Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
libgmp-10.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
libgmp-10.html
Resource
win10v2004-20240508-en
General
-
Target
libgmp-10.html
-
Size
295B
-
MD5
e4911776daa6663fc9cb528c6ca0ce6d
-
SHA1
04cd1b799b0a821678997be74778d4212b449064
-
SHA256
716c613c60453480d3fb208167fb8630d6e32a33defe0039559497caf96d3c83
-
SHA512
fbf33d573c05dd80bafbeffc268cad76a0a6c4af993306b1a6432fe1e7c1fe52463f23e1d8013feeb90ecc323a171e4bae660e15418adf14fc60f7190fa2cc91
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52789941-1834-11EF-A48B-4635F953E0C8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422541714" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000db4397811bbd48fd225a0ea2bc942091d02125bcb359b73600bb592657f9a0b4000000000e80000000020000200000001e4d129256a27647ca6310449102135d8631e04ff68f37f58f73404d87a819422000000086a4551f296ef1cb366ce17d4526d569707eae079e208ca52732775c9ba63c0e40000000c16b76ae3406f8ec46cb855cf3cf7873d5e9eda99bf8717d19d29558d4ef1cd563271f10bf2fb5f7cffa17b2c9c1a2a4aacdd440c32e3030748b9e31640d2bce iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501bfe2641acda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a0db1bbd8e340ca275b4cab3fde13e4bcb93bb7289eb97527a0f3825c33eb963000000000e800000000200002000000041c7f90f71cba2c61074645cfa357bedca75b3e66dcb55d299780ca5ed069ae3900000002633fba8f26ae107f5aea36b2fe015f3023c757bb12ede6f8ccc471f9fdb64ff999bac2c64098dd7fc96f46fd5650cb3d2729b8c2c331479bc12e2cce6cd829b85c5690c48075c759d16161ff3d05c3a1eb7661d635e40f89170908049666041be698504ea946f00a1e598e289dfdb7623a29722bd4b17794fd51514334e65345527773e88083723c6ee2d62186e9c1e400000007892e9ce4923faeb536fe7b0caa3663438a366b4bf3a3b0f2fb2b5cf7845a3bfe1d6e5d3d79dd93d65cb16bb4eaad72f41933d0d2a29ebb9141fbae5aaf40fb1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 1132 2060 iexplore.exe 28 PID 2060 wrote to memory of 1132 2060 iexplore.exe 28 PID 2060 wrote to memory of 1132 2060 iexplore.exe 28 PID 2060 wrote to memory of 1132 2060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libgmp-10.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ab7db47aadc7ba64cef49a500f5379a
SHA1a6ecddaf6c31b48342f0e9383561af27dfa7ff44
SHA2567e89257f069e477af93d462d30d9cd50b2b80686bb9d261963e582a8c9ef0a90
SHA5123a6357ce01ce2a55fe75b39ccdebc6896c7103f958a044a97167bc402ec76a41a47032823959802fc16230925f508cfdbfef4ea9c0527592acf2f97ef27bcd28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0b2e4715b30368e5b84b1d74a93c7de
SHA1f2362b41a5e2c58d322bba37cb04f4a2df6b9a78
SHA2560fda65bfeeaff9ab20b68d9a6327895d4e1dbc59aa1fba53fa445616fcd6980f
SHA51263b6c8752f3702c4f892fe7e031ee13fb6f93b3ec0455733a8e93b107c3e2a11d3a7ee4419b8f7b00a2f83ddd03a5c900d1d6afa6e90e7af14a743dd96b2e0a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e56debc4b546ed34198c8b5408ddf391
