Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:32
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
214KB
-
MD5
845e64336fc2e6f237e8ad18cd89dced
-
SHA1
3c555673a979ee3202314333d58f582015b6b994
-
SHA256
8be0925f0611be4a0d66a46655fffb05ece574f314c88b22e97fe4120f9f2f8a
-
SHA512
77faf48c027406c1234acd9a1c0509bd496d735888cf3446df9df151cdf5af72ef1342395e47da742d7e31a8f93029526d536cd42a4502aee07c8342943bf087
-
SSDEEP
3072:Se7n6dgQkunyfkMY+BES09JXAnyrZalI+YQ:SealysMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{972D63A1-17E3-11EF-A34E-5E73522EB9B5} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422507041" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2236 iexplore.exe 2236 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2236 wrote to memory of 2612 2236 iexplore.exe IEXPLORE.EXE PID 2236 wrote to memory of 2612 2236 iexplore.exe IEXPLORE.EXE PID 2236 wrote to memory of 2612 2236 iexplore.exe IEXPLORE.EXE PID 2236 wrote to memory of 2612 2236 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a72860af7e6150e1aa1b7900aca1b7a0
SHA1696a25bdfc99f5d8c2c35b328aa7065e40c41141
SHA2561041224818313cdee414eb236598521c14a90bf397483b41585718f12f35b0db
SHA512b08d66f12df60219793501fae6da4f005470fb0d8cc15041660d2bd0fe9c057cb236d0b01c43cba80dd2163300538a0d96e6477d030cb3033632ba4cc76f6eaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4919b0ce6d9a9c36ac1c45a6d5910c6
SHA10ab10865507d1c619ada2041fc422509b65980ca
SHA2561e3ae9a7c84d286676b22d73e903e46b71f017f1f3b3645fd9b329887fa5a3c1
SHA51204f88afcbb34571076ddbc715fbe1831278b6c96a27f43d941b2cffbf2032f1c600704bdfb754ee44e50f913578eb245515f162a2af608b374f636d3230ef27e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec539dffef4dead9c7cf8b13a35843e2
SHA1df87b815725b6722aaa7182415710b986524b41c
SHA25621a3f19521f7d78916c3d2940bea55a6221717e0a4bdd1599c56721f1e336fde
SHA512badff888ba1f2924c788689ada46026a89a9480a34185778cd449fff9b9c0286fd23ed8533237adeefe2e8de6d0aca64e7eb8b9da7cf06b7a97dd8174bda8c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bee85a437f479348b2a3f9981630a54
SHA17bae168420d7192f46354dfbf9463652d5d68ea2
SHA25646751fd1aa546479565befb84dd2e2bbe41640fc4c97fb0730ccd62fde455e05
SHA5128bf160c533463f643ffa445b8caf500deac239bef5e847a7c9eab3964f97561ea26781b4df8de279c3d508db9d994a1fccd2554e2152e8ddf9b8ad522cc3bbbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a6d0db91f9d855b64eb85e9c2809e2c
SHA1195e54a686dbde6ab3682e30b6db1de77927d249
SHA256fb2ad583634f1b0c4ca1b062b434815f6616cf7e144acbae0149dc6de77204a9
SHA51235b9a1e010a727a64a9de5e4fe368a02744dd9dea5bda892f0366a97ebb2cb9d5d2184cb05e6fa1418f6059a7df9fb7e13376c3f4031ce2e04ecf60b29537303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ef7f8d0453c9f68440653846c747a3f
SHA13a1dbb8eb7d482770c091e1b89b9c39f6aa6642a
SHA25632c51aa251b476e5d5db733a60ec61673d3a7e4cd8fda967ef4f4d67086543f3
SHA512e56c7e500849159c69aa8a1de48ed12920bb88fe497b987e6a71cba8bdf5b67626d74bfd1015feebeb23c2b5bb10945a7b7fa30013edd358705c3cee71390ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce9d1995e4c1514fc81a9edc07a6f673
SHA12bd3164a43ca776111bf86b4767377d09ba3e5cb
SHA256a34c2c63a4fb3b3899f16716034dbba0e0f243b1b46adcc8b0e598586f3c5373
SHA512f2d8f296feba3884c603d4de0016e49d3f28178efe5945c3b9a723e0709bf0f95b263f3a6766646a9b254bd6262b1e92cbc052f7a4456a6bcc170a6584275ce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545b0383beec55aa13cc995c947d5533b
SHA1d416ac345603b7315c1018376f62f93b7d46cc60
SHA25638e787671a7a2c0f4308fb3145cc514ba10e0965b58d8575d4171f469b97f595
SHA51233e293281f398d7c1c87a491639dac318fdb278c2e6f5e25235ee50487bf9eb4b93e2d23b8f8e240dd1969935734b2d7a71b335b14a3fb055a79563bf92aeba8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d1fc9d49842ad17ea80b1f9701ed5d1
SHA15f4260282b119a9eb45f71e58c1ecb7955d1bb5d
SHA2561399eb133023d132b712f6edc60f84c0644bddbf0908010671e62bebe66135e0
