplore.exe 28 PID 2900 wrote to memory of 1564 2900 iexplore.exe 28 PID 2900 wrote to memory of 1564 2900 iexplore.exe 28 PID 2900 wrote to memory of 1564 2900 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\randomprize.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9e85fd03b6e3cc96c3c8d793b5e4798
SHA1a8fb7cb7791ffcb1329f27557dfbac80087985a0
SHA256c19653522bfc6c3ca507ea34bce5e40565e519bb57d7c4d75ee8e9685f2175c5
SHA512a42907e39be6c092f0fe187c18b5f780f7996eff484b6b73ce18c6359cc7bbb54966c58c273109c2e966a8d001bf3594a8d3d21999daa5b7ff8d26b737c24c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ff808d780d53b8c346a1133f7256881
SHA11c0d39cc7193ef5d059e0b62b7323c5e7edc2aff
SHA2564de85ed00dd685932c72b84a472d7b0b07d5c7d661416a336be24c9e4a241d0a
SHA512c39e5100aa4de09ce812e88f8d316ba5a084ab5de3ac1e6e0ce39554fed4a9a0d6acc4b3d74124cc269dc269d8f864bb543fe5eeb256bd722188e9db85b0f6ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5534c6ea6126dad2dee74e4a28c674722
SHA138e6ee7e3e3c3e552a530e4c711b75ce8f24ee49
SHA256cf12bbf5ea5e6615caa76e721f2c98db0b7327b3c47cd91ba92defcbe068fa83
SHA5124728a2b03764b629c79c9b2bbf3677003cfbf1330468468c0e76f5b229c67c55a0b175af3d111db09488e57b6fd6b99a6f86207f884be9beeeba27e97b2f874f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fd7179d60bebf9c4157ee81b9012d80
SHA15c7969f16489bc64ddfbac3bc11dc6a583e5aea4
SHA256a35e562db7526237cc51368c9458dcdb802351f2f9914e681d5283d54196aebe
SHA5125fa72bd623591fa64d743e624ad87a6832b911fa78026769b14709ba333d2d1020f818121ef461c53832a4a628e0a77b1ef09e6f99a67f14f4ee47fd785e77f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5782c5cdf2943442b78525df790d26bfb
SHA16fe999605a00513beaa9f856e23052fce06b30a3
SHA256fab252a5547e11efff644eae289115b150e1cd057f0ab8e09a111c02d8e12384
SHA512624823317240d533a1911e61ef9d311f6db1eecd4af6449a7f8a8ad2f3cb3695ce2e85de8a24eeb26f210c1ac72a3fe8903ace8eeb52d07eb931a8a3feffd204
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53beec5c20f959b373de9fafaaab59527
SHA1665c01df980b8b12e02633ef6932c11c017a17fa
SHA2565765ff9bfd079c9fcee9d4fb3bf2cdf600af67b4c9270d78e1855066a9e8fe29
SHA512f4e3cf9c6d87f708a064fb1c99f7340f0da5eb4af70521643fa3513187c62f298c68f8329218f21d56e2cf5db52a55bda62772a5f5275f83e5d7b60f8442d92e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d852bfedad6cafdb574066b0847f5cd1
SHA1c174c7575e856292424233f0708822625af50c36
SHA256d1fbd0539296fba59ec2dcb4ad25bf867c924c03f541a77865279ec17ee42dc2
SHA5125cf0fb620429a0265b4cb4cf265ba1ce1ea3fe3aacb8d3155f1711cefed8b362f39839555bbd31f2e70288d55bc6af98dd78a853afe3d1b94d06c4e3afbb1548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586a17c1c6ba39f890ad06ba522809bc5
SHA1b3915a662497378e0d3e8dc1f9b3e88fa121f25a
SHA2560175a82664cb38c061d3eb7620ed7ac646ce01da410dc69b4182fb1a89d241a3
SHA512930bf53e2c1d800a16b299db1b776a3541e0a3beccf8f93e1d884d1a5c7d4a18ee75fe7df53ee55f1051ab50daaa4407fe5501d5b703898c1fef40972b671ab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d6cd5bdb78dbe52a08248cb0cbd434c
SHA17a8104703e0f4e1776dd6ace0ac4e3a5330221ba
SHA2562817eddfed70783bb35b9820b36e939efa1237e289ad99fbf097894b84031edd
