Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
test.js.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
test.js.html
Resource
win10v2004-20240508-en
General
-
Target
test.js.html
-
Size
6KB
-
MD5
e27a0cf6a29f7386ff55c70ea99283c2
-
SHA1
3784ad579d47fa3711df0e9cf19fbcf1a8ea8ea9
-
SHA256
0eef598580487de200c02764755e7f0d1ec7a01ba8800457f083bce0b6e2ad53
-
SHA512
73809aa5d41dc896536347fbeaa23c9bc72751b132e9c15eaad0d0e543341b71e996f18891ce09d3ec069cc7f76ea6c0ed9dc7a363b4eedc18736f74247c76ab
-
SSDEEP
192:8gwAntlO3AXIEgssrx3KaDjNVSGbBIxBtbOnfrE7T4UWQ:8stlO3AXIEgssrNKiAGbuxnwDTQ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900690350ba3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421528985" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000eac846384a9ec7de6fc08ec8effd9b8f41ace9552298a4a7402524a3d05e0e05000000000e8000000002000020000000923f7555894e09abe051b3d6ded989266e389231ef39888d97608976368b2fc890000000c006dac071f4f81e6be5ce9b37e8533a06a68aa843509ac9e6dc35cb9337ee01113ee4444018f7cb6bb5f239d986f287e64f09a5cc45b731d15dad46e43824de925a124cf658168231128fca745b78e629cc7c30b06a5519d67ef16bed25b21c48de221a38129f95e1ceef4d442a5392dd035a87b4d6183ed1a7f8988e33e276ca4f5dbf5d04bbec9693ba7f3e42fbb040000000c32bfe8266910b9f52ed44289266067c7ceb3d63759f16f19395164b50311a9c71eb7ad5acce764fa68cac5e6cb08f2b872da0974456e34d1b52dc3df6972db2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000c0a51d15834ea23507a3147ec263a2d2c25faa2ae9a6a7a34c225cd4ce6f9614000000000e8000000002000020000000d874f23614ab02375c706202cb6786c69cc02efc5a2dfbfb4b78d0c648dc160420000000aab8da3c261420f72e631a7b8d361a7caabbab9f0fc8d7a8590dca13d4e4ca5f4000000024f7fb2da5d21cfb38a89ce713410882edee2fbf6d937559c1e33f9f4f5d113499fc1991098621a6a4cb2d949c98ab64c193d8d1608b543a5a1a1a096400efaf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60FD4DB1-0EFE-11EF-85C1-E69D59618A5A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2384 2888 iexplore.exe 28 PID 2888 wrote to memory of 2384 2888 iexplore.exe 28 PID 2888 wrote to memory of 2384 2888 iexplore.exe 28 PID 2888 wrote to memory of 2384 2888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\test.js.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b74aa5dd87d7368d14d81b4613291fbf
SHA1df1a99e950221ccb5402bf94934d96674ba352f3
SHA256d0d4c69ce7858c6c6a9b325268d3b72c68c419312d8b3345a518efb9ee02359a
SHA5123b4df175eef210e7a4a7f0860e335bb4ddb58b6d777d2545ae706e68b18fea518c74b8a8e636301241ad17ab20b7cfd5f3dc3593fb2af241b5ca482105bcab31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56495ad043cb1792f965ee4cef71b1e3b
SHA1688a59538cdeef28d1fdda364ba5753d1aea3651
SHA256a1dc6eaa04c706145dc9562f5b0c6a24934ff2d000932a37c1474d462121d616
SHA51268cec07ab5761e4d42df1c2b4c0ac4b9b1d5d201a62ce5ece11b814e2b0c0fdc8fed827f55031752ec8ec95ab85eed60e4f3f75f678c2d8809723d5714573afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba6cd368946e8dd2c4e289b871cd2bf6
