Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 10:53
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
1e05e002d2c2484500113389f95e5d5d
-
SHA1
df6a974a852944403520836e191de3df4b185881
-
SHA256
41b1ec9fd455cfba2089e59fe3d8106ae8c6b8057b58a7ac6bde71ab61b1805e
-
SHA512
9ec03453219095be25ef342b43ffcb968b19faa5bb096ed32924f05fb11c21ec826b3510cd7cef55d7669ae96396844c77f4053c126815e472aec9ea445c57c3
-
SSDEEP
3072:SeXSlSreh0yfkMY+BES09JXAnyrZalI+YQ:SeXNrk5sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422623458" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e46b396006425a40a9440c093086a02100000000020000000000106600000001000020000000a067353398a5b85556e487def8301cb29ca7356a3efe1f34f13d67c9394cc829000000000e8000000002000020000000fc841d557792e3f3e767c6a13787a7f20cb8011764cb669ea3cdee1a10b996bc200000003b0297ff3f9fa5e54f844bf8c211baf4137bb36280ef75e54c02421ebddcb0054000000050fab74def2172c60a8860b4ebf15d45d9a670284ef528368a33c8d73cdbfaf3fb4313078d556aea28b3f09b7043251301d445a8d2d2887a99effd49a8538ea1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3EE7A11-18F2-11EF-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e46b396006425a40a9440c093086a021000000000200000000001066000000010000200000006c16d5f5a125f2ee22e0c6ca5902dee975ea08a070a774a56358976fb4e46344000000000e8000000002000020000000cd01ced898ea08d08ece888af0fbcbf643838a82137c6a974068f9bd280541c090000000ae63fe36f91556bb79a960bb0e6abfad96f787041a4c871fef9613dd6dfad8b88c729354e320b3df011962ae7cef789e415184938e14f6243572025855c9c63f2f03412de1c47221facbbc10b27c2b0ce008e9c4607af635e96a54aa8c52734bf9d2542e53e8f07f0afa3bae7f7444d823756454350adc2a139fd8e4ee0cf3a60535430d3c6394b669a93c828e75e76240000000b2c83f0689f14278119abb61d7db09b34b1eea25f2ae01af1a83b91153797be003e77b9a4899305ee7fd7b3d8f97888189c4d539efd8ba6647579fbcc76863a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605a81bdffacda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad4948e1ff474c9913fb46ceafade83f
SHA1457a44494136ae70960209deb4a10ee9cd0a5c2c
SHA256ff34caba18f273d87cb384c79aa8aadc40ebf8f45fd0517611e1d576b382ec05
SHA512e833742842bc634ae18e991323fe9d90a939748f09da78a75d64aa45ddeeb4b313bc67a580df5a1bb0a5f9ba69cd34d514c3ced9c633e606f450c05280279f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5351a9e770241e4bebb33a21c951afed0
SHA1b1dfb234cf6ceb2a61506f777815ed478160d362
SHA256bd362fdbef4c81f29ea961d107288c006e10085010ad316caa17d4f37ddf637f
SHA5121a3bc069ab9f3af055000255d3e90ec9e10b8882adf072a307d37725dded080e27b2ab90ec2ba6dfdc7cd34d440bbf1f956a06f5c3434b480ab4620d329caeec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525523e0cd0c1c8532a82e2ffa6a9a6b3
SHA11857242c2efcc53d86e2331535d6fd881f93fbea
SHA256019b7957d9d92111a049759d1cac36fc6ee0696c9bafa4353599fa4de426f197
SHA512218485e2336dacb521c8c0ea40cc558fa0c43ec24fba94721a47c2e008a55923acccf06e8454a98e843b96a90488fab57e01e5e704c3b8f98dabb3ea5d4a5771
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a8280e130048ba547e88b6b2ea25a66
SHA14b09cb762f1200e1587ea565719d2b63d8c67b66
SHA25668b59b1dccb80d4192d3abce68b4c58d1743c8cf3f440220418ca82cd456d303
SHA512403e557a2c5c2ebb5a5b6435d5deb47296a96e448a37510faba5f5baec455e22383529ce0b6c2578b515e1d4fd0ef91618db3a5e731c9cc2b0e82c0a1d392382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1c0cee23bf3c7847895f430806110d9
SHA1eb6aa781efc0bff7dcd2cf3b250c9358886c5630
SHA25688c8b29853222fa7bd4e3b82a1d61287e17779677661ad35ec6231618cada930
SHA51255991190bbcc27c50488b854b8570880dbbe4c66ba46843617273cf6769f0b617ea83cd0f5566af5183d33e1f310e6383b65083065f4fe3195e5cf21cbc783f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5c07c0d47374a63851b1ec9b3dc582
SHA1aa311c828b74f6e48f4faa97773c21d7ec0e0ffc
SHA2563b7a1d4c777f42261dd1ff96fa032ef67d765f09cd507eb5f2f531ed9907acec
