Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 16:01
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
11a392d5f8e20e47dec82d8f9b1f475f
-
SHA1
d06f3163a319d0663ee58730bdb738ee0599a483
-
SHA256
e70bd17fa4e9ab83b940102edf065787c1af8abc2b492d0a7d189464e31f7fcc
-
SHA512
b91ffcc5ad6fd4020be89d796068f09aad1d208fcdb52f98623d2dc5c600e4a23e9ac0959d84b6d63295a213be2da03cb210503179e6fca0df3ec2a7282c1400
-
SSDEEP
3072:SgfqSwdNR/1DVEyfkMY+BES09JXAnyrZalI+YQ:SgidDJsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421950747" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E1E4701-12D4-11EF-9340-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2300 2928 iexplore.exe 28 PID 2928 wrote to memory of 2300 2928 iexplore.exe 28 PID 2928 wrote to memory of 2300 2928 iexplore.exe 28 PID 2928 wrote to memory of 2300 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac3f0d4a94d4be0658e3456c9684212f
SHA1fe981492d6714d3a6a4a1fab37b5ce2acf7b3aad
SHA2564af5cd842b8e0074381d2b50f2f8582890841968c6fed81cd4910b0a5848d87a
SHA512f08ee54f9fff218b05625141285a47e8c834973910411dad5827f0e72afeea197a1d2b7aa4d7b8f00d7a56f85bb30fa4f75598e4e19c2bf18a4bac85cdb20c00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb71813ddbe87e1e4feeccc9c80c0ace
SHA12c988647addae2523cb32f31a2e2a4ce465fbf28
SHA2565c79b1a37f1fbb9d9898a67c9fd2f332f80aa938f0c9d0420923ef65ffca23aa
SHA512c61df5d933152a2c71b25ca7e9816e618a9c1a5ead9055dd7965d5d326a092e470d0d78792810cd7b55711c987c8a39eeee1e76c9175c942227cc53d2896f357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ead6e60e34daa9969da9990643aa8251
SHA10e4ad9e61411cc7c4b11e02278f077d2f7bfb072
SHA2563137bc858aef952afa09bd0da667feeab1174181165ce5c65394cc197ab9540d
SHA51263364e1298a0fdf737707e1282169e965f22d92895f4c3712a3bb81391497f83db78491cb138e12614b650ffc07b2aa517630281d595d304d204210a044d5e84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b139609720eba8f217d0ef877e300cc
SHA1dcc688c28fc1637401c39260c3a80d4bb4784cd2
SHA2569487593c6d4188f9cd22396531dd4e7cf2f813f39b4e7c2ebb4c47195bf10cd4
SHA512c4806b886d9536d5be4acd83d84369514f992c6a32428e0023b3e07980e9dbb621f40a7b4f8c67cb8b3dd0b8f59b761c338becedaff2cf025b924b6fba83796f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5768d5e75a298abfe7ff57ae9cee765d4
SHA182ca78045cf4cbc22dd3f47088caaf526fd0aca0
SHA2562fc0e0cfc74f1b2c28913e3ea321f646c18b56e5d527ed22225a819141512e9f
SHA5121d1705e18644c10bea6e96d5c22b679e57c32b155bca2ce314157bbf871a14b6e10945590bc560b51e3d83e5e41fc13049591503fc98642ec13fd9b5107587e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7dee624e130915f335fde6f616b7f32
SHA16bf41b50846f6855232dc43e42144d16d3afdcc1
SHA25620deb42a7fd8bd9eb6d5157bfbcf49c5fbc2eaabc044b8ecb61d7d695b39970e
SHA512e0fa881f8ca02b030c2ec66479d1e4bbdfdba4352af8f28e31466ed89de77c63d9a09496fa659fc56303f718174af604a27c4e7620ef899c0d749331d12e7445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba1ec4e8d14100d1bb2e2668e1732b8c
SHA184d8406161816e7c7146930b93af061b62b09e9d
SHA2560a1759f76797f06c04c43e4308dd3d9dc51291dc0098a5a4d5fa578848b9831e
SHA5126e68654aa6fc7f01960561098d5447234e37c782149b498832ba7f437dd95a5a578ac179ba6ef71b64e99c8cb558c1155c1467d2f94a72bb629fd28b23f388e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53791270b1afd5893a95fa1491ea56bdf
SHA1990ee066bc962a91b4af1f8046c9029eba585eab
SHA256fccd97c4738e2e7f6ed33819bda19c78a80501561b3ed7ebe4d9bb5376f000c6
SHA512fd7ccb0c79c8485e8e02031ca3ba77b9ef26843a34f371c43d278067efbdf8e0cc4be930cecbe64569577f05731c925e0bafce4aabd5b71597b744aa89e25b4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec78d83862c0f2d06c87651d9ebefc27
SHA1aea70142cb39f3c69dca7a31720599c493cc4f99
SHA2565b0ab74fcce233ab68a535233857c8046481f00aea284017ae9fbeb5b6ef9899
SHA51271fcf65228b6389d06cbf6b3ca80887d0fb8a95c1dde41b219b7052e50d2aa89d749225f4df3afa4cf1388b90073691b9f5f8a85145ac15b8f8f3da278ae7860
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575179687786d3a0a929a3911264061e7
SHA1acb3f9591f87941d88f54b446472d6d918a17925
