Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
639ddd3ceeac02d9213f95993ed195ef
-
SHA1
bd2ad6888c872f61a7ecb3383ed9c5904ca782f1
-
SHA256
30e448c1d551fc3c58c1cbad6ea5346e98e52a6a945745ecd595477112b1f365
-
SHA512
901133accf132be5d88985020eea24d1a343ff0da254c1e53b10f98b033c26d39741c625613f3772b62b258781f09318585c3bffbde2707d08decd3f76886693
-
SSDEEP
3072:Si0yVH2SBr/yfkMY+BES09JXAnyrZalI+YQ:Si5dKsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{144F7621-17DA-11EF-BA28-C2931B856BB4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422502956" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2140 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2140 iexplore.exe 2140 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2140 wrote to memory of 2612 2140 iexplore.exe IEXPLORE.EXE PID 2140 wrote to memory of 2612 2140 iexplore.exe IEXPLORE.EXE PID 2140 wrote to memory of 2612 2140 iexplore.exe IEXPLORE.EXE PID 2140 wrote to memory of 2612 2140 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad8b4e8cdd868659364530d11004a4b9
SHA1e8ab7f3773347e158e9670cd4ed203d8f8a726ef
SHA256e0038c0085b10789bc1701159dac52154fd8448cdfc3e7879cfd43c6a4642a8b
SHA512f7577a62f04a02e65cb7f74af287de07d2d1a0f711e420d94458d1d4b7e790df19fb6aadd54a0db0cd85cfa0fded85d07c37cd9295a1f254c5bd1ec1209c500b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5397eec819534323d0efe96944782051e
SHA12de79035e087f7d7d264f4e30f4856497b34c146
SHA25669d1de4ebcf8dbacf555251b956fb004125b59c2e261390ead3d4a731b690f04
SHA5121948817d21915b3adad52e8dfe7a5ee9fa486d64654ff9bf8814e38a7b72b86f6ef09d4d176f42288347c97a07bd95cf6417f6c2160ad77ac2b116f63976a159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f839a3281af8fd4f716b3d7685c21c6
SHA1d03da489fb5e4105d5971fdd97fab8e041057a84
SHA2560d5b2cccf5af96d7cc46b9c5a633e6ef2e6edbc4e63b1b0134797ddcb87816de
SHA512110301cc42966e6e5fd1d5812869f5bfcece7a8758a2eaaaf337966b5b3eadc82b9b75504924ba46a5c155690fd878c47851af5f65152dc7ff585b850b4aa56f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5156f943a0f5f72735035673b4fe68a08
SHA13cf699b38e05bffabfbbab2b77b08dfa30e63369
SHA2568390ca9dd3d0c9da4466689a73d8b1441d18219bf1c6e3e0a2c7d919267a0fe2
SHA512d9e58cee4e87e61b9851ee8ca6c18cc1bb0754439c14bbdcf6676c87543c7a5607632d878fb97182a76aba8bb5658483b92116d18db9ffc22f9fe5fb9828e96a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53936ee04cabc8e46b7a5cb815fb6debb
SHA174705a8066bd643f26b96963d25557a084af8ad9
SHA256e1cf0256f6b638d173a88f8cf2570e1aed08374e3d70a2c7ff4c40a86ef8380b
SHA512e6016f6a777e45fb4b916d173973501168a287b271a8b555aeb1b941f1e31a7e44bd6255d44c21fc2ce91f34f01f7bfa31f16a20469ab23447c3d950f7cd44c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c603abef06e60a2159898a674d3873fb
SHA1054ed9d17911e01bd959c22d3b47e5e952f7c322
