Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-05-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240419-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
12fe49aef5ab6254556ea2c37c34659d
-
SHA1
8d778ed24853c2c8f987582cf17cab38fa966778
-
SHA256
d7c9ab419e72093c2883894902731e8d62f789c7e8850251418262dd724d082a
-
SHA512
d04ac9d0a7b48cf61a76ffbfe5cfc520708e675805d7efce557f85a4e6fcdab647900549674eb82988a356c4ef731800b481131199e730dfb2a609e59695055a
-
SSDEEP
3072:Sln+avv/ZUSO9yfkMY+BES09JXAnyrZalI+YQ:SlZTJsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421085313" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FD8CDE1-0AF5-11EF-A4EE-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1796 iexplore.exe 1796 iexplore.exe 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE 1444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1796 wrote to memory of 1444 1796 iexplore.exe 28 PID 1796 wrote to memory of 1444 1796 iexplore.exe 28 PID 1796 wrote to memory of 1444 1796 iexplore.exe 28 PID 1796 wrote to memory of 1444 1796 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e77aa8c8434e8f25c67e6eb68cacb0dd
SHA1f84cc1163dd9c2f35533ea4499d75ef21c3b5dff
SHA256c3271d83af44c0df4440e43d9a34c2193b811cc69c5625b26dc845fd496960df
SHA5123cdb127a4c6b92a51cb1c39ff1cfd796b8b8258922860fd74fdecb5bd49b2cf04668cd680b4efe3238c41f86afe45a3b221e14dba9492c5b5dde3dda68cb82a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7c4549aa09032336c81617dd5817106
SHA13c00bb1bef5bfd5b7b92d1ae03d7d467a2de6268
SHA2568bd5a4184d3c9e5007d32e78f53c3f3f43b5d93558d9bacd61296f9ee1d02601
SHA5128bca707ac24e6774c1a21204baa09750d3ac23f6b30bfd37d578dd3181c46cd3c87297b6ae99e532a0237e796ffb1b593205539e5dabed878ac14dd3e4a52240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab0fd8f0b3ea710791c8c58cc05139d9
SHA12a991a6af2187e653466fc6581bf995720339fb4
SHA256fce1c315aac36a9f0e5079fe9e4be35e1290650d2a139ac37f7b315c165d9bb1
SHA512216cb46c9559ace6d1129baf2b240cadcd35bebf06705c2d4524a64f1019f76f9a2e27c059d884c2356d93f496a8eb84059fdc048bb672c48615a6654652257f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe110cab26616e72e57fe1032c01df1b
SHA1b463e19985a4418cc92070726a2533936cf57ce8
SHA256df7f43bbdbf2c50b31e1002a2ce367276eccae88bf73b1a825dc3b6bdb5ababb
SHA5121115dc21f74ef9b12561466673c677302eac646910a6343aa85222f983094c2445949df0b8684d8ee20603fcc365a8efa7827a30f2a109fd22885c313f5f5746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f463eb23b9e9a102b027e074bd899d0
SHA10a1a09b0ee3abff6c6add29c6d8ea6d8fd8ddeb3
SHA256cb3d9ef947cc4a349d865d6f2b19e3d799f80d9e22905a37fbfc572bda2cdaab
SHA51253bd04cb7991b91f578c8f88f7a3cef12848311368cc38dac1c7090877a25dced503f77abd581ba2a0056827588713b58803f6a5ed2d5b847c05a983ab9eb26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517b0c8bb05d0d3c5cf4790a3931c8ad2
SHA14ec1812fc2fa77b3a52dbaba715e3b067ed7395f
SHA256496095b1d163c4a6395b62bfaa953c4aadaa8509554da62107c05c83515e383f
SHA5121fbaea950769c4f99ae530a41f0fdc9ac1668d6145f6d14e9129be8c88d59c2d2ab9f892afd11407d6fae71b87b2986c8a5bc6838cf949b23a4496243cae7dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5459a1010ad2c33cbeeb62986f5d7e331
SHA14d741ef15e8c96b0baf1b84699b66be24e5b5fdd
SHA256cf9b06c4e85e9b5a04eee060fde84d4fc84c047df278861d9d3e56e8ff4abf46
SHA51281f5b11c393b1cc2340d0caac0b07dfee129880e7239ab70fe02d6a132b12e799d359191ddd02d4fbd3bf3bb240f73ac569a0fa197815c3440e02cf9ab15b152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fb00c40e6f30f77c6a75da9732c343c
SHA1b0db0aee46ff7369db71c4e9c69cea0b5a06030a
SHA256c278416c941c1e413a03b7f830861f12278a0a3ae70f942df38a9250925f24fa
SHA512aee4827cf83435ad948ba12e76943e4fb4cfbd9260736f6d20e00434e72c8c41cfa3e5d28433dddf6c29da64cb689defb40259dc70e3f7cd0e2dd3932ecef821
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c126f4067350efeffd89a0c3377b2ef6
SHA1b6956c5d586687573771825f6590f60098c86614
SHA25666c43ff43491724fd4af3af234a1203b85b7b28b7415f4fdf8d85eb5ca596b05
SHA512d8173ae4db6c9640850bface491e7737c1ac9c4c198bddabc23465f47ce599f485bad65b47f5b1de17a65cf51adc2b6a5b849271d26f44ce6c54a665b5295654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59886482a0a161e8104832dc44d94cbf2
SHA1ab026c9e69248add1f4e471b6ff615fae96c6e01
SHA2564f37793683508558b5e4942c7225845bfd576d13c8dc61f20e325fc070c61892
