Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:16
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
9ea6aa32b813e779d94613412bb84e86
-
SHA1
4fd631412ac52b9860f41e43d4748f98b597f735
-
SHA256
4703ecf15b907773f2b3c207672b7470f3f8d2b4e67e3875036ad8df61bd38a4
-
SHA512
2d766fa097ba7720b409962375c82e80c973936e58f67de58b8949027821fcb4d0fd4925db47ab22266181a5468ae39f75332fbbfc827be9e2c6f84427b8453a
-
SSDEEP
3072:Slhji5aG6M36yfkMY+BES09JXAnyrZalI+YQ:S7N6fsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89E63DD1-178D-11EF-9911-62ABD1C114F0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422470087" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2548 iexplore.exe 2548 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2548 wrote to memory of 2092 2548 iexplore.exe IEXPLORE.EXE PID 2548 wrote to memory of 2092 2548 iexplore.exe IEXPLORE.EXE PID 2548 wrote to memory of 2092 2548 iexplore.exe IEXPLORE.EXE PID 2548 wrote to memory of 2092 2548 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51e7afcbc507d7a5eae6ba4a1a8622f14
SHA1c3d6c0cc61c2727a0df2c6726a2bf26eaf137514
SHA256f58abb288f04311db095b65819bc72f5e5b60e3a60ba4c14f623f8d7b17d9cbe
SHA51257cc5fd5d413ecf1ff9d61f1f663ebe151fc73031a82c95218637eac0e464ac49d132e0fb496e9a853258648c01f49fe18cc27835d6d0e0b241857b68d82569d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501f6fdded796d5231bc3a942bba1da9a
SHA1bd6fdc783a84d5c66be87ee606b07d4c08da3caa
SHA25622fa4fe1ac00ed11fa9649451f135a7d63d511dee9e34880922296ce3d4d6e16
SHA51245820ffccc55e09455aea20a4511906dd91241ba43d3b28a55ec5d4f89826b216d7b79d4d901661fff2c9f7a8a1c3553b5f8433f8b3f17bc50230f46523f7e34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c100c9c4c77b1ea9475602726e8324f2
SHA10b5ee62c51c83c41d2d19e639b3b632068456bd8
SHA256518e7c248e4b9fac7c1a409346b55af6daf5d58659fb8c0ea7dd807a03264d3b
SHA512a02bc7e04988e8de459f840701794a66b077d5ec2726ed1ca4ad933c2ecadd5ae721569d8f35ee2228872bdc084a040f4c15f6a5bed43d918b8adb76e525aedd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b24a6ca0935316bb4ed2daab6ef994a3
SHA19fd91c35f66059ea7298ce9c998194603685d13c
SHA25681b015774e976890aec37dc3d0b6bf3a730d2f2942c0ea974a4f2418fbadc44f
SHA512f5012626e3328fd7efd9c5c0ae076fb1afcfdf8df005ef1915c74a3e0d8bbc0c0a7294edf8da0d7575ae9cfc644e4bcbf2a0811def67539466d604958ffa742c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a02457028b105e5351e659e43c71ff7
SHA140481ebd4866f4d2f8e95ba271902c2dd5fc5bd1
SHA256febd18e2f7243b8c8a496604c1da4a04bc56306260b45153039ba44dfb689382
SHA5125c22dfad0577b8932f0387ad752f6b901e4b1a5b7cb0410fde25fb53c20b725eb0425f8c80efc2e93a2203bfdf2f44ac91526697d571a36c6763c9b61b664b54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e5ed5b23231942e64f02026c5894395
SHA1248e9d2e2cca22eb9e756584acd0088253c44160
SHA2561942501dd4a0645d96ac935c3d8f0f10f6494f507f2547efdea045fe0593e9eb
SHA5129f29eff55da6b213575280740b4db467011fc20dad79cac76cde4c1c9f1edfe4b18ef4d1b1bbc09c0a9a904ee5750704f782b3227492d476ba3c9e2a40d35fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c62a26b6278bc242e70874397582d984
SHA10632897f4eefd0228c0c62f81f0e914a84ba147d
SHA2566d2b4a8b4beef664ec23a71e5978ebd3e01d47a076424dba8ea5bb9135052be7
