Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:21
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
39KB
-
MD5
ef252d204748f0c0fecb351059f1b99c
-
SHA1
27c6b928c523a3df72be953dae0e210057ffd85b
-
SHA256
c0eec0569a74912263f3de802bb53e1b232b182d93c9b09b785f80a2a4444d25
-
SHA512
5797434ea6d6de9ae9a7f8debddeecfef43113cd806c8df4c6d5c6fcda52ee411a84efbe647468dacdf9be2485d1ad6c04da084bae754e9c5428def2e37478f4
-
SSDEEP
768:SXhj9RoJx/iUsTnDRnY6amBc3Z8vfb9+3khc6HJ+jE97PFwu+zQbfDGj+u+x6Z2a:SXh9ReNiUsZY6XBc3Z8vfb9+3khc6HJo
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa1d430c60636841bddacd95d569d3f800000000020000000000106600000001000020000000808c324b9f9b28675bccb23574a601f2e7de8a95652f9b97ae960dac336421a8000000000e80000000020000200000001eb8dd94049358828ad1360a86e727bb4e24a3f6dfd801662446b3e2088e18cc9000000003d289fcd8c754e6e9c723ec357d623012ea8baca86cc3d2f2d8cb341f3bd17434ffe9e8a17a1bc807fd2d7069dc5cab3f7ddd135c6fc5aa91f0bec86a239206c98a6aa41b3140ca4e9c5db292a590d210ff16d8674bf42fc246f92fd54948df499f8f4421fe064855cc86b324d549c0dd200b76c2559ebdb652543df0adf4a5cc1f83aea9c7185d649951b3ff29e10f400000009e0ef771335c7bd830286decb4f1ca9e5e3fd65276a1c448d9a163939eadead26f7170985f3d7f610738625e5a56820c7c138ab1f17d7658f8077c6489b1cd2a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571143" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fa1d430c60636841bddacd95d569d3f80000000002000000000010660000000100002000000063bb491ed4b0bd0bb634732cb8979c8c086f73b596f3987d19e6813f1dae6f60000000000e80000000020000200000000b726b06fb9b5aa90587f964d42f3e0dc5f51f8ec8f4cfbbdc7afb150490f0ae20000000349e44243f3cf55b05012f851768e5ea971aef7313a77fe376565ed2f0bbb0cd400000002e5bea226913b098e5d67c2b399c200d7a4af45c2ee8e47450412331ac95ec7b316d4cf6c7dd65b664526d19b14c668d8e8a4903803a593f91b6a8b2427a642a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4AD8B21-1878-11EF-9511-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2096d1eb85acda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1152 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1152 iexplore.exe 1152 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1152 wrote to memory of 2316 1152 iexplore.exe IEXPLORE.EXE PID 1152 wrote to memory of 2316 1152 iexplore.exe IEXPLORE.EXE PID 1152 wrote to memory of 2316 1152 iexplore.exe IEXPLORE.EXE PID 1152 wrote to memory of 2316 1152 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1152 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512dc81bbab9a780a987eed3c4d4bbd5f
SHA1c764a3c3b280eab7fb8192549990b96fd6bf6a63
SHA256788a8128356abc7760332430a34d0cbeb45a50ed93e48a45f083de240fcf26cb
SHA512a04e4cc41018ca006a7c4bb7b67c6bc3b0eefd67f401e95ce39f5a29bf2b1a785550cca4ba04e4d611e354023af66601d56872dbf708417db6d3d90c37408557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f10b83c139ffb71f9518b093d311d70e
SHA186a05ecd0585a2fe2626e339236f7ed56120315f
SHA2563e9006beefe5497bfab99340d1cf4a88b561a1a7f65beb9628357a1ff48689c5
SHA512fc1aba7812f76bf6909550e8659baeff2073373aabbcfbfd7860021b4e04b35af284ad726d2224cd69176821fe197d80515c9b01a0ffde13397e971276b6bad3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59441501fc5ad2fdd8953e4f9e5a67bd3
SHA163177b6b6e5799872c3c07493604df184390b919
SHA256bf524f40c26e5ad325ac66622ac5cb5482fbb1a7e7c7e36c38a4e66991934948
SHA51278571004ed6531e7984e4172d7ff03b17e92e4ac6c1d57a400cefdd5549b6954be05418f9846532d37c3229ddbebf0d4000ba0f891c430ca26cb6947816f26dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c84008d77ddf8cc27793979de889ec4
SHA14e10b55b250a84dc8987114824824539f2803772
SHA256cc47b22d68d7ab7502a894b1936625640b6568de362dfdde3571d689b6a9de25
SHA512d48c1a905cecc66108d961ff1bd48ef5e425fc04242da90d15fa86ac0f4b4e3b33a4038aece03c84a7a7847691fa4e707484d635e41c7ae6472769966a6dd325