SHA512b6ddef66afda5d5ff205f2841a909835c4a0898af0c8bfc7dac303fec0abc87d46c3a1cd0d43f648fd42258465957ade4bc668ea5010e1ea51370c8e3baf9d4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ac89277d58fb1601e38649dae4e75b3
SHA15b1ecbd821406033f25f317ed7f188a0cb8bb783
SHA256f1956182f434753917a8b5a32b15539116afd9bf6f2bc7061428bbd67cf262e7
SHA51272d7ad262b904ba537c761cea35a3dc5aff39a7a66c22a084836efadfbc17dcf800fe4009245595ba44485287eb5fce93ae905537e05b80d272684fb49810d78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57eb7ece625ba2787c237e8b241db560e
SHA10efbbfc2c10a667957a9052131966229c13e7cbf
SHA25669c356a53ba128dcca5b5abf1598f56a68dcd554d57c4ef3a0499a162e46f870
SHA5128e531f1131261729adc9b41fe294deb8b8c19afaeabf93bc248f49ba490183db215acf786361a2304eac4c43caf427e8d57a03e3997b2b517f0afba6418a846a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57515b00e29e0adfac9ecb0b1f3c83e69
SHA107a9c54832f52e4a7df9bd3faeecae0f67c86c20
SHA256c5df13f63dcecf379c2ec7bc817942426550511263e7d4aeb7c227d8eae5b31b
SHA512f86cd4cd90a1cea7079df2d682c50e03a15a3650f71b8d037252b096554aaff54faba7fc22acc3569f8cd3b4fd7a9d8aac5cb0bec3a1898aaf16fd6b722d1c38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5510b3789073882f641ddf7df0796a78b
SHA1d60aa2c80a61ae1d0229233bdb5952274b536253
SHA256f9b32646998cdd67c9329dcfe38450afb6114fff8ea652c741cbd8777c890c49
SHA51203028054c8f31ff962e94dadc4c9fb10409c051c9697819348b061886abe3352cac52bec4e607584bc554917b00507e8c051a6646f328d0c6b301e192c2d3f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4b31fbec5c816fb1ee4ccd4412cb9ce
SHA1d00414f15364fcbbb864797ee785e00d0119b673
SHA256caa2fde7f55840d56650c05f2bce2d5c48186fb33e1bf571221dd0ddecf6648c
SHA512b31eba7fcff7380a5117331f0985da84f4d73921469e0209af948ebb2a165aad5146285347f59fa3d244d06dc20f304397c50086815a4a4420aee3e29deccf4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7946676a233fadaaf8b4f62fe5443fa
SHA12d33b900945613572374f7d417d5b5dc590a1fc7
SHA25682ca3696a3e5e7ebaf03094f7204199cdd91ec4c18a388196c74be85251d5372
SHA512d1d176af5d27fb98b4e85693130eff37df0cf9d14085e2360780c5ab38b1d391adc7449b0781f8732a96d8ec4e7c4add73d3df00596b295c42c519676f34e639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5659975189631b0cf7144c19a36b33a02
SHA17db4891dc758525832d1059a8f3605b484440fcb
SHA2569c1a662db176fb338e38304572d251d2ccabb2d3b87f494f7f805187349da2e2
SHA512a7740d8a79d3e8bd63ea65b5898f4b179b55ee335b09a0158568461fb17703b6291af603585c72a16175ff5955b72cd3ac95835b0268445b34fc21ba0efb7bf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c3fdb09862f09411fd93cbcbf29617c
SHA1abc743b5c2006e276ae48438a46a870d04a7635a
SHA256c1c098e751395e7de8a51338cf9e08c699dadb74ad482cb857e1738fbc95cad0
SHA512fd1dc8bf44fed3a8955044adb51adbaa850ebb657399f6d4a5fe3711d63f49457a9c6efc14a0f5d740cca2e75d5a10e1eabb36cc0cdbc2d2c1a8ce9117a28048
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae297d05088b3132c85a489a8c7bc72c
SHA1efbc99878104c28d630379cdfee541ad944e2334
SHA2568e87dc8499b4bdc446aec282c65f2c9d56e276a7020c92d65cc770ef0201fe55
SHA512fd2394e0c999ee89b3b272906f33d4bb83ae1c69407df55f42f400a98101dca1dc4dad0047f8ae06529578dd19aecc4abd4720f0cea48fc372deecef1162b82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537429c4e153a65357ae343dcbf0190dc
SHA13cc2ac6a7783fabfb21e0e2c75f1510e57cfea24
SHA256b4952cffbe7de8f0e9dfc4de8c9bfc16f8a74c005e0a758fc4ec9b825f774ed9
SHA51239f4d4b444b6ae0d40da0de7b386ca444d1131bd03d34cb324849e5c808b2367f01bf7d7062bc89176a0849e4be5cb639cd91c73636f006bf7263a87738bd31f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a404051da929def3fa8b76bad37d39a0
SHA1a2ba0b29b51be0a7a73beff73caf507d91a7e094
SHA256d71a0349fa8bbb1a8007803b545a768c85e24740a05dc336e7b4248b7b543b4a
SHA512e1315c248c9c6f75c4cdfab9022b240222ba21f3a6ebc05d47936f30b3a41c787af19c270c9bd6e823a2cebb191c3eee4c6cc19f63569348abd1b659fe473efd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b75ed9aca2e65737d474cf7a87d0f27
SHA1f121bc455c4893f6cb06278e6983c6389bc76054
SHA256c681117cab7d3f8854190f42d3f8ed4f18116345405e53f6d636a33ff6fccfe6
SHA512c9e6c5f0e65003911348b60ba514eab3fcd7d1735957ed41f966c7f0c8981fdc6088b14537f51a188ccb9907542fe567e12de16be117806b590df50c1688effa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a