SHA25667d005c2b7da78dec07447df3de93b2f712f29b2b9a9dd48e45d31f900026b4f
SHA512848f82e97b743984a48107c4ca0cc39fff95156ca8bb68e37e5b4d46dcab9f2c00cfcca92e7db30eb6ab1dbea33bd761e795c7d2a51e4a72cb4b2f6943912543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528c8654b9fb6b617b4488c9b8c797a7f
SHA18d48df68f0dab4d0b407a756759af2e0df9623fd
SHA256df950770880fc0c340d4fb1f08bbd807b1924d7164ade5770005b3f0e73943e4
SHA512ae0364e528175ebb3d4c4d2120d05faef5b28e568c0dbfca648ddb460b11f8a0fee0666097ec44ae6e49d5d9795a82ad4c8a5ebc61d666758df8d500dd915488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca1de9b5c69095c258fbdd80a4d66473
SHA167c1e808a51eead97796579000f76e5205b005be
SHA2561b9f3325625af17c3de5bbcd7aa2f6aebdc64945989a66ba08c1eca96644c23a
SHA512bfb86c62614a8868066e547f6d231420a65aaf4e528442ece5e644ca7e3f76f2943153123e1d35abd1696e5c2879524ab9505ee4ed4737ecbb8c91b30bf6370b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcee57654dd754e92e7e6725139095a9
SHA1de3fb1e2c07378d3c667ab7193cba541cf3a76d0
SHA25602b41a869467b508b2dc2087de0fee5f5d4e6762c17b3f9e0c21be26d0434df8
SHA5121843d63e2cc49dc9e1708ca2b43d12f9302aa5dd7d36808e4bb056749566d426d8c665e5046c6ecd11ab7cba353908b41b64c60a13e109ab6fa80808353d0f42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511cc717b045f31a5695b3e1d41895487
SHA1eae7d6f308e3e285c1f94dd0d72e9d907f16665b
SHA256bead3c43159d384623d6cb3949c5dfb5c32e99dcea2d2bd26d43a3622160c8bf
SHA512b4ea3a8649e772ad141461788487df7397e33b1af54a57978955742d3ceeb8db32fee3ceca08cc02e2d6eb38449fbb3c4dd4bdd2c59c33af53cfa3ef1b2b0569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593872a610f263fdb809487ac762529fc
SHA118d51a2ad60d7d8db7d9bafed2e37269eeef40e0
SHA256f5636f18dc991b4b7b84d9120f2e888e12f4c7f296b25d18b881498b38a9c91f
SHA51220ddd01e0e450aacd8150cf2f9e9fc566f4df64bbbdd6ce22ebd11b09355899db1561c526a930a21f86e190dc153c7f6fac77a046584a232cb1101ebafc59bc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b30a4ad050d63068cb0bce3e9dfc83c
SHA1ff6e89b37ec379696b0c295c772022d08161f011
SHA256bfa6f7bc43da42f260024d43ec019aab91d3281e659effa883644aa82218cb44
SHA5124ec086a9dc98cbe4cb4587bc1a985ed1b350938139cf7564efb1a5ac425afbd14aad0ab40ed6cd9fadd40437f9a60b87faf6655e4ca785a8d5b2640b5e2b60f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4f4b6b2eaefd6c49f8429074feb86e2
SHA16ef3eed8c918ef0f70c50000568cc5d7ec727639
SHA256bc6dedecca8d9ba0bc3d6665a8542dac8499f74afd0df4ffab53f06643659672
SHA512f7081343140ac40c3c674c5d2c27ef53e2ba15a8f4743f1772969651bc44f2485f76a26552263a55fe6ffec51f14a54a267b2bfc43717fff9f3dfba1ed7c5aa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d72850d6fbb14acf2a7acb96243cd3
SHA11394e3a3168bfc1385a41dcf77412009c232f647
SHA25605947de51c3a2512843299e8627c614aa817cb31f365011a931fba52de9d5564
SHA51291e3f61bda5f697e0745684a8b0a9d7c1a6c694e92317f91f0056ebfc076e06d314e2d90973cf13f9b4f6a2ba02c1db5f51738498029f6582e64965cd0b87031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f9df447f46741e3c0a893e9d85a468
SHA151222b9ddd4bc0c4c6f50c0a41250014381efed6
SHA25680529d7e32daf1370937d8e82cbebd57dd64401f34234dbc89044861ae9d2c0d
SHA51226f32086563c6b41d1506a2d65da808287eb91e7d2be252c2c0ae02e31ed0c23c3fe3ba49783e7fddc462369e94b992915851c6815559fa67da18b65dbc322ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51122d191e4a33d48dc70231e43154c53
SHA17c46728c46891a70365fba0db2af25f1b1541099
SHA256a3b64f2c67723297cc0e6912a4fbe36847ebe8d40091760781f94d4d9b2f1ff3
SHA512c3f3a15d9b5d49224b95eba79966f8135acdd4ac3a3192e61fbf1913f93144e27d30a6cc3a0314c8c5fd04a9f98fe9f3d51d63165d5ef562055c276d12db2973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f46e4d88ea3c0ab6070eb51300fd5312
SHA14c6ae5ebf4c6366c715ce5c5f037b7198ec59f66
SHA2562971ec4f65bf982f0cec14963b6ace2ecb89e0c9353e4dbbdc1a016cd77eee72
SHA51281d69f93332a25719d7cbe51d0cb7b9310dae76269819a2a9e88f908ad6bc6120bba10d5d663d360d09c4ad18d7d28890a19835208b0b8fc60ceeb3e6ef9303e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a