SHA512e4c6968836fb94a2e79691b99c72c6bf33ba09274416046693059dee7fe49480122d559bc4b368cc65638bcadb81edf59138b7289ac7958f56e40d7f6b0fb6f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cf1fa0304b2a5b432722edaeeed16b9
SHA16f98793e3970a8d3cfc5a3b4d9dfe0cd0e6eaa93
SHA256aca4076a77e89ebcdb4b7c9a71d1f847b2766ed28f9159b7c4866e1461fe960f
SHA5124dbe2c3851d0511163aef3ef2f70a31dc57e51ca2b7cdbaf846867612a967ea876a4b6120dac1167b3c6c53b6c785703675ed34d04a4632c11701fbf96dae508
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f972684b29e4a436293538d716709c7f
SHA18d588c06cc2ff7461de0595aaf171893082011a6
SHA256fc1a6a672d2f6ceeddf9067b6cf4c1b850e4dcfe1d5523f0808e51b9547d4cff
SHA51216ae9ba99104394134f8a26048d523b2e1b1ec1a496bc19758ffb2d9e732187ebaaa4882433177c949062fed15b3a1b40a1a0418943482e7839c6e9836d54c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5553fa16f717f1b823e45debc3d95cd50
SHA1b87a3f10ba83780685bc55ccd66622aabc331766
SHA25608982239ecbfbec3736f0096bf7dbc845f58fa6ca785f84c613613f85253cac5
SHA5121d0075527161d3e7ab729d9f02589e2cbbaceb3e19e8c35d800fa0ec3d778ec00428de2237818634b07c72f7fff169ea14007b3b839e9cbf62417f2c0943d129
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c56a5380db1d704a9b7ff5c35ece193
SHA184f65c0578611282cab060b9322e73b60d743ffc
SHA256a02e6f6b106335ee64551427cbbbf13685bae963b7a3a23aad71d099f6d720bd
SHA5129341d51075f93167708b7dbeb80ac8264afe58a388c501c061992746b2c3ddf6462d654d7980f37eb70b0ec0acc397630aba164a2cc5be66abde575385980d12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a41917529a085e51269ba547b4b0ff09
SHA1a6686df5fcdade9fb060907b571fe552fdeaf9df
SHA2567df64a47e6a76a1bb6a9ab0c76ce54d597d5f57678bd826acafc518c61ffc768
SHA5128ec2dcfb6d48d39eb278404e0ad321cc25a3f817b5ab0f8362ebbae89c62593714d41d98ab8eb21133cccc14e225c6acf95960def4dde8da88f345c85f65cfed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd98fa8c978c0e1f0de84f92a4241957
SHA170239861a13a9ee5e68eac2d6063dd2e9061b024
SHA25607f56dd3e3cec411db1e6e5a44889db6ae814e5e38e4fbb4f4af19416a358315
SHA5129ba3102e4bd6874d152786b97429d88dd9fdd134459cfcb2b25f31dc62cb4e0e830176fc6f6adfea472b2b7d8a190ba366ac0b6eeaa16e4afd850750b778ce10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a7b546f94714d4375fd64df0b1c45c
SHA1b9ebd2cae26c7de95a17e2b64113fd80f4e92ce4
SHA256bf35686645f75bb9f99e61458ebe9459b195ce79d3c04d28cec42f9c6ca131ef
SHA512b0ea473123383a1d1b2f4d3390c250f004904760467c45c9c513bb6cb8a00addd4663eee21703c043e3678cdd8e1c0871f15e26a2ffaac7e2957db9815c00cb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a704a5f349d119f43bdeb778254d25a3
SHA1c18731507fbd3452d095b1a7ce3b91a93a7c77fb
SHA256cc91f45eb78724f07d807fcf71f01880c389bf1d43bc79708a51b9e8de0cc6cf
SHA5123ec393a25330b26d9be1a6656e01a4d1f5054bf8a48ae920721b2645a9ef9d42a9c0056cd79ba5968f7b60f97859969b807d9ae0d8c0a8c221d06a7e87172062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7df1b3f641499bd11538d675c9c102e
SHA1359cbb2b49790c4033369a6e66edacf3fadc542d
SHA2560f0ee409c2c8d6564bbf97a18bb702d11a2e7fed5a3bfabc4b4efec4ec75c48f
SHA51281e0f3cd868d0d05c09854256b8ffa5297c6641a34294e603131a31cd7f221438e4a03bd1b0c8a91c1936d39708b26c7bac86c7f315661c22537b85d4841c2d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508210843e8f5274bbdeac1c8e275ebd9
SHA1dc334c0d61213bde046dd084b223b939d815b049
SHA256bef3b0502e180e1705402e4e2cce07980530755d7db0b3a868d54b05148568b3
SHA512afa50b0b575514a4c714ff97e848036158749ff4f2723c50c5f16c603275bfb29bd85d9a57eb7a440cbae6398b17182eada7683c5603a362f357ada14355487e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5906e95d0ddf52892bd24896eee603257
SHA1c9459c690c775a999efc3aebb2e38eb4cdf41563
SHA256118c0ec5dbe6eb342b230708f50ae76de742ea7910ee87a7a37cb1428fc8fe7e
SHA512f9564d15e130346a05d2cd88c997f87e90f267317617fc59f123530b203cff3f8fb2818306f771f3a967ea4ccddcef1769942640805a7599644ce8352d12f5ea
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a