Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
2c3b189445b3f168e9e1b7410aa7233d
-
SHA1
68260edba91e1ae8249ec77f7d05647c600c97f7
-
SHA256
3e04c62ce8dd8e0a168a0de2b913db251ffb938ca0ca93a1b2482b74b73a7d64
-
SHA512
01a24d576a9ce7ad70141a4c7b6cc6f2ebc7053392ad336a4210e91e2ad30adf78667a8b5676f0ed70dd95f75cd2781b4fec9d4fc0d5dcdaaaa4f99ff866213c
-
SSDEEP
3072:SlU0ci8krjcfk4yfkMY+BES09JXAnyrZalI+YQ:SlN8oN1sMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEDA9D41-1893-11EF-BEA9-FE29290FA5F9} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422582703" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1540 iexplore.exe 1540 iexplore.exe 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE 2196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1540 wrote to memory of 2196 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2196 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2196 1540 iexplore.exe IEXPLORE.EXE PID 1540 wrote to memory of 2196 1540 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52c69768b821dc2a6cf11e042c6a489c3
SHA1653aed8866ab80e719ab487ce19baa0c33988b41
SHA256c34e25dddf178a1af70a721db4eaf95f16b1d1301768b5fe11b674800ae13952
SHA5126345d55e5b927e35cd2430678ac94d9360ab7019fa03a32e750ba94c584aaf0643a511a45bcc7cc90853dc4b6843439caaaa32bee871fd4d4e8e543042ce8d65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c2d1fb9d0214819b3fe807e54d89f06
SHA17cfdd9bcad143db771930912c68fb4fbcf4678a4
SHA25666f885e1c09330fb27843253af0aebcc1f7bbec8aaa552db55d26456114a0fa7
SHA5129559865aff35c9f0d6d25ff5d67af06a482c55b3b8dc1ec7bd3346fcd0ed7a3c587fdb79462f0d7127cd8b450ec8187909950f0009344366bbfbfce29a4432cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015118cfc189e65f099046c34e62a5a3
SHA1a5da3d75930df69cc5d553fa34b04e734ea3e6ba
SHA256674ae6619867c0857ddc7ce589e28fb91dcb539e1ccef1092c5af94b098e11f6
SHA5126ac57312d57ce5b186b3ec8f3ad5c08e4e7be699b2e4a0860cf0b855da1643796afde847e49d6208c625c0c40d4763dd5bfb81871348a878ebc99e8210e1dafa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a8aa847a246aaeef558209bcca3c660
SHA1813cb9c63934274258e4ef5ed454d8f06625a595
SHA2566c45ad7dd73dcbbace2e17238ce53012e7cd4ccb842e53c341f6c47fd9f71fd7
SHA512a3e01fe9b9ffe25936dd179fb3890c6f5acdcce27262744d83b0884375966b8a6593bfeb278a5b57c2e1f8efff3c61b53feb38f191d98c1b9530273bdb0b3d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51621396f795b40d96eb726cfc0d9a2ef
SHA1eb6c2fe0a000bf295f337f0afe79385154e8b8e1
SHA2562404e5588bb91a46504fba60f44cf33ea26fc48930b624459c5063fa409f4d85
SHA5120f6d81075de88dff446c3c67d970262ca04d9b325648713e6b234f1f1e75dc24fc4e0aabb947c225b44f8ba446797a94fc94b6a07768eb02e6669f0f92eac438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a601820bc6b1f086c0617e9114c765a
SHA1a48c0bc05d9812c337ae89c54de64167fb26b58a
SHA2569ab9f9e81bef600f2af5d23497dc2dd6bafe636036863733aa91d97721b740d7
SHA512b1e951a6af23d93494c01f6264ae643f325eed2f0562796ee067a0e2169d21da2fa8665329da0fe7ced4a4d44c23280f3acb3573d9a9891439ac8f8dd8d63524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5418d220c83807efdceb30aebd78d8b40
SHA1e6859bc2d910ca6171e4f12982e9a7a06eecf61e
SHA256a0de1ec398974522846e88ecd906e0fed6ec68ce05ab58b93188f1dbeeb9f31f