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58473d3ea05dbf1dfb34a28089d99697f
SHA1c7ff87476d0dead3e9e0ac5e4db1d1ea18e32d44
SHA256dce5068afe8d25a68d9ad3852674c6f43ebb98472ab0aa1f3c603b5c8ee8eac0
SHA5124bd81f2396ad5fe91b98ce48d3ad1d31730d5d343816ef38f437426c325fcc15d3bbe4752a7439e61b8faee37c6d4b5bc54a75f8a59060ae7cadb6b547bb003e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585c653ada59c0d3eb7ee5d23aa430dd8
SHA1fcadb25698a5025c0f3922f41b31a96137475ea9
SHA256e4e04812119938c574612f3dfb928cf52fafdc7ba212d4050dd99aee4fa78998
SHA512dfebb7532c456b253b725ea8c469f2b48ae65688a50bb3e7317e44d732187fdb2d73124a7e17ec98d5ff538db805a1c4dda18ef4359ccb62b94e6a11ddcf2125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eb01b6783a332e7e52acab51aa30b1e
SHA10e69a60a30b84f6e460a91fdd6c8b7abb9ac0e5e
SHA25651a14f3f9179a40c0504fb6ab6fbe82c1caa0e7eb3b473bfb5c7535f4ed0b1ef
SHA512cf7bfe9f17d42b3062af75d62317f46e8b78d92edeb0fbc5dd5d1d9096e12e9bc5aed747735419a24ae08440e46c5d46c9bcabd3636ccd8f6b88a02f5b054e7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5899aad061cc672f286a71a7510a360
SHA183510cc5c41dd2fb4f636403986577b5ee534b68
SHA2564b3163b04d103b6106308bca3a75d8ebd6587a1f018a27499ef9fc6bc13fc265
SHA51270f5f12be68a5add9872ca27f2459575a6c183c6078ac045aa8fc5a6cce61f1be2b243e726c1dc827148397b469e7667a9215b469347919dc1ace6de998af912
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffadfd6cf8ada05e3d3fcd2d881e4e6d
SHA16babdf4cacd9fef5903033f55bcbcefe92fc68c9
SHA256d7423d98ff273132a0ab84eba06e67c805d51f47ad2107f4cbaacb22961222df
SHA5121095fcda66bae4813acd73367a6cdd0cd44e16cf55cc52726fa0daca8b57e2a6abe28d9f0aa128c170c61072b863cf93b563929f3e3cc505f39f12143491e155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5256c5c735dd223a698ab4df488f6b094
SHA1a6ce8ec0884cbfd581e82ce282289db0ea5e0edc
SHA256de3e5df7310598f171576c939e9bbdbd780dd172622324ef05ac0f00f53708fb
SHA512995e9b2f7f4bafcd4f992ab7a2614528d1ce2aa7be65c159c9ecc360384329cc2a3592fef059ed6999d33bf83b41440483ebdca494ff697efbbf8122b1d4cdfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555228b4a42a603f4225903a5bc0a38dc
SHA176a150bfe24aaedde243ec7fee2037bca729e8e1
SHA2562c58792225d0b51f1ce4f140b39e96406e223aad1a76138d8e60d0caa44375ed
SHA5126d848cee64d1d71b23a614acfe36341649ca4ce7f32b7ba9c23ffe4c849ef0253a0447f4735303c422bc296fe551bd31d41d6df284ec19b9a84001e4a94d94d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d67ddafd729c45613768567cacb8cb5a
SHA156c95f1e5971629b38c0c591cc5a7635455165ac
SHA2566f7fa0e4cbd93295834132e580baab5a2e430a9a18a8fd9f3d4d8ef963d9ee18
SHA512ed4235079274ed7cd41c6f28eb75c84297a7952ff8643970e0a3d773729d1c9346d86615d2c36ec9dd51cff24cfff6b873a9a6f1e25575c5389d0e449c941d77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55868634462b367e085c497da77ab8d70
SHA1073334fe6e80c2f1f7ef5bf6136ff866a1184ef3
SHA256025ba8db951a165a90c17b8a47b25dd0539bc18dc43223016d194294d2cba743
SHA51246972051ce5bfd1521ffaddb2f44048a8418403e5f7bc3d396c846a7314190eb1347ce4a4f875d8ae792ae2a24ca2f1a9c86093f5a724f4d9a367664736e329b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc98b5dd9187b33674104f8877705bd8
SHA19fd3c66b58fd7ceb3a7ea3fb0db23c02247201f9
SHA2569a1a152968ef4dfa2a2164238c40756be15b9307bb3691f176f93d604fa30b6b
SHA51284e87140d917b9355d8cb5c83376aab86f379414064a6da4d6d239ef1bba4a545b150dc75e98b055b92d8410365e19cb65835167a4bcb078b8216c8030f3cf77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5927718e51472288d676427efa68af939
SHA1146c996823422d19b6fd472f6accd6bce2d6ac24
SHA2560e967b0b7b8bd87f0475dd7120b0f90192badad2d6d91ae13015cee953ad0a6a
SHA5129de8e806e6e13073037fd24600718d125839f4c1c93ee5f2249db647b32966cd4043ec4a02283b61187927e8e2307a11b846be4016317dd346d3d0bb12ec0847
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a