Analysis
-
max time kernel
143s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 04:25
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
ae840ae005555141a899c19d96aabb5a
-
SHA1
e58f31b9b8ffa78576a8d1a767105b0000c705be
-
SHA256
15eca9fd0dc9f4e2003f2d2ed41a8c1646edf6de9f7e3e50bdef24caba4dbac7
-
SHA512
c5fc424aba32da6fec97533992de9339f8857d6d05287c82fddf062d196e3c852e062c970616fcb90b44501e3a6a1b0cb5c232c92c60abb87c97b725cdbf5023
-
SSDEEP
3072:SMVfbkf7WfyfkMY+BES09JXAnyrZalI+YQ:SMVf4fiqsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ed2c7392a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000487291f83c86392cd4ceda6317b8bbe33539bf58358e3f2bdf4d2c3da925d1f0000000000e80000000020000200000000eb5dd967b3812c7aa3fe2b0f49ba75d443d92e54c0729d960d913d46f5715302000000003bdfcb580a2081cdf94b462b58df92dafc68d23764ebb2680958c56955d6aa1400000001bcae3db5e1c3960b106cdfeea24e45402d83eea3bf87bacf8c850cf49e6cab547910d342e2147047cb8bfc0697e01204d7ca8ad02d95593d23e7449385035f5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000787ebaa2670ec276775ac7664a2a69f704212358ffbb3dc4a2ae3eb6e588b216000000000e8000000002000020000000dd66aef0ef09d30186a933cede682b70c4c88286f830518bb9c22fd4e4261d019000000061e738d2618ed008ea0efe8b34d7f1ca95d980a40d2880c796ada5fd6d50340f2411d549d86181f88703f0ec1492adb740d7cd6248de2fa8b1486f0994462ac7341b58e1ed0ab7f660d7cb2f2200d0974ca53ae3e0b02250e494c87529b85fd90fa7aa2e74a89600af2e13f3f465ca7e9b0d0766baeed22d080347e3a3da8947910e6ad1b0eb772d2e9c42e7798aba7b400000006c309796b7aeba62e67083ce2398cd52ed7cf0d46f3bd10009523ad2f5e26f2fd3519b3f48d11d66645ec0feaa68c78d240ce7f7f6810b87b0e6c0d23399da39 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BBA83A1-0E85-11EF-BA3C-D684AC6A5058} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421477008" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1276 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1276 iexplore.exe 1276 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1276 wrote to memory of 2700 1276 iexplore.exe 28 PID 1276 wrote to memory of 2700 1276 iexplore.exe 28 PID 1276 wrote to memory of 2700 1276 iexplore.exe 28 PID 1276 wrote to memory of 2700 1276 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d97556a60c8f529ea338596250ad008
SHA17da73975c19fc814148172646b0cab5096449f6d
SHA2567fc25245e40eb7326fcfed7fb58b8e159c4fe66a6d670952205a1572d8c59579
SHA512f5ba085b1ba329ed424a9e1a420b5faec4ec7bb41ab36a91d7c525502d326efe44d984b5744094b123aee29ec5e9108d30ac2c4d21750e2c2a55edbdd2d22bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fc763247654d09b5cdddba3acaefe80
SHA1cc70ba33095f1a93984dedc04644bdc4c9baf811
SHA25624743b30015044c2fadcb8cfb593340e4d574aedf9b698f2daab3e7649047817
SHA5126fdccd2c382fcd414db878422f01d952bd76bc63d23fb245d0de72b7be560f4e4b8703e0b34ef2731941c4c543dce05d8d8a713476b71e7adf2f3b546fe7cd28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea109581f1fcfa4bb80517a85a183b2
SHA14cadd2de9ab31d59c2af646e49d40e70c70d54b1
SHA25698ec2cb0d26106b57d9fbc6f29610fa4576dbd09b07ebb4829417f2b9a1fb3c8
SHA512adc10c3fac833a81c3053879cb2f804cebc2e2d257b16c7d74a7051a1d7b6048ad1c49f1131a1eb5793c55e7d5e3c93958cd04eacbeda7888e0e41fa383cc0c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586cf1b64723b8668f846b9ec455375e5
SHA16aeb35315656a4eb8603ca1094c46da3127e5050
SHA256109a2127fe9f1d2abaa7744eb9eeb020d9d770e629fb710fe8e1d123a50ddf5c
SHA512ad4fd87f8b9728d8e7bab36de4018b618e418691f25d7f2551927d88822088cdf7c55dc7e0e49bb06c53d348b04fbe0f8dd9905aa6e5c97e93fc555499cf38f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530b417684ab5d1edc28dd1d73f655b9e
SHA1adbe961253a122580355b1c12de5a51ffa14981b
SHA256f3ea909e9323ce80717123ac3aeea4847157817a437e64e9c901d39ab33e0b34
SHA512e6621dbc6e33098c404b3641a915605c74d446f7598f50f0150c4a291439a161e46d266be98d2a9be3fd37f4a590c75dd6b43186a86eca987715c792f737a74e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cdb4ddeefc9b289ee2f0e4a81ead767
SHA193337e47b958582ebdeede61658fe4bbaf010c97
