Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 19:08
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
be34a592b5ab9acaa114405313fff8b7
-
SHA1
737226fc83f590307f56d6cbde8eb98dbbd97d70
-
SHA256
322bfee369c966a68dc34ae557d88026998dc0e1a6ad4d4d86b82d9485109d26
-
SHA512
d9da192159760ce0110d391cc6ac28d2fba15a99bfcb5f460484fca9b3c9f2e353657900e72223f26c03369d9b11022c05950735543db97dce9c1252782570e6
-
SSDEEP
3072:SdDAl+lLwqpyfkMY+BES09JXAnyrZalI+YQ:SdjTMsMYod+X3oI+YQ
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422566764" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A41D3F01-186E-11EF-8706-CEEE273A2359} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2168 iexplore.exe 2168 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2168 wrote to memory of 2088 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2088 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2088 2168 iexplore.exe IEXPLORE.EXE PID 2168 wrote to memory of 2088 2168 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e87cfa3fc20fa16043463f374d2c9c06
SHA1852f0ab6ae93a7fc36a6d8d9148d314eebef2c2f
SHA2569046ed8fb1133c5993829d0f3637c09fe09237e71a2a64b5833c33a59cda89e8
SHA512b3b640bc98ea5f17dd0d6ca015ddb4ad14d7d4d23c9822dec01c74ae8dff32d4b74b6defdab30ac0bba032683730f7b2d73f1ef7e1e698e44b305e4484c113b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bc06e2148f92670ea2b2865fc0f128a
SHA188a24e36c85a944f58b378cfa465e5d82cb11f8f
SHA25604de91f5eb93cba39cf4bd2f35d146dd3bc005a9b54b078fe1ec2235cdde89af
SHA5123e8091e2b6c7df33627173a8966017a8bfd38ae347342d6e733314241a45c46c0284669a4090155119ea199e886bb6bcb5204dcd74ca38ce351c44a9431e507e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfbfdc4542d4ebca120bb7ba84657538
SHA18905a8f577399d0ff14877182c4eb231fad8856c
SHA256849a909290c3c7fb276292675d748e8dfae64ece25c75301a1472de015c00170
SHA5121b81e3d9aa249bd95a7c28a806de125b1c888b44a291911527d1e5dbe0bcee814b27fc5969229d9641af7cc3f80e1f68226245bc193ee01ac4d04509acc5809c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52797c3168bb6f3c0bbe83a3e4a5eddd9
SHA16b7e8cc36befead277fdc94f1952553fbc4e4ba6
SHA2569d7ea1a7d2e53859bc403b018f3fe44ac3d8b9cc23a87964c5c409f9733fa73e
SHA512bb3de21849542cecf6972f0767161a6fc460e1a03890be67937ef66dad26b11b548f81bb272ff7db774aa371a403acaec4c8759c141dd8ea54dd53037f9386e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f56e903a4f15cdc149be1438e2891a63
SHA1520c2e7f2b4415d0bfa7936d7ec42ed140501764
SHA256896798a031618ead3e01fc772fc36cd4bbb624663184a9475318df7972afdcde
SHA512cb91559ef69187a0975d041f5b035a0811a047a6e2125d1e6e50752bd663742a8d9b286869a8e429bee6f1c4616e2bf2b561be15da96eb251b1d797a2db51d0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d29a80f0bb98defa4ba45b51ed7d889e
SHA153005d577a5a67e4146804fae164f4cadfb49cea
SHA2567b699666c366c4b4ecad11b627b6d270e60adfc737653a8b97c81f97f6ddfc96
SHA512b046aa5cf8538197ed8dd41ef861992602f0b85292182eb57f7e931e9b57bc14d1423fdb20ab76b1bdf981cb7f5feb72672e42e62222376a0fe035d605048283
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0e6765e7355e9344715f4035079326a
SHA121a5f8d546767fe8778ebb11cec4f40d9a3f8eca
SHA25600869a45f536e75d7539eb011b5b044c1b9a425ba9a374756794cbb58460e140
SHA51220acd681fc1acd72c7e3b6b39a6590ed2879a689fb9dd75ca5a46ca2c0f2303073c22f3d5602cab3da5376ba718da10f6150f5450113c45c2772b1e926be0e38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce0a40d769a0aaf836dcb35ffaa8fce1
SHA112e83d7a313cc9f1e1f5096eb2fa44e7f4c01eeb
SHA2560a4542130d39f4d01fea9d7733086e1045874ecfae6a2d5ea95ae60ab80ea4f8
SHA5128a30c1146e6d07cfd501e634fc93ea61e0a8e897cc570d1ee0902b7bf2721820c9a5b56c64bcf83b1622bee11949e27d650dee61764716e0f4ac86702654f0b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0f86419f2ce28d5ac0431de81e1f118
SHA11c6affafbd9ae6ec1c284ca66facfd37d083c4ff
SHA256f2bb027d3dcd2dbe90d2ddd1700ec9a142e3cb3f522cbf8ed07576d06d720c49