SHA512ef567f6366e05dee528fec11ca1608f96cce1e2e589f1a1d81f0d8c6349b271d5d9d86df70317cc3017bc66623fd48b6b483b21a814ec2b5d3f9f3b316c8f4c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559dd75a90ca5edabd91a80fcb7cf9ae0
SHA17f8f0da31c897e9ea70c0badb2e31ffbc9701a85
SHA2567d48cd2afdb7014b437d330dadec8cc9868b9dcdc419e8e3ca76f51bb8f4b6c5
SHA5125ba322c3a70a915ff67ee62a17ec7a65f28873e3c7ad4afac545b8e48601c55dfdc6c8c5a451e7180a085285c5b66530410487ed82fe9c0a361e3cf7a0189bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebf70f97ac75eda53481c241c6e7f76b
SHA1e348506dfd529ab0e41e85a747de5cf2dd10a4ff
SHA256907f92b691beed9912410d66fa0c13d5a2fd19489c3c122249991848a2c194b7
SHA512393dded89fd67de7e3272222be1e3b3aad30b99dabcd00048284b4bc2029deee0b1cac5cafa7fac437b05f0a7d3b652644336198f14c03c4ae3ddf6e1790dfc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4e3bedad5e12795c05d76f6d91848b2
SHA14bb03a8786cb6a64fed2918d6b59a779845d141f
SHA256d8c6a20576214486cfb3e31ae71440e9c1eb490eb75bf940cf1ad6ae7a30ce66
SHA512aa70b08eee8f2d10fbdc1eb11074794bbd5798f6aedc05b26281d66dc199ac5c6f3fe84ab6cc0b802fadf6b4b38a78ee14c36b06ce7d469421288f707cb6da48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea54d409a762f53f7f8bfb2d7fa32fc2
SHA1413440d16e09813e0f9128f313eaba12dd7d45d4
SHA2569fff6d2b5c8e051b9966c9227ea3d49493066fba419e546f658c652c37b321be
SHA5122ab752e5268f8a88753352a0afd6df4828156c8dc8cfd589e505dc3f37805187ab62027e334726d7d9743e9040e1fdbce30a2889fb6458a293b9fd782354a0b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5394e1c80e53cd70325a95e43d6973897
SHA1c8d7855321b668b1552ffd82596a8c6f674dda22
SHA256e5e4a242556546aa1287d5ce693c8947ed118bfeef2dd3aab864390fd17c1ca8
SHA5128a2b5d4cd09e479fb15ac9499aa714a3aa5270d9391d7a09f0dc63fa858ff05e0d9a01d63730e4e5c951eb60eb0d5e03270a54dbf92947b5145ceaa4d43dd9e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae749ba77972f450c7bc362fbee08167
SHA17266b65688f7ec91a5b2a6cbf126b175fc847e0e
SHA2561bf99489f794a18a8ca7e55cb09d2258150d9ed096460104dcec11ca3ac4fa86
SHA5128ace9360b21accd77cdb6976de9fc55d1fba630b6fa3237629d7acbe913c4bd21ca083aeb718574fe664aea9c59e1f54212186246761acde6e8b77995037701c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554eee1e254e45c5dda2f6ec9aa9820e7
SHA1d35f8af8d93f14a97c45dd690ab99ecd90baed9d
SHA256dc290dafaa1a76dc2103fb9b049702045c3ba81ec1a60b59d05e9bd290430410
SHA512a836d6cf7369fba786ba34f2a1612d56feff1fbc99ab3ee29060c19e848aab6b2b25e768461d5ee47fb890eabb7b777de001289a57c3d2d3b6aceaa1ad165c18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560f759aaf28828d1afc2ed2521ec1e18
SHA194b7d24b07650d278fd3b82a4fa3fec9a9981db5
SHA25669bf8d0fe7de8e0bca1f4eb212d0a5d1454633567e5ed82e4c8c0ef26dde892a
SHA512590af4c43878bd37f47ad50156e8c51a2bf73e10f9cf5704d747c734945727f8e7abca2fa3b5ffaa272d09b4a6bde5be8227c7eb54ae888611e84c5ff4af40a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d75742feaa2a4de8c043023b03982fce
SHA1555a79483c50a31867966058dc0cac0a3f11402e
SHA2564b3078dcd48ed1f55811bf0bb744ce49fcdf45336a0acd79c72d08dff449003c
SHA512add21fad93c104c3e04ffaf57b9de215e26e3e7802844f460d11da988d02039ffe6a2faeef792f02e0160aad02545c6c6c5492a040a9b3a729a139ec2412b3e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a