SHA143375f5ce0852ad662e6efb828b8487dda6c2c87
SHA256e36b1ef13b26d98634c782e4b277ed21e262ecabe24b22266537c47eca375df7
SHA51272455e0bbcdae5a2ba1f3e569e54a4c5eb692bf5534b9c050532a0d47497f79d01bd6f94aeb63b54032b9b6101647cbc6b6cfe8359986609ffcd061a59cbec7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527f2b6012ba11837f60661bddcaea6eb
SHA1981b08c4ce97fb365122095a02bed9ee5f85f8c7
SHA256087c81fd6fe4148eb9aaeeb99ca2516f4e8824cb5db84ca278c65a5fe37d480c
SHA512e35b5a18baa7217e1c40ab0a935279a1e391e9934b121d0ec643d34752cb73b33338a257e9d1cf6ecf378a2aae6f910f319bbc6da27aa80291f385f2607261f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51377533d4a037915aac034966ac77e4b
SHA1fa6cf7d3cbcf01cc4f83e5020af655fbb5e2f77e
SHA2564a6cd54022bb85888ca0fd7006512865a46d1f3c9c8d40baf7de473d373c7fc8
SHA512488872c7bc70c40c5d56349a22d134ffa00569cd938a873818a869627701b18076c0ecb8b35ac267bcae5b6ae7972688a2e2c19785d22151ba90180b07dfbd6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a6d509a22741f9ac64f876a81bea351
SHA1958f2cd3c8bfb09c8221134445b3965f8db75887
SHA256cdc6853ef797000573f36a4fc9ea58fbf4b2bf9eecc4638e13cf7c9a442d3119
SHA5120b4abfeb37f2322d4a6b11162ae09787f2cd9ea81f3e282ac65c1e4154b5598d0333931c863f457a0a46ead703d1bc2d154adc4aefd85b128ec278eebca16966
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f86f482abcc48e32b27e28d75686cb5
SHA1a9a703554ad8e23286ed0f124d2e717e2121d9b1
SHA2566470a148c7a7fbb39c482f6bb3e7c94fc9f76a1eff92a9d7077ddbca156bcb2b
SHA512a84b15d0c578b3024da0faa776e5cc4266cc5d8fdf11f32513a88990b0cc0595c534c44932693dfc2c1e61973657d715a936bfedeee77d472ae4a396531a6a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cb8080b7f2e0ff02b7ee7adbd19a155
SHA1bf1396a8f3976cf42b451c0e50eb4439a936bfa1
SHA256977498af9a5ae808a120db33fdd7fa5889dedf57ada9cea648492a5b9fd42345
SHA5125a7cb4a2c951b65fe8080d84e8e78065cb4fba0c88c7ddbe17e2bdb74b364a9098d89423f11d6685464361caf4eae5c033e57a93292524c9b6bcf58501d74fbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5315e80bc3748c9c7a55c0064fa0d2d
SHA195dcd12b11b5e3213ba945c0e59a43756751bd8f
SHA256decec9bd3551c01eaa7a6be841aebb7d291c507d9d071dc8269b86d6f973e0b5
SHA51292c63d14f1e336e5b3d7ef26e1ca6615b8a5c99529be84f1e51c54dcf03c1a78525449222b82780cba8ac3cc6c248aa07d511f7336afac64a2ec9b184cbfb316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5519afc2fba29912843e0b54186189a38
SHA1ca0e770cd7a9a8f8a428f85da97bf20ccdfc6f9f
SHA2568b16e87e62543237d4f35df30418321c78aca0d7979d26be21f80ab8d015dc61
SHA512024dba9e8da9d5416ed792ae7d49a7e79bd4e78f155607b8d4519ac9e8596b08ba23ae7a0e545eb48bf9cf63f61f3d5adb3f0e56c2debef48279f29b5d20dd69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3b75f3bb37f3201117e73d66e208f25
SHA1d9b726e62661ce9af427954de11535596ccc87af
SHA256be453b441cbf175487872b68a412d140f4672dcb4ebf7f02ab6e7470892f85bc