SHA1923ba6898fc84983fb9f28363ef8a95c06d3f78a
SHA2566b5b45bf735bd5c46aa46b7cc7a983aa9e3bf943b6597d40e31146089b69d7fd
SHA5125f162d9709101beb1bdf7cd7c9f6dd57d030ebe0d43d556869040b14ec16931c276706fb36755f6831c63f1abe058ef67498f4762749548fde784dae60a68d6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5625679428a65a2e4f3eeb55372150d43
SHA13777e0aa337d1a5ea407de32c06aed9adc9ad85c
SHA25637208185f6c6d7099b7476c290643d07060a96325efce7442947837f2249204f
SHA512eae5990f70aae8597df52b723110d9d337c0d80ae0715b19d74cdce7fb3a457d99fe2b2ef3be360c9ce81d5a0dec54b70fa50fbf037417f2377a7eed88e9dcd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b7e8961ad34e9bc8756f4fd3f1d2452
SHA1a57eded238026745c07be87ab8cbbe48e5ff6fcc
SHA256958e141c74e03a7cb0f7f5e9efe24da9c67218dd492ba4b99773941a963e7271
SHA512d5482606bf7e133137e892486bc513f0473c158c0a2a90cf4490f633f6350448b062a7bb7b6a9a79bcda3bcc6e1120a13af04040537eee03f3ac11783cdae9a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c68f96c13a657ce77975cbddcab8bcdf
SHA1cc61065a4a0e248de6e32ca3a2b33d19d589b019
SHA2569f9723c897e54716bff680e36b9cc37f01470c85667ed4a97d709220c06829b1
SHA512addbdd86f5e14b0a18bcdba410b3bbf67d8445e6305488ab4960a178d9ff3b535a5af1cc095bedec58bce240aa2993163c3ec3145c67c3434e92757234b53216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5057546c73c93ed24d70197e6ee42cc2a
SHA142dec3974f812df21f13a67dda35e39bc279cb58
SHA256bf2547665c75be88ea4d10ec391cc3cba2a5cfbc8be158db1a64d1aae756b052
SHA5120b6c83b1002bfd62eb345dcd7cec9d3eb920c6f02f5aba1ec335106145e38d2cc974d8c1da29ffacf66dc099e7fcc72462b3e49ea4f7e856dabee5b2f4b6f351
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5214941ee64a884e03c33bc633c33fb5d
SHA11ee84b2ab217d0c4c8862c25ac4fbbcd0c3b6b2c
SHA256d5705cd47ffacce4bea650824be321414add61aea4cff3080602c915717d4224
SHA512274807125008a2b7e117522347a40e3ffc26ff6e929d568152aa4e0284e7cc80c5ab31aa80b213ad06b0fdde008070e62c546056a865df07a0cd73f36b67f0a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e10f39869d83b8dcc999022cf5a94e1e
SHA1847c6c68a4c641139c7fe27d58878e4024b1d2a9
SHA2565d552f7a6d9bd7c4befb49584842007da348e84cd8c225b92afdb81b93560261
SHA5129b693a0f761a493f9b3ea2216bd5dc767bf7970b8003064da7e361de2bd2deae92480e0438c2f4c60af5f3bb4657bc9c051db0047897955cdd706d093cda5b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cfa7afe0afa32fadf86c2726bfd17a0
SHA12631be2a3691a23ca0aa6e3080d2e4d116935287
SHA256b5152afe9b4f001d1b3202bb464b4e7a5dfdca6fc8a6262f94d633a1d917930b
SHA512d3f13abb434c47dc6b4e89ee3ff9cf6968c6f9bb8a52179f1572f84917e38af6cdeff4767413e4623e9013ecf4c0bfa2351749494c4143aeeb24e3bf24505c05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ccce00b7eb6a3a4c37f5a2dd60c797c
SHA1f200b14b001ba22aad0cca70cf1eb21937027a18
SHA2564b9221b9d36c036ae69e4512a91a464dd16cd2e444df668e7471a0072b2feff7
