Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
HMacSha1.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
HMacSha1.html
Resource
win10v2004-20240508-en
General
-
Target
HMacSha1.html
-
Size
4KB
-
MD5
16166ec0eb8678123d392335cce8f805
-
SHA1
64e5d3c2266ad717e0565550a5977fc1498227e0
-
SHA256
785a864e532a576eaeed8f7d50d7ff33e5f7fed4d956e97d655a91a7b20f2466
-
SHA512
33f653d567750aae48bcdacac624c89959b5957a0191873205b2da9f1d2818ae523cfa005dc7e9c5bc0e324bfb4e5c7e7792b5f831fc3d719f12a51453c13d34
-
SSDEEP
96:ovTJBHBJDJgJLJpcJhCJz+aCJzkvJd1JzUJcJzLJgMp4GGwDHKZCFREyRUswyL:ovFNVM9OAOUdDs4J3puonp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B0E69C1-1A8F-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002ef0887d2bb3c3a8091fd05d548ab926fc095a98c472d91a5e5df5642d64584d000000000e8000000002000020000000b797564be25cd8995f5b635570ffd8aafefe1f50868e4b15dd7cca16833689c29000000081c64615b1cf38ab784758be3a755e95f7dbd0a7bb7b7b18d2e1e29faeb8ea427d82233cc5ea9c36772d2beb717a38bf3f74909d93ab6e890680841759aa9207daf4abb0dd85178765e7ec0b9e460aae7c43c491174beba02a44fde8907aa97411c4473b2aec213ccee5c7703eb22873ae4addde7e63a9644787ae391db58c67031fbe4adebc1a45b4617f29d294f8254000000088a88309eea016b1a0bf8a9dc5bfaa4023128774b91315537060cdf7cc38907a3003dd979e40f0b237106201fbb4be4014e821c87ebcac12253459e4cc2994d6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422800689" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07f981f9caeda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000002395c6ccabba02a248d567700f3cee2ceb6c3a0855b1fb43db116f7f42c112eb000000000e8000000002000020000000ddb6d5516c39399cd290c2154ad9d304807fe189084e5b4aff1c7329464afc4520000000162540609266961738388528e959f39f0836eb4450aba3f7de5332404fb3769240000000d240cffec65964fdde2fec8b7e851a0825b16972f3f6b2b9c8610d32f77631df55822515770c25b8a74882ce9cfead21c3b28e6b595667f2cbd443ddb02cc3d2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 iexplore.exe 2052 iexplore.exe 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE 2604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2604 2052 iexplore.exe 28 PID 2052 wrote to memory of 2604 2052 iexplore.exe 28 PID 2052 wrote to memory of 2604 2052 iexplore.exe 28 PID 2052 wrote to memory of 2604 2052 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\HMacSha1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2604
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520c71e211c9829e291c01a0a2a0831f7
SHA155db4cfdc412c5edfc996905260ab472d743bcdd
SHA25669e080e46dab18e5d95504b37ada64d874ef0e389bc275aeaeb1fa90ce059450
SHA512a72994c0452c3f576e6ddaaa728fd1cb553bdd082a7f701075d4f02b4af99af4c83def0d6130ceb72802bb00bfcfc8c699ba4018090bfcf1ce4f4d34f0080470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8a704ca98f739baed58a4dff9851b40
SHA106a82c3a50a371c55dbdd9daa5c118056927276a
SHA256198653874353d3e4f2b5d6598d6a0f2f4a43c2d56f61051513d80193bf77d4b5
SHA5124c1142560e7b61b1742fefcc6010ed595354e758c8ed072940adeed6faf73f9ca492f5fd4c61bbfba578cc0f583b861996b867ad0761f7eabc609d0035bc1961
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d6ebf2b2739405dbd9c22e1831fad9e
SHA1271053126a3d8c555078a9c196e9ac0938b4c083
SHA2566abda8421b60c254f4227686ce3d0132ba574d3774304e192cb4041566d1a462
SHA512070b03ba1816bb980e8e176c6c2ed4ed473c458695cf1de8d3872a468c8001855e3d5a4fbe3d8fe4d65252cd85754a75183eba938d61111e9daa9620f5569b6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5436118380870416cd72e5d345e19a695
