Analysis
-
max time kernel
143s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 12:11
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
8584f926f5d430f9ade1583d8f863e46
-
SHA1
d8c5abd0d816dd77e9a3ee88b99c175e64ff3295
-
SHA256
fa6c47233c168ea02f200e0fc7c4f30bf8e830b41a2c9dccd59c8223b9429151
-
SHA512
789c32cccf0aa9f87d35ddd323106cdaabea6f72243159e772e68a3f5a2c312e3df0f7480de3ddca3bb5a8f722a2a441cbf0edac20b7479e3e23b9a1cd92b8d5
-
SSDEEP
3072:S86f0xnRH6MChByfkMY+BES09JXAnyrZalI+YQ:S86f09RHgEsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ecd4c0e59eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A964A5F1-0AD8-11EF-8221-D669B05BD432} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421072984" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae830b7425b69644b0a1a10687fdb7cc000000000200000000001066000000010000200000008886ff2c475f404a8cc6174d8ffc20a2ad97b413572bad79c1b6e8a7c13e3e49000000000e8000000002000020000000e1729fa6b6669d261c216ca68de9b3a0a585392d023258c757b6e57fb1b406a2900000004b53e9eec14e0fc5fa7c916aec66ec2d2724b04f0b78a6232fa992440ec0f0f21f837c6101995afdf04eff7a8f62df1516c0f8448316e95e545397c947a3d90510480295eef34f03dbf6449712c7257686b307957f4040700eb4a7d96e918c0761db2ad733196bfb7831ad541d3cf3baed504a2c15d55d430e81bccade7a89e07093795693770a97950f385e56f0beec40000000477b7fc6a2f6a2e6ddac436fdab85dd4f1d665bf1f84ffa30c4b76b0261ec62360c620ed81a6d530a3a52aa8e26ba6f5d6beebc9eb0518b8eb8692d9030705bd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae830b7425b69644b0a1a10687fdb7cc00000000020000000000106600000001000020000000eff85941433a4dec170f5003c5ad1b7288476e0d6087ace8b6ddf19a4df9d2d4000000000e80000000020000200000009240329c6044aa83e73a9e67dd07e5060c86a556afff9ed57c16e2516e5770dd200000004f22147f15e470fb695a8bf2350033540e7d429d9a0e4479baff853416f421444000000065b2ceca4001c7f1e04f10039387358d8d31ad2e4caea361a45aac18f3a190ed581b604fd966ea59fd8ab62f6ed2897610f2821a7c95d47bbf197f10790aede1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 860 IEXPLORE.EXE 860 IEXPLORE.EXE 860 IEXPLORE.EXE 860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 860 3048 iexplore.exe 28 PID 3048 wrote to memory of 860 3048 iexplore.exe 28 PID 3048 wrote to memory of 860 3048 iexplore.exe 28 PID 3048 wrote to memory of 860 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD590fa9aab45d68d4ca12dd3232385effd
SHA19591a74c11d109171e2f23e6ae767fefabdb1c01
SHA256a5a6eb40fcccf6e3c45bc6b08de98f186b50d20cb752f49a17685234a075ca34
SHA51281050a1b8a850d43d5c63dc28ba5d4e2c889a94ccc081a0ede9b4e1296a193525eee30999d07902f94e75f929a6c1a4fd733b053076b8d35810b7d0925efc379
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5255cb85f31b67ccfa1421b096dad4920
SHA1bf76e9bf5e571d30ed400f209bf82437250b6895
SHA256e429a70b3e000c89d4664cb1f224963b451dd54fea071dda2c5c3d0bed03849f
SHA512d6bd837662cdc307a40f467dc2d84c7385d0ada60c91012d8632ecc98c08d1ed064327ed86f34f356e28d84d24ee39372b15c38471c5f878fe2eea22aa510619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cd5a58b3e5af520307865244a3ed60e
SHA187146baaead8089c622fd088d7751eb4312674f2
SHA2568bdabbf2062051371c5733188e5050d6f78dc843bab31f2319e80d1eda46ac72
SHA5124a7c82871bb66674366e8ad4789f9c4cd839a717a4af29694994883f3acad576a3a25079125a1771f75233b7da9a2fe984d0b84f514d6f1ed3d4b435d104cf52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb3eee9dbc0e19237e24c0f951e87be6
