Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
ead0226471582c24acdd1a7517dcb401
-
SHA1
714d1e5959c2e56f8f93a159beae57003eca9d0f
-
SHA256
e9efc88907940c7cb6c30568bc2a444d937837f062f3900709b81fe67e3477e2
-
SHA512
76efc05c09747385538874b2da9ce5b13393b22ab3259e6d4bf4cf4fa4ae1eabbce749249915d9ad96705732704c256d82fedd5e2c7c79a0249b821be0478a56
-
SSDEEP
3072:S+5aUYsxduHcByfkMY+BES09JXAnyrZalI+YQ:SCH6bsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422394451" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72E76EC1-16DD-11EF-AD38-76E827BE66E5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1736 iexplore.exe 1736 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 3008 1736 iexplore.exe 28 PID 1736 wrote to memory of 3008 1736 iexplore.exe 28 PID 1736 wrote to memory of 3008 1736 iexplore.exe 28 PID 1736 wrote to memory of 3008 1736 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff09343608ddfc98f1af92495bf1ee60
SHA1d89c81765690e83bd149bd62225935e99f7c66d1
SHA25625990282e3ddf040209b68f1e2c3f78cd4a4549d0203be27451dc94fd5da2ea5
SHA512eecaef17ce5c005d17d81d5d403e2427a5f69bb464707b65e28f2a6fc454a41743465dde8f562aa78cd6537572aa9c56e1fd29aef466e867dd361171aff362c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50658bb36295d4c4cc13665f40f719c90
SHA15d2ebaec2ec33ce0ef204b26c795a583d84f8a34
SHA25691a9c5f7a9428210ef5f8ffcf1efbcc987fb146caf321cf7b23acd15c4724c45
SHA51210d4c0acbc7b194737610f5e0ed92cd3b9c7b704c3782558679e6b2a4b533951e0964af932d0447b7c5a9819eac39fc89d399a50ef8593e37a193a4d13a77906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a69bae61af85fb6f95f40371a1df304b
SHA125ca9f3673eadc08f1f187431afe5bd1b9aecf7c
SHA256b2b5abe78eb8b48837e8219c480d2622e7fb9c5a589c4e026bde0229b58d6b77
SHA5126f4ddb2ab0645efd66a434f642f164ccaa85f655893ee71455e63871703b5f66a767a6335cca911cfcb63fa62d6d17b26ac578066c62f495728cfe29767c14d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57941c7939d36210332b946baf7bedc21
SHA13d90a9d367f1b98d8f17bb1f00891cc33c44bf15
SHA25618711618f1b1dfe030c14cce015a6459df0a915235d458577bc97542d3723752
SHA51272e6163e5ce7985c42e9edcf9ad22c23d4fdae744d0203743542d49dcf086afd12e6805dde6439a57f6cf87218404113baaec9e58cc0e2ea65daf9ff633d7ccc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58902cc5cb76d016f6ed283a7672f2ee1
SHA14da8f0c3ec00581163cff508e1def600e7623da0
SHA256a65de6203a5fed4065527732611e59dfed4fde757e1452049d032a57c63c6519
SHA5121032557c3fadb35ef48313a150c57bcbb2e0245dad3ba061236ca423bee0f4f1367c5df29d054a0dfe1e0d0534c9e776da6e54af1d5f05639a3b1897f3572fe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a6730b2cac2f93c13b2118a8db89bf7
SHA195726e32228c6c6b72521873a85249c1a5eb7884
SHA2568ceec7086ca3472bde63f48fd74e41e49e934382ca2f8bc4a444de1e29cce08b
SHA512c3250855b7b5fb066aa73c4cb375324b12bac0c26ecc5e2bb7f988dc3ecb0f2bed9cecb453ffa74457bc446b43511391548035931e67ba4544cba857927aa5a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2a4c4fee1c851c13c4ad602d4fc41df
SHA17ac3ff57d5a47a151fa9f32d23bf4164850c1ca3
SHA25698800425a1782178116f91998a53c49514e76ccb746dfe3691f2f598abe71249
SHA5123f2e2c51c221ace1e9e718ead4f2ae14584dde81b0256ba87ac78ccd5a9661aa8906f871efce94f7eea60e599bc9109e922b617034d9328f3700b782b621e221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53425c3efbb986acb0d52b4cdcd2c1693
SHA1571fec768450d5b03bbf56ce3de606ff5ed77a78
SHA2568e04b7d3ead0a1e15609e92b47962311ab6e34e861381fb7f0feb3455f9fb424
SHA512d9f368270195bb4beefcacd69567845252a96a431bbda27f84ac5794a71a0e023d984d8c5c24d1a89a07329e58a3c7ee518be89dc216deb95535b8025dc9f95f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7acaa2e1c44c6ce1bc13eb26f22e1df
SHA158145d76d10e298f3a25ed0289f338e390c38a2c
SHA256e032269fe402d2d0b6df361ba9237858f4c6666f18ef352b60f0965d58ff038d
SHA51278a1c841467fbc90d940933555e16a1404dd6f5d81b7b5a80afbf743f311e102581226eff68f9be6cd8ebded33f8617816bbb518a23718f7eec744b1650717f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cd4c1e26adbba24ae3a6c976aba808a
SHA14aa178ac5e7599c6cf3a0df6c4ae454a166917ad
SHA256a29fbc4322a388b2ff12ee74c78476661fecb033534547464a86467e1d9ec190