SHA2568d0e2058f4da87e12af949217148bd685e4dfb79441cce7fbccd4519f8654374
SHA5120626ae7035ec00167afa2368c3a6ca3fadbe2771dd40bfa35c49c10a92255af9f3eb844ebeb09cfd05cb11e6a5d0f9283d9952403bf3b93d0cedd9900fb5cc81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ec0ed70e43a061796439663b4e2e862
SHA16516536fc1e9d3cc3a6759eaf449ab7c4f6906b5
SHA256e751a3d404efe20cd34ac67d76136b60b210f5ca5b4339b1f12b06d8c843002c
SHA512e5f4fbd9cf83340cbd235e58bf1d1dd44cd60b1b83524becbf32edd99726d55e9b325679e9f2cc1a39a1aacef99231c4caa6b21d2d8eee945f8a3a2e3b17ccba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57203a2586bfc093fb35a02c1b1baf390
SHA15643068c9423e1f97abc3eceef1bd1814f32d659
SHA256bcf5dc9d9031de358fb073a951a7a3426b7b94c15c9872bbf45076a57f75c3ed
SHA5121fc2af991f47117d7013dca7881c1ccf7fc2d9a8caedc9ebde1c4e9405e0e5c0344687e5e0d86b5b682f1e547dce6cc03114a919694bb2757c45e8786f7c0135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5300a679ee02aef0b78ffab8e4ac40c40
SHA12403816939ce88131c244e874a4d5bf5185478db
SHA256c514aea2652cbdd2382c3551726f84a2132ee43e012bc3598930e52691848432
SHA5124d177a1677fe50587cd24399499079a9083fc395299771a7d639c1eb66b81e74a10b0ca32735449e33668763201ddd11cf832a36d1ab3d749d3ba4636aa28318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f4fedf059ab7911c6eb3139d7c9671b
SHA1641634fbb71c408364a5d05fc431ec4cdbd5b6ff
SHA256cb6a562e02d3fbd3234c14696ea8bb7f474af84c3b26626f8e63c1e72b334e48
SHA512a135b2fa9367e6a7bba02dd6dc7582ce624dbd667bc273ee30850b2e64c21e8e8557ee067c9209d84c8a5d38fc6bac570f4106d52d90f5a72ac6417ce527d89f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524826baf16b3a8b4f81416b4c9ebaa55
SHA10a9e14232716a6c1469a153ce440856f04b82a11
SHA2565102c1e9d2b338094b0fca4522f7b99adf2830bd976b5eb388d9be5680be359d
SHA512fab1ba4942a2a77e36928f5673ccead79eda9df30c0b8586fc688754a7c674725ae74507dc0a6cad5710389e41e0fe8a6b1152a5d7b7d58dd33a356dbd8205c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c17493ec192fc9d8fdcddb1e2db8549a
SHA18c7cd949d4225724f7d98e1180364d11035a5c24
SHA25665fe2f11fe96fa624abe0f85568fd03e4fd82c8004f58314fe13e6dab8ca9e2a
SHA51219e26168341eba071a7ba2d2c2121bcf75dc2ad8b127c1fa42d3b2cc1bcbb09cf90b9402c8456a146c2ff266cdfc7a3e6ee187186e41b8a0e34fa6df5a295302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5072e53271ef6bbeb7b8913bc900d97b7
SHA10b3f8951a1975baf0fe670ab8584ffcb7bf95e5c
SHA256d6b014639aceb7b80cdd3f9bddb05dee7e84f36d26c49fded49809e39d46d2be
SHA512eaa2caf17520fe1c97886a668f6754e51f3a4a213ec6125680ad871a7e0a89b781dd87ae61d826064d33c9fc15ad96623c4ce30e4939711136766d966f1a0c25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579ecc7b2eeb823cf25bec1f58ab8dcc6
SHA1ac2e680d52e014e740c7edb3729874126cdfd637
SHA25640bbc9a66c9ae1a8d75a9a0c72c8d5cc2817a4ebbe7a51146ef72b4d89d4783e