SHA1a10e622fe072617940726ad121e534ad53cca7f9
SHA25620c7b5de4dda33ee1a4b73d51a21f721f801d9643e96d63dae0c074384b5dee5
SHA512e8dc3e311932d8af100f8d312c9aed9162a6bf4340ad43fc4b6237cc31d7daf3c505248b0e718db583b9e05ef73e1b21a2950b69c8fbf8a449df797f79bf8df7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566234cf4a02994bd72e142373ea7f1ff
SHA1115a574322792a485b0ae5dc298d2eac7553e5b0
SHA256c2acf93298de6a8db7845ec7dfa7c83b7fbc74cc613e373e432b226bc021cdb8
SHA512130f46ceaa95c0586b2a21f3bf87f6df6146566c7b9ee12e3e8dfb72e93b7bb41895ecdc5a1f14dad961679d84b6a90100c5f3b569239797c4689fe5f654d526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab82c7bc75f71667f9531c3ef9d2e16
SHA1f015014b517c83facc29f3f5e613a8bed9092b7a
SHA256d077d061c7ab4d5dbf98de4e92d2e6524dffebce5ead9f2b5a13f5790922cb96
SHA512f653afe6cecdb6c6c1414e9545ec8b205fefa5a9a287e63635ae7461e3f6521976d9349b39825c09ca963a5911c2f37bdfe6127de1dc19e9562e270a994146e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5c84d26aba1ec9af80861034fd467c6
SHA1509f255f1650a56136735c809a8c9c3a62ca2f75
SHA256a8ed7757d218db393704627187079de2e30835f3b4fe88f08057f0b16d931086
SHA51288fedead4c36718a92f768d8d87bcc03fa6e89e49211f744dd42e8a5ea310d30fc9353dda44574a020c9d7b85716276576ab89bf715d63ea4411c4dcde2e1a04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec40545df82264b1ed597587e15a33dc
SHA1026aae5a7ec98121fbefa743a5abfd0d6e32a99a
SHA2569045b28c772ee0deec8f9378e8eff405b432b54dc02a067c13d7336000f7efc5
SHA512a12a92a9ff8863d5391350b5dfb4b3e9dcf4abb4f7dd74267781672b5023ceef16b639ba19d47bacc0b105bc7c2cad6665a890c54c8fc73f4d10963599a8d453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b96ac774c2ac00b14d27879cad31016
SHA14e1dcaba452583098f448a2028a74f224ce4ed20
SHA256a771d2285771d19c4912b239342acd27ee88e595ed71031cd6f45d262a1f4cfe
SHA5120b8cb746f01f1f56e750ce80531ed77413b60e0238d877c5e2c0534e7c2f6d1d84720ff9f296bad10178b05a0465eb11a66e779aae2321fb8717372c64bb4676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afcfba108e5b8c0e4634b05ea94b6d26
SHA1682961501da0334a6197f17b6171f065c1f51218
SHA256f1731e71df003d60e09ee113d3f4d9c46920c4d4f7bee56b46059a187f5fd00a
SHA512f10f8d5a8a928badefb0b96e9596b431d1aad9217efb709494b474f32c7c7bfd2177aaeca27d47292b880b1145534a146fe0a80afe42147cf9ca3160f99fb30c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea8895acc3b3bf3b5f0fe257b0cfe043
SHA1d6dcadeaa794d8d3e3e12359fc90a539a439fea0
SHA2562e7ee4edc5f058b334b1d7c9fe1e5f5d5bb67ce9d37a0f10ceb9a5ba69ec0c7c
SHA51297e0885bcad88356445348211bf0ebdfdeb2ea8d6115c29bb106be66160123a243e36753b981c0aa4a682e4954b7372d4fac0dd5c1b4bc35dec15bff861d15d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e235f3ca42cac9b151368237b9b58cf5
SHA19a871712cabba9e866eef16d4782a4f4ae551849
SHA25699b5b5a5bbd77a5b7edf0ddee3ef6fe598cb0bb6f1d0303b618bbc993d5533ab
SHA5128c7b40b0e478bfe63091379f2f4c1fb870422c0edacac4e3c791c5cd075f658ac1949ff389d2556879e9c5a4088b8edddc52e6f64aa0985852ed6370b7b99512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57602157588d296850a23e491db051be4
SHA178d2a469cc730c48c69cd14b0e847baa534c3ed0
SHA256cc7834808770969301898373dad579a8bbd2e03439ab1a545f5042d3b284d7c9
SHA512f88980f14551ef1a2047dad49a59765311eee842c0504a9c32a119e682dd5aff082085f49d01c43b76517711e9c98a1e373928e428cc203eba87525c382241f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a