SHA51241272d3f5edb0075980d58f9a9706ac97a049da7d0535cd9e2522979d3ea0fab65d9d99fcd6134b1c93f372d58681bc639622f66a8889ef53bf47025e609fd80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0bb691b547a04fb322ee942e33d81be
SHA155b3fdb7231caeedb6bd0ec02ac9db41f3bda394
SHA256a8bf6055d4a9431d15a3dbc15d4cd57aaf4db036a63f45dee1383f184ed9908e
SHA512e89c44e220f29d1c5f74b3de8be82e32b24017cac9737056d7a3ae0a0f5339257f5490966285b7e42a5b255f80e523923ed4f560486c04620a1c60e0c600fcd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5cc4f1c8c90f5afd956c381b59848b7
SHA19847aaec3944a24d22bf780810aa73a3d15b9d3f
SHA256da902e3ddf4e9a5fe2ceab3f449b48e6783de7942cd016297e3cdad07dad9e02
SHA5127d110cabd2cb06d9583efb17d3de4752e341ef46e3f020756cf310fd7a32a73b48251ec6c682e19dc2ed7b3c30436bf2d95490298f70837fe9ec496f558e2ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aa823568741b0df4a038000ab168191
SHA1dab54525760db002a732b1f59d29c77a93e3abf5
SHA256d96a06bfef3ce11439dd149f20b65f1e3f5a30efaf5ed3ce1b9d70f18e0fb504
SHA5120782a65813ab0ffb7d2cb5b5242b63da5bcc1496a7086a167842c47e044ac4d963fac7fd5af9d80d6fc712939519844784daaee4ea12eab34d278dc471932629
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520b3fb54028f92779e847911cdd2c16e
SHA10cb9715f8b4412f0f5def3bccb140e6057bff582
SHA256b69955f73ff4f4e2eb07cd2241f3826edc3a75db1d18c8820ea07f15f8861dfd
SHA512d5ad7fa55e4b03eb73e4a4d8a7c3300bf87cb34e5ed8639c09988957c1f27638436f4880cf696aaccc5f5bdea3243f9f0d4d781c553041c564d2d7f7f3aedaf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554c3660b806d11f6663bf3313bfd35d7
SHA18aa260718bcc3dfe62ddd959fab2971f57dfd3d1
SHA2564b67ceb362f23a4044bed894d66388a693821e3495a4d3bc28db042d0f4177d1
SHA5125adfbb297069bc997682fe2be388a1dfca4996964c9938650c24ad72e118c591863f34bc9dfda78313f49345403afc48fe9b801081a1cebdd6e99dd0e5728cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a40a3acd30d61d12711e34b21725be0
SHA1283f2b34fdaafe53e28a20b44e0c7ca0f6052a6f
SHA2560b50fb562dcf93490844be55afbf0679631bb0c1bc6674953019d8ab1e312211
SHA512f8463544f812eec07f857ddeff6872fda222e03b2ec48c00aecaac054fdf2d8bfd48ae5685e2f303983a362ee89b38de4aa085baeed1f9b67d3ac75d1c47fa25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c77443c0e828d9620f886d0136da0c8
SHA100b4ca998cb11b1a12373934bf18a15bc780e257
SHA256da31d2104a0394d0ae59cff001ac01eafca148fe2d382bdb08e0b64983d98af4
SHA512f70374f07019d31aa8a63cf15fe31cba79db6ff747bd550e3403126474372f6f9e43a777d9df6af695cc739285ca1aecab63ba53d93b1f4994fa4d31b2ba0a34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504a68c3843e578f48eef7c1930f542b5
SHA197c872df2697293fdbb87cf45eed75226c871c02
SHA25662896341b0edcf381460693433b2262dd0ed038d39395d656e0c68217008e547
SHA51267bd2f9e72bbc48d523e16c692cc1b891b00e3d8810414cb384904f874a92047d223bbc796b4dcce4cd53a5811e9f67d7e63232dea260aa617c2abb5f7c6351f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a