SHA256dc6d1fb15e55516fc90267aab7500e7e7fc9bdfa6b24aece7717bb663ba910ee
SHA512291aa685f61fc5b9c71fdf79dadb8f7c9d6973345c8f3126bea1907917d32c0605c9e0b484a2e0574e449ae3dbf67dc1d8a3fc1b93bf18a9c6730ee85ba4ffcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e088147ef8cf1aee026669ff6768045e
SHA19a785168118bb92de9919f00e8c68a60a1eac13e
SHA256e3a4cefb2f22a936c34f2d2a7d313c3bb9229ca3ad6bbf852757c7039bf57441
SHA512585ea170f4c8d1207762ad21c4e48697b6bf478a0e46d6295f529902c8236e4b78fb9a5aa2542345958272aba5e4825c15c980116de5f27bbebee9c1c590e7df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583f3d1bcc7c0547e758ed14a7b6384a9
SHA183183de3773434fbf00b9529e1b14ddeca7e18e7
SHA2561a4ddb855651572adabd5e12292bb4989e7c5d6638e9107d7f1b077a74901dfd
SHA512d425eeb0607f88a358fd0a840adb9468971771c3c0e82256550fec89f22c1bfd0486dcc2227c11db53acb86111d831f4777845251d61b0f7c934b13f2dbb02c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544810eac81d9a759c127dca200863f41
SHA1ca8fddf739905b2747550233d558e3390e412a80
SHA2563c49ade0dd2f2ed327e27b3a18a1828ad277b3bc739a7b4f02a76d327c146701
SHA512ef1e71f118b871f9638cbfd13222c7dbc10400d596ccad408f44afcec140884aa69e44c3aeb9b4ad57ba22a25d4fcee04a6676c17f7108bf20ed03de1a4122bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5109276b76dc1e8f578181485d4e3d6e0
SHA1c469617b9af643e967041c3f2e3633054102cc08
SHA256f2277c71c2bf94e02858c3145b8bfd773a96c4dfa37530205bca64ca9a740d51
SHA51225d953d34cfabab567d72296d0e329c83bea13a2e38f79fed0d2c07cb535cbe4f60f35623068bfdbb131ed254f69cbc2b0e3014c5684757a61a5bcb0b5041df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c3f20a9d5be0169ac5ecd4863bc7bee
SHA121a6a89f0e5f57020fff39310fe04cbf0523ec3c
SHA256e36d16104bce1064909ec26ecd5eb93b7611ed9233be7ffdb3e61218653ed767
SHA5122919238df079b1389a7fc596753d83f5790c93e78cef19ec86032377a437f8a1c2e0f5a480f84f40c74c4ce33dd6ed495ce08cc3688fb31f8df0511f965c0937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560fc44fbddbad490ae2f449b4e52ba09
SHA12a37e4d5a1915800ed49831f8591f49cf8949e42
SHA256984feb71d6714e9fc325aea41894cb453f315ee76ac31b133e1d715382a9e149
SHA512c86fa93978a67c14a5e0af80ad75fb7c13f49a636d5fb8d20cc3177f77d7fedcc75b1fbab0066c920933ba4998a2b6439d225ee30ec8e1973cd08c8b65da6008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500a36e2629a3068d606477bdd2432f1c
SHA124fde2afca19e4190749c44f73543bdd5353a302
SHA2563a2ce95b6f041f49d4ecc9335b3c26283ddd0c56d2e23c479e83d49da0660fe5
SHA512a5eaf95cb7e23b31ffa0be023480cb75f7c80dfcdcf83e1ee1d0ebb27bdb99a9870b24bf67551d344caf1c478680001942c94f7c3792f54abdc0d2cf630f7397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f287e5be5e9e25c87e2fee00b651f7b7
SHA173924337ad23e413986a02e8630cd78dc9d8fb2d
SHA25675a05bdb02f13af228c0918b41690239b1839ce2465044c56f66aa3c755f8713
SHA512c3bab94dcb5fb663e33a7f6ff8372f53057de4f9890e9c3e1027d50a858be3b0e9773dfa053940f70007256bffbb2ff38be2c9e56e88d3377c32beef5022b9d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569967f027beb0c3277a0b706fbfaa77e
SHA1abb743bd5c08aced14938dcd041e2b513bec5f3a
SHA256f44beb7bc60d0a5014e33facebb63bbe58ebb56d12667324017580e5a46bdd49
SHA51266e7e23b874fdd33d5c8a1880c043d0636de9f794f27b69e45e71621796fe135182adec653420f1000143c0f5dac6103daae0f4d49aeba9e266a2d938bd3f1e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d65224d8b3d950c9d7231659582a96a
SHA1c74cc3cfaf9e0691595c148aa4ea2ec95d5aa52f
SHA25696fb9891c442a677d411e93fe2df58a84929d43880e7dec8b1266cc843ca2de4
SHA5127d60ee46d11dd5a2b316d4ee1fe44492cf53732de3b20ec928e857b1c6ff06dc5b7f5cab5c338860fd7b0404d2e1e428df4c202d6f409436fa4fa6faf209916a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e139d24061f3c0a6ee2d138803019ab
SHA1b9918d5c96f801ef802c6b8f309ce0b3c65135f8
SHA256d3f8ede46ddedea27904b19156e824774566697722457fa8b3c7b45f855c56e0
SHA5123ec0af49eab04f1fd5017ea945191048a0a6fefb5c9a0e4d67a0daefdc04907684036d8fe0d8600d7805eacb36a94b70fb44afffc0a2a944d7b8ce340758217b
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a