SHA51220d38c48f77784f1b18aa9353d5c85567e755ad0695e172bd4fca91f7e13833bf84700dc77a505f3ad8da08603f45e70ed99467c64d6c5aacc527eedf4bd81b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568cdf6ce4c8c7bc1c1c71b9e241f214b
SHA140a4308866d4aa895fce1aac7bfd769c5ef66a99
SHA2565e83046052380f57c61c6da9edc458e93f0c2049ffb578d89aec15b2e6751b0e
SHA5128c1d2463362a96f24c51f08a8ca799b988e9585e1a93b35834ab496543f1f8a137980a8ba1a2a354bc1ddab717a5cbc6f36fad80e60d59e6a5b67d6f2dcd2024
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5051b8240d6b503ff168c448a89fc0b52
SHA13015e1bb25cb6d4f0c670bec1249c61e2027f638
SHA256e7975d2ccc2b17282ea989027c3368e91482522685a90b7ab49db91a4fd2e38a
SHA512914b60a65c4149fee5d84d603d2d4fd4ce405d7466f363cc68aee2d842fba040a6ce65530fb1f0d1257d30f19c68acb4a5c05f37b2349e004599e91c8748b68f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff2882e760739b8ff2d080aa3189c176
SHA150046db587e1883a2c84e06bdeded8d61b78ce20
SHA2560a573eb7b5912a05334edf502a7d1a682ab1ffc7d4d1de7be3ae53c3b8c10c4d
SHA5125f72ff1af33fa5b519a897769a2c50ac31b2ecf2ce32745450e3c18f0676ed8632826d3605c1bb1b0bb402957b68c6f4effc7a6f0ec09a89b9fbd05eb92c9a5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5980fd5770a8bef214f88ff84f34dbe52
SHA11b32d0731654f0b0869119fd5066d1b60b3e41bf
SHA25686da1a017ab2e7fc8590ffb35069685bd393c865d2381b5d338dca5b9fe62a7d
SHA512d74ab6bbc6f9f50d21f4fbd679ec41ffd7d56063cc30d03f21cf915840c3c8ec23e0bc9fdf9a31d1824f25323d5413c2400a41507e6634415cf1675e3fe9a560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bf524e9b414dcfdb57af9a1d49286ce
SHA16615b70acb06a5ba53a25ec432a823b3abbed257
SHA256d800bb94d69a78df580ad58c5df5edef8141c59779cfebd0df7e2dca117c255a
SHA512f2485bb11128e5dbf5129580252f905bc85c93f9901bcf9841efb95f7941fef0529b5b3a18f53d6a015e8ffa007210f7fda9c060a34f2cefa2769b2f934e8bb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55377ce9c076dd7d835491a2b0bac543b
SHA17e67c3001c05ee39b49e97a0fdbd2caf1fc9b607
SHA25694ce4a0fa90b83717c5173675729893bf117f6d81c7c64806650d942b24d7ace
SHA512862dc3e59085ca2c8e883acdd4aa16d340d53fd48c0ff9c39fd16fb56a0110cc2bb31953b4b2045e3ddc77bc09a28065b55d9b2e15f1c8367e24deb3e5bece18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdc820ba1f75a63e60caf03090633bb1
SHA1db355fe3d5dff3dbcda10e7655b75bbb49a67b91
SHA256ab62604530d3665793489f62487f8bcb3d53928a0fe00ec56d045500d2114531
SHA5127f7a09b406b46b802d12a927a656a124b404f597259a098ed9ffb0b75641eef54b678511cf71cc23464f6e9375bf873db213fc66ddeb90236abe1df3876cc4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a006fd53f1d8ff5626e90b319a50a9
SHA16063628330410530d7f4b86cf1be24c9ceffa128
SHA256c0879a3782cb51c92083f1e8a54984fea2dedd4bf78bf3a0f20f98b92dc6993f
SHA51217c3bb21eb0dbfc97507a0f11c3c0965778c26f759fcce490f61441d7a353fd09339a14b967dc390807aa4fdc952e269d969a8309bc5534ef094ff617f813e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b35998631d289c95b6d0dcc4e9a5d4f
SHA1052f009ee0e070ce8ad1660eb7ae1cd8b7f33e56
SHA2565a717f6e0aac581c28aea0ae850dfa3603aa45c5e32456756f27567b91ff7a6c
SHA512a3f4ce5d94f083a6934a5fb12e773484e9f30aac8c5ad35304cbf247b3926457e296c7caa90cc8c98f2ebc57262130796592833f364cbe49593c2cf57fc94d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57de1568cac69c92d324701fede79a44d
SHA12df443d6b6058bd3cca9be4a2e19715e2e202e26
SHA2569d9dcf804a88f1fc7fecb98f7c185fcf2bc1de8dba135dd69c26a9394a9ae1eb
SHA51258e1d331c0e29f7d22595af2faca92f4b2074ee09b5f224344c8f9f3ee3e30c77163ca353d24958190fafebb1d222d74dc455397399da40872b401abe6220976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5067f92dc3a60d44b0e9645cac65893
SHA10b73b08e39af4fe86c07d168a8710ab3d5327acc
SHA2569025c2c57a76b03eeb8fa288f3575fbf901ae49c5cc9ffdc2ab2ad4272492ee0
SHA51248f0a961ee378a324348832c659e3c421cc038236568de11c8bfd3d3cbe1ca2c9da24f9f92f55afeff6d5fa84fac77f8b8eb2d3230420290921325c77466a47a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a