SHA512e985d569357fd54b4855bd6742dec8bd08ff236690591f8ed18db186e5620154a11ede68f0f500ea79f812ec6e643d9790831f9ed62e90d0fc8e9b51fe2f81ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5201d158df1be18609fc4a0d17d6facc8
SHA191dde9a2d4fdfff00737b877c5a9789ec512c83c
SHA2565a466bed5df7892de8637594821777bf26b2721e1c7ddaf5f3f7563c3b4115f1
SHA5123be88f26b90034d4d1979997e662726914e5b753e8569f9b5fa0b64370bdc8f1257d4822c73a7efff17cd542303ac6978d9862e0545dd27fd1cb01f764f44171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542b2242823b1649bff11a5c6771e233e
SHA1b992e798a50f7c06246e5020be5f74987dacfca1
SHA2563f0a4fab905307b4d5bc80403d14941fd06a0e53918556b2aeeb7613f6d820b5
SHA512e8d0703a32039d65cd097ea4d0f7c582aee7b698a7465612f0e0651b01b97b6498a997eedd87ea4938833c15b0871552cc9e8c8054de98327c4cf735e3809a1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd9ca3563370391a1de9290170752324
SHA10574db9e9380d6358c626e1af70c88eb6cbe6a2e
SHA2568cb56967cbdc59388a089004fe533d2788968811de7dc94abcd62884490385cb
SHA51210cdb0e995e3c1a91b3aa3b39dd78b9b29322bbe6a4786b7659412abc3466505211e7091ce0543acd792098bcc3fdc9c714baacb6878efa9a813eaf7b34cd6ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0df4d0c0d712550edc2850aa7a77d8e
SHA1bf58ec020c2f245519d65596958954bc4509a8c5
SHA25627e7c4a5ddadf97765eb49f4c2bb464b552ac788cadaa6faf8ede552ccbb301d
SHA5124d2bc89a47f5b72084ce6add206586312007af5d01273a35c3e9deea99d39b4a0a7920bb5b912994c872adb4dcee11d85b83e2e7f11d05ea93b07aefe04befb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55151c7f8b7a99b444fb045b64a1b164c
SHA1bc859d8649b41127e47e3f457d75a003e6205b77
SHA256e5073cef58ebf5a1b1b8c6866d115f8e4b7f9b18339a36d6f7a4fe7c35d39413
SHA51245fe59f784b81c2e74a814e80118b4ddaf8cfed1f04cbdebc47b118e9c824b9b2e54bd908550bee9a20e8528ba3cdc21ccbddb7fe5581c1807478a3188c3cdda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561bacfbaccb7da70ebde68de40ad4a30
SHA1a50e7637004cf0b6b05b663e2afab5cfac33995c
SHA2564cceea9419bc4f4fff3ef082451b229e9d2a86939ca3b06bb16faebc65dcd59c
SHA5123c8a9d593ad581775eed4ca6b8a850e08d943be6d6e70d599c3733e4a0ac4c9dc4b4a11b29ef6483acac6b022bcd6d5bca4bd10aa400f1c42f6d9df48f45d4b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58394c1ce81cca40cbd2fde64e8bd182c
SHA1ef39b78fe0f40a05ac929ac2b57b85b106e4ca86
SHA256d1bc6a31e3303a2fe79a905c8517d2eec80aea3fcfdec0d82b6ec5cb90cbbfbc
SHA512d25ac4ae5b2c167094b023b2a2b7358daf0927e8047f595714f84df883f0a3584f46f4437fe5cb61c35f1bececb02d29bff53bc29b46b511db942dcdaa3eed37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551bafe3eada4b38535bc8681f235dd7b
SHA12e0a6087e3efa51efc5bfe00b7f2f08b6615cde7
SHA256b059177d4be924f6bcd5abc05d70efb01c76e831edcc941539b38bfc95710acf
SHA51231d344c927fd94ef85f7596223b09c8ea9647e2b76a7da319f3b0d60027cfe6f12a92a1989b6e74ff72930f5cae8878c47604602ca1a08d48f2d0d03e28ac505
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a