SHA512a654390d445ec4f166b7bae339f120e269b78ba51fdfb96bd55b335f0f80e049d2e0450a7fc4813e8c205f8f83f3a7f1d35c9fa337872bea8863eef2ac262fb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a620f207c8f87e7274d52e359a27ff9a
SHA1810088581a01400971febe12f044de8cee7d2b7d
SHA2562c5ce59994c2ee7760073d0f95466c852bfbde39560401465dfc32f05e4624f3
SHA512b3dc1baab8bbac27d9e328715cb7c6bc993fdba435045d2ccd51fef87afbeadb9d1432ab8fd4ae8a12a79bb5c0b53f160f236e86fea2e4e02939a9db6b67fd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f866ec1317ef9528e8726861a446dd
SHA1bdf5a4b3c87a68120b1a54b215fa05df69de61e2
SHA256c71799403fc7afec2947399d4d01d22c7b99922a3b991c35642c23d837f0a9fe
SHA51208354c71bc33d16e793e1f2bb47e79faa9a94f96da8dcbe7d08aa911c96cfdf5592112bbb33d6d92029c52690d3103d6f2781d7ebe6d06d4d32f7777f220776b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5966797b747eafd18fc3db8a0cc6c2ce3
SHA1759b5e77a8e166a6a618df44462b34024ef4b576
SHA256729b5884e130f2130ebdefed1a1d23d61705a407169ed869c564bff224c3d2e2
SHA5127e4de44bea1ff86f16f0784f20b8a1e52777b80e0f1e9865bc61dd0805ddcd35f0bc1415c65aed7c58ad6e54e02038d9cbd2cd41a2c416927b8ceb49754833cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a202c969268fa348c1eeeb20e47950c7
SHA1e5363341310fcf435331e21d0fe52cc5ce39f1c6
SHA256525185db758e25a77311aedaefd0ec6bf5ff3bf82cfa74c1bc66e112381d1136
SHA51220bc83bc054b6523db347889e5b063251228ec52d74e014b427cb2a739cf49db9f675b747ef525997b7c85e9c369da8478e867507984aa50a66288f1f1bd5520
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555585af655b7435581ed2c79a831f7c0
SHA173810591700bd10ac2cd39b8ad15644e345c27ff
SHA256648897491c6e833a0e5e1c245dc047bd3d40672de3f46d715e18bd556fdafc27
SHA512ba374317154a6a1dfafb0bb5150b571f76dcb8705879cd998e088733e21198388e743da948ddf72f10a74ba02b03ef794db30ac7687032b25251cbf530569a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545179e0b5f85cc9ce62151e71f2b4a4f
SHA1d31da87a1233cffccfc0c386eb1640eb7885fd7b
SHA256cdc8d633bb9b94116623bec997db3918926da5a61dfb16cdb5fef26bee4c59b2
SHA512b52d89b1417cfd21e7470e4012381ae8eaf7cd61192d721e9a73835ca326bbc7b62e859d0b372d3dce46da83851161f688f577f0de2aadd415dc385381ac490a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bbfd001ceb68f37fc2f8d41c3c8ad8ad
SHA134d4b7221e46b11e87eab973e13fb46f43db7150
SHA256a7eae040d0c092c5919d571d8492d50609c11de270f5fbb7f9236175345f7006
SHA512485dd81517966d6ce1fcaffc508887095e51bf2ffc6c8a798c04ab61f3bc8f23fe71dfb0946e02d9786a6a2000b2f0bf72c936955648f94529d0aefb3aa8bca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1181d4ba11100733ad03e8d66a1a845
SHA16dff7a05b8f6e9bc9f07d9968e1ea4de62be1ce3
SHA256330cc8bc6f9ad7301627c3054c6eb2866a1e12af5ddffcc5070d6a0e2825ad2e
SHA5120dd7787bcb70d3cb7b17889a34c29b79398cdfd780a01da52b91f1a6f1ee9a164959ad3ca5af3d87edb73ecdbc33028c86f0f819d358f5c6816771d8c691e4e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534382aa43db7cba6fea5310d7e6e477e
SHA1f1e2c5afdbfb852ea143e7abf2c91680eb88a1b6
SHA2560c77c51411dd5d1f8853b3dc2af8cc202e466a9d2e2875911445e04933c26f84
SHA512434d726782002218ce54be6c44fb0911825aa690cbaa288d3e858bba93b58024a5e8df4c3edd1034365ea422b428a15c4e962c16c56182701c2dbe9151a23a49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bf7dd0a4a765d80bb18056325409b2b
SHA1f036c7a9da1eb5aa84572116e2d602523117a100
SHA2564a194e915f4c6e55539823437f5f2455cd9cedae80001d77b3feb3160ec3ce71
SHA512cbd2ef0414a0b0aa9e360b585c18bfe68cdc3403bcbea45c7ebbccdcd0418acb1b48f59f47485555f84faed41596dc5bf722154c1aafe463902f51c49e8facf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6eb861631ba7f71ff4e58e45f76fb03
SHA13a649d236398211ea60687c4cdee0a4fceaeb9b1
SHA2564fdfe242713d5f1e914413dd009b5b8e0fad64a9dac87c4d7591c68276134286
SHA512b47786d541dd6302a3f4730d3ce8a3dfa3b20b1a85a001faa011873bf6c291d1de4b4829e4dbfb1d68962962804ab36f83c41a8ff5f5b5d09c9272fe618ff646
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a