SHA5123caf637f337215c0d3427633c5d99d8470c466f52b29c21fbd5b6c96f781a7dc9f836eab01a7914062e2ef2b45fe8dfbfa3181260cc661f57adaa12c6129a23f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7362b7c833bd5002269a1cce7a10c58
SHA1fad6e5915b0bcc9376047d88e7edbe6fd5b1b02c
SHA2568b046e977bdef09ffa081030043a08d500cb0c0ec3d95a554d49e4bbf81334ab
SHA5125ccd794ddb6eca4a44256e373fb67657b6e518eda4df06cb3827a8dfeb25b77d5468a9cff868c050f05d1973da9e41d020116af761158403488686d3c1f22dd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521ccded46299deca7f163b36a45e52a1
SHA17934b7c456a8c21abb6905e2d3117cf4ea9c94a5
SHA25644951089244eae03e8578050a41685918cac9656917df28ddbf56d1b82606072
SHA512f92862dcca9534f3be0f8096f521c408b4146279bd4cbb83f7cb187dc1687ca28d6c937677592993e153df20c7e0bfbbf75fcae34c0883c5340251df04d7b19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a1679d77a0fd3da9c22ecb514e1f67a
SHA126266db5eb4d8fa3d0084899c2bb7730da8824ea
SHA256e6fc95bc54e5166d4eded8c6e33cb475c0d22bfefc3ebb592eda2072259edd59
SHA512e2c6d84067c12bf2b0a5cceadc09a913eff120b2d91266e2fb3f7b253d8bbb51a60bd3356135588da52592fbfad7bc482f440f61d21b9f72af3d516c5886f4d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e63e26b72f8abe93ca47186166e2b284
SHA1359d8711101eb9db6fc7b29222b3c83b7d18a796
SHA256dbdc8cc4d9287adc76c4705eaa4b9a1e94fd527fa9569acbacf58a84b915ac08
SHA512ad943a9fa203944121751aae44f5567d029c72c54f7af7b5dad05305c9976846d14af70000ae2dc7959190ddb4f04f90c13819c2079a163f0a3ff3ae4d9d5928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5751f741a290f8c3964fa6c8ebb96d7de
SHA1645d32e6101aa6eac69f11ff23943bc979a0e0f7
SHA256c47c2d2d81f110099ba7943d8a4cff3e640477d81ede643856de98b594085585
SHA51234d7368c869ae156fc1899c525d60a93d0576268557ed090c8a7444df22919a0ad8297b60fa74fc8645e5c18bf94ccdf8d71ccd2f6f1a3592f9b2e68456a46f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54308323a31abe191055158306768a512
SHA13c82b1b64a4751c2c24570e7c2fb7783290e7e28
SHA256c6a6ef31a28f7d21bb5db1467216f5c2a0337efb7a2569385fdf2d2834e602b7
SHA512369918a55f6c3baf48e3d8f87549ce5da962690a8ed2e2bac74f4c7aa5589bb3cb3de77dc9a7bd511b0faa19b97d0f966e70ae85308558f5d4a505936a77eb09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576fb3286d3335629d99da02891613a17
SHA165a86689c8696ed936f40949a3a43bf6d4a50172
SHA25616e7ecd86295639241f74cd5eb4420152a28694da463d44effb6b0baea7da8e9
SHA5124b589b7e24449e301f729ed7662e3c74b142f54a78403d18b47e84d2f21980c90c4887cc7cdd6533655cb7bd87218d210cea4401436b91bc3b825d7838823e33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579c86afc619d7579ca2f759e255ea931
SHA1369de501997806987ecec727ecc51a56cf66f4df
SHA256959dbc70fc6129262bcabd21f24aef6daa1e8cf3cf654fdcc28200b699c5094a
SHA512f0c0e49d0e14b4f8889a6f08ce939b8094e05003dfee8765dd05dee63641b4438adddaebaebcfd465f91419fbd3b7d7efc0c2165455b7ee6ccd6c00fe2cf0dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5919ed6f29d91a8061917ced8d42dfac6
SHA10474ba38c3bc342395da9bc8602c368d00b9c5e6
SHA2564fa825061896d4b6f06afbf800965e267d5070d429fd9ba7975fc339104feccf
SHA5129c437e1163055c835d69abc9824ecff5487a96eb67f16ead174c2dbb87643807d75b09bbf9a2641c0bc9d9aaac30cae365f0c88af145b264849f5cf133177de7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd1506c2ca31dddf10a4e9c7221d8c2d
SHA1a8402e9c417d713eba36ebe85e30db908bfb56b4
SHA2562bee560d8bc0b39983a459786cd033a60a67f18f7e1cabe6000e1aeb2ee6bf74
SHA512056d9bc8288e404464788dcb2260147a685863ad55dc4e772ec811481053c2fb2e24ee3d5400bd928ae09302c42cba94bb4b17eea6dc9a99caa9fc0f16e22643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5476cba4226b6b2a86a8783e8f99a26b0
SHA1763cad432f5657d13000faf868958ee3383a01bb
SHA2566105785bb138d8b2d97d5622a57a69f6b7119be9ee94d2aa579916a992c72df9
SHA512336bb9ecbddc3aa7deff4f051d37330c335b82be533ddbb65af88679b9277bcd725a44b9a28653a7bfe9f1e04eefc78fd09f30c601cb242f1ce7bc90025944d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3735e89829ad12c3fcfbdb4b169ab38
SHA157d1a830fd266e716fcd5f45d1b4295a3085c54b
SHA256c720ced0e04fcf9beab8510b156d85d7e52a8ead5390eb9e14a71a3a2f8d7b54
SHA5124be81e021fab6350eff735317e334099f59f35d22d2930670303b29c8249554eee1ace400b88f0d25d1ab938342c3288328de699dc52808ff51b7d54467a0801
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a