SHA5128da832bef68e3a4bf1a66cef2ef14a084313e23e3afca91a30fa4e0da06ba5ee9f2d231b3618d2eb967403918b486fb6deb31fe802b9678e7125d99b93ee1edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b6df09d904dee8f2147781a48017f4e
SHA13cade5ff6efddd66dcc096ee8dac6634d405dc77
SHA256887a1c8dab74d2830fff0d2864ea266f7f605fd38140f77e9371df5d6bce935c
SHA512d183e27cc5f74f7b44ecaf0450c88f13b272ed5a39e12dbc9cd9b54f6d2a52f5ae2ed1653ef459beddb50d8336a109deb7b0b049f5ae116749c2585609618b7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561b5402f89633d1b4cb436aa2d94e462
SHA10c50ae6ceb50505a272b5e2e74ccb30f10141518
SHA2565f46e21c3cf0d8293739dcc3adc59fd49d34c969a63e7135b53e87ac6440d44e
SHA512715299b4c28e63149bca21291f70397d61b5c32f060f867d893d419baaa39f843a259d68917828e4403ea59d72b14886884bc41e53cda8796cfeaa163e69d8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d09be73616e85a062fae05643c95d3a2
SHA1165dde7811b63b5ca626f34f6fe9be16de2fd943
SHA2564e9c43e8cfe9f003cedb724eaaf96aba778c45b733a79caf04ace1a18e9a4cc0
SHA512dd2df9e69a0733f7e92d6bdea5c082aa1d3163dd1cee605a609182f528979d85f0f5bbbd0a211e7b2fb4f7cbb617d948c9b6b9f04b4d11f7f4fe1f60c2dadc4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511d0a726cb53a3e0260771d83efca9f1
SHA1ca51fd5dfbf36fb36daaafa1a9e2489c4ea69490
SHA256ce8970a3cb42fe4bab39225d56318e20d4b25681775fff7d843475768e7419fd
SHA512d34bcc90920218c023e034fc29c32bc698ec31fb12b5b3bb038c93b2f240c05efd4ffcfa547057c7e363d42e8dddad225af0f87ab73fc40f3507b04455d29c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c5a026a75054bfa6af99e4caf493145
SHA1d1d8ffa7791165feda9689566ad9b04e2d04a4fb
SHA256f9417c9556bdcb02e772ecb6b87c0999d2252ed9ad148ce8f27ace9cefafd1ca
SHA512c9c21caeff00b288838f53221b9093e99da3441909055a5e0df3bca866aee55395db24d4ddc31bc8b62e30623764f7986540cdb0d4b0cc3dcc9af6b5c8de2708
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5918924eb4f32686099001788950752cb
SHA1bfadfc8117b286b4dfd409325fb757720860e5b4
SHA25640277b934270d34cdbf13af1205042e2fa373274e43c0a5eb8c07ca75a02cb43
SHA51233401af60086827ac1db29c177687a70681e3ff7d86cc0a107d97e08599e4e2ecbbf0ffab2850b841a924173f758129f4b2f3dd3b84450ce4ca5136a2fffdd6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc8810a4f24a2fc50291f81707e3b2f0
SHA12b5c8775cab289546bd4f54532ada8ffa6c45516
SHA25653bfbcad495470a00350c16221a2f60f1c75d2363dea49976ec844b16dfd9b1d
SHA5128da52affff970da11b9265d4b883bcce8cce6c48c0c125a4add12dbb247196e8597706ad348a63d58a6ef5d077bf5373fabb8988db6da037d6134652a74a5c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5115475314fd430ddb351c57d872e7ace
SHA10e2c5131195d5d5a282c832adb743a43c919a01b
SHA25683c9386c564ab735ad0539a8caa3f89641793ecb02bd76bab5b5190e6346f021
SHA51272700f14ebf10ccb23bffcd7d9d4e4b3bd7811e92c908283cbe81d20f1739e53399ba561219fbf25633c0e10e78ffc9807d41196f2fe836a7d91d22d8f3c82ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53772bc3831a19f218cfb0639b10f8e9a
SHA1ab2c56a62f124b40fd8ed8efd81240d7483fc8df
SHA2561da44462ca71a77bab28a47d51939a499b62758d5684336946e8baaf9f0d6481
SHA51249fc2051db1ad6377f637d44340e39594ad3f0dc192b427ccf0061622af3ed88bf7130494ad6db3b78f369eec98ed20520bb5118a17ab9e8784736bfba6c547e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a