SHA51250a6790244542be6ee2ef83b8090212ef81fe1d1ca65c769474724c81f04916610ed62857d4b3a47bf1c4bc0c0104de24d1d4c010d85eb0d8f76cf6754047026
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bbf95a137e73de420be6bdc2004bb10
SHA16d070e48a85bfc625b7fb34f7731ce77c6345ffb
SHA25628552a81a7a5b52290bdd391b7f4b39de4ee05d46ea8b3375ba1dc76acd19a8e
SHA51274aedac38936d223ce5742228c83a00f66a4d6e9636e76cdcb827c2613153c237482c6a0845a7da1aa9574b8d77722fd6a87ebea7c11df5ef86978690842c2e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ecb266dad786dea25344f00e4235c7
SHA1c9dfcbc32562c4f14e3d5d8a002bcd883938d9a9
SHA256702cc4c3d9aa02c7d839ba93ea2ad631bb08dbe28c57d44e24a48d61bd344f79
SHA5123435d1ede10783e1fcb208a226e830e3ace0ef8f82279563d74f8a0acc5adb380e89abc7b3b0edcbde7f3679da92f2f921486692116ec24c68cf177076412619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5542cb31733ecb3c91fc4b1725b21a120
SHA14b3ff0ddee707b7479bc06b4ef2e001b08f843d9
SHA2564eb50cc90d929c49ad6d80652386d068eca79db6d59d6265053ff2a3f2e8289b
SHA512f5dfe099a00d0ad9e4f43b2dd7fbd912daa1ca57d8ff02601598f632e89eb1966d868930147a0e3f53a68a5c9e47f3249158d6803d4d32946ccff2c1d0fd1c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed83133ea30c465b6ec7060ae6242615
SHA1ed92b7bea9132acd4f63dae14b12295ec460fc67
SHA2569bf2584926b6c31f1fdcde4c82ff479f95fcf58f3e5c0bbabe00d85e29d2f910
SHA512045ffbc58642cae610bba79025cb4d2579514b7786a8a0ad01d64959a764e85c21b4f6b278927c5ccdf711afc31960af43ed7be707e5040b2ddc1cc44ff7861e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2b383465ba9d526effb6ec29bd1d1df
SHA136d67d54bd073491a4fe26e79aaea0745166d6c0
SHA25659d7bc6b188b6163b6c7d3d10a7ecc97466692f737a2999eca74d7467746a063
SHA51225478f181aa452fc6de77284ab83d1ed6851e8985b6d2c2fd48f5a3c3cf6dc16cbe2383ee54e9945923e33d784600e0f7761809af2f27b23639df9a66bdcd44e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cbaf07ecc204875856e03562d6da949
SHA18c7f4290b92246a00135763fba89bbda91d2dbc9
SHA2563f0ee6a9fcc946dea5939ec67671aa31f41ec630c7fc71daff08593f594a3c2f
SHA5122013986936f4ddbbe81090b5fb57ad28af2b4cfdd4562f8fe7091ec81f6cb8e27d932c81d75c6d696f11749eaea96b5b1011509e60093eabf7ecdc3b4e1f6ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b72de5de778bfca2c8628ffccd64123f
SHA1cbf39d85a24d697c7b5f04321844b2047015bf18
SHA25603f264900a7f8a693edba8fab23e3d57671ce2eee0623ad60dedf414e3168a4a
SHA5125f0c77b5f515d3ca51778630b265ead9dfee1479c53d57c26a3dc26f0ea1428e2b8d044e080de43e4d13888341357667ed003bec630a2cb4407faa1e39a2ded0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cea438d396728981d499ef01ba26e931
SHA15455f7a255d4634734ca1dbc8b3330b6e34bf063
SHA2560288a9a5d7e9bab216b494511ce7bab04b9550e44fc4c051e2675d0cec287865
SHA5123a9ff6a73ec59123403928b0df76b4f09ca3ff819f609cee7fbb6ed2def56dbf6dd2bfa024e79102b1ecec1d7e5719e71acd50c4fc89c349344af367289665bd
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a