SHA51272b853ab2f171d3cbe02cecccf28217eb54da56961d9c7c07584acc995d61431a6d9f8e1dbd3ed7a21ee17d2dc5a5354765e26777687d1ac00c0c7a15fff33a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5229dc98f1f95e1beebd0e22f07d8cace
SHA11789572b51cc05495856a398129fb6fb18cb5723
SHA2561f5dbb32c5f94cda8a81b683d37ca2ffb2888c2c829e7fe7d02d82e3ee1409f1
SHA5122e955b8dc1185a22af553cbf9a30b61f820a517a15423bb21ca5084652e1c4123b5457271ef89a6d99f0d46b80081b07ba1e3941829faf998c873cc82cd78307
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f526e1eb83aa65e0e349431917f2048a
SHA12ca11a6fa27898bdab5b791c0d965c8a4962ae53
SHA2565f90e68579d6e73e2a5056b636d57f89ca32034d33cda884dae37abfe8ad7392
SHA512c0d330d37e55bbb77fc634af3cec1936dd57d96a7db569655fcc779e3c3492803d240a1998a39825d363167f6e7a66c1d3c0cd964049fa5996d3d9b6a5386c64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f31d791cd53185c53968fe8ab4e1278e
SHA1a920def60d0f5db22d4bc1c8f85298894f96d13c
SHA256a5972f6eb7a722538d03ad38c777ec463eca4ceeff717838007fe310a092686a
SHA5128f49b73b855dc275936c7569d0a678d231fc57159e4295e3bf314aa8662becaa21da1c75794bb08cc10558a3b4ac2d86edfcb54a5cc8f9e1f57a94fde33ab0ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5251c9c19f99e137c57e5b47ca3ed2c84
SHA1b59437aa7f12f2b59d6867804638ee386ef0880b
SHA25607685db26ac90f4f4b305a0dd316ee446fe8c891170bedc44e2eff5289d05cb0
SHA5120f947a7ec0358cecdc053298e3b47dd68305a577d752f58533291cd920fd5af5902a23c2bdc53185c309b98b1fe6f287f7ac56b4c4fc49fa69df462481a972d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eb8cb00171f998979bd4eafa4052c5d
SHA1a5c97dc369db5ec1dcd57ad936b8c7643c058c66
SHA2563b44f1fd6af1c117042f6b168ca20a199b8c6e0290921e59c65a844fa0d35ad2
SHA512b36ab034974c26e59ed25ddfbd564b14069a932fea0bc12432b77f02abbda42fe87062f3c4ee6f4b03f8efb7653ad6b64387a9caa9aa6371f8e40ec816c1516a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c737099fd18114f8d299935e24250073
SHA1f8ab1b5cf43a4563d12458a87ec19793dddb6006
SHA256a9f9fa1246ef86897bb647c7b950b5c36ae36274bcec7e891e85ef044572f7a5
SHA5121af50fbaac407552f0eb1274f7963cfd9d3fe9a93d5e643d32722f00dbed5487f42c384489f031f69a85f527948c798c9dba276cb8d68aef75e2000a080688f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdf6a876a7c36ed27f383cae145b631b
SHA191bceb6c0cdd41edb90941be3ea1c5e9e3898be4
SHA2568b2677c22d16947e284d16d9cf06b3634327f196e9b7e66e73d381c2128d7422
SHA5121a881514f04862ba146920630654537c842eef3f21be2bee4df67311613fb2fdd30275bb17681fab585e18e2a702cecfc35fd988ce1a816bb0ee73c4988076bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca41801c0286f3cc03e1494ddd230bb4
SHA1ef08c936739cb95e0e4150c8527ef7d34a7dc156
SHA25604f2c4d0e8316ac4c0e4f7432680d264bbb1b2310bb567837058cbc98c02c45b
SHA5124069e96c4ef4eb8ce9870c5e55b08dd5e37b51970125a35a59c3cfbe84e37239474c2d6138926289801f70ddf25e0a742e6c9384a06b0e05e572e50c49b4ffaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD53a612d56daf53799939bb8cec6897b83
SHA1c5b95f2428a1d6cade5de3a560b873fd0e42a59e
SHA25644ed97134deafde2985c9604e55856f0d66daad839590258a2e142ca9b8f1340
SHA512beb659bb29a40682a561ef67de19d3f8d10064903d494f4db4feeeabb44342e692dbcc418fb33bb62ed05197d95612bdedd24080b6e0affa037dc13fcb0951c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a