SHA1e70d8dbd12e6765e16347a51d9187643c210cc7c
SHA2568b52d0ec9019b90074060eb0bb036b1ed97ce8a079fd480de60969870039db27
SHA5120fe8ba0093e42edb05d66aad869127361a98e2ccc3da2d40834ffe58ef2bc06d83c89261aa53d0f425a665b48de351359cbdbf98207e2dc72712025acba83f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f706f95bbe3b716a309e7976313d3d78
SHA1c4d67c1d78e9b9e68f952f69ab55397663475445
SHA2563afd90615ade237ab938675c6edd7e18f592ef5c88c1bae1de1ac55670ec637e
SHA51232f681693a3c3dcbbfc22e2c4572726d145f3eff1fe81cc85d68ddf6aed25b63c9110481e803678095f2b77c4e13231310b314f72f18d6adc2fc7aec1120b4b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed8d37337ff89445ac27a2f1ea044d2b
SHA1e6e32054d6e176309dd98c787e83dc4c7fe66290
SHA2562d146a36f90eec511e59c2fe293ef1697c314038314f8b20bc1a590c71761ac5
SHA512095b2134956c7dccbc62bba76bb23fc783d1bea70663e518f076038080ba8a2841b93bb8ff4582a57496a569b2a42cec37e841b221a2c3d467d86ee87f6bd9ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb79034c7a09698dbf6163cb581f4998
SHA15922c131f40f10a697fe34c767db9c1bec452c76
SHA25644168c07ce27edc0402e6dd2206e3ddcdcec293c307977b41d2695958cbeb56f
SHA512f2f4f40b60f3f6392baa3316b06033db307a2f84460c37dc4a530a73cc200c496b7fc699a14864969e55ce88a37110bae5483e3766306884d6904b9e10b7ad75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51675d0cc5195caff14e0776ef7db6ef6
SHA1de8b2db6a741e4797f6277f54125129720f72912
SHA256dbfc2c688d852577412c2b947899c15c9655c5f6b7a4dd229eee6a9205c027c1
SHA512b42cb5e9d2866cf5c0502fb7b17fa2882473043147d2ecfd83754296ca25fb9e065e6d7ec6da151742a986e9c0eb36b7378b2aff757bc1d85fc5991dbc580648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585d1bf611e64cbdf7cbb4beed988715e
SHA13189277a0b7f78272134e317da38262eb04692f0
SHA256f255082ffaf405ac4f502aeac8db489fd98c3822a0c2226c56708baa0e551a6a
SHA51296ba212a3c10b45a4860e75c15093ea219523a5b36815c9cc18e13810f5a97e66712ce0a837d2f08825bd8323351678ff202ba7712636251de50d710464cd8c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54570e54565bd99e971edfbf0b1a34799
SHA1c2819f34d837c292ac9fecde0acb856d920920f8
SHA2564fedb3ef2cc530d4cd6818aaf1cd1be6d9be03a5b104458328b8a7e137d2096a
SHA5128a528e802482e9fe6d3af0e0b306c02e0353edea667738472f160c957b30fa3364a6c1046abbdd50fbfc7b9aed3ae4a7d2e2787d7c2a1a02fe70af199d204bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe0604f6de0db3e4defaeb914a86684a
SHA1173a0da3e695f3937a6e5403de32ca951d8213c4
SHA256139c131076013d0e4cef30b763094a7c9eb362c7f16d80cc81f5237776eded0c
SHA512f16c8c8659452721a356f8ae929587ab171319420fa0607d14582872fe209307330d53c10f029c071b88d71969f3ba6d1a3bc19ec28eeb1baa71e4fc8c6050ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1c1e80fb40e29ac45238b1747651b05
SHA10ef04c39eab068b8e6a94eccaee223ec1ac9e6e2
SHA256314f512c4ee0d869385a38bdfd198a5d0858077e7d13882268e805d66e9fd6df
SHA512ce5eb235943a9ccd12cd50f735b7b3532c5f194d93dc6ae1fe1bdfe056375148be6d7c0bc9bab582f0e455d2feb0cc7d957e95b7056f95d4afd0173870e68405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5957c49be2873bc0ccff9d60c4db8d7ec
SHA15e5361dc5ec8d6a8594a0bb5489e6a5c2295c21c
SHA2560221fd406c4466bb1c68ab8bd1d9dd7974e892f26082345af628d4c9286acf23
SHA512b695910a1e3328c7eb92bfe3b45b6a000bf4a677c7d86f654a042cecc07da103b982b87770ac509d340d4cf21fce83589202455b0f2dbff4d0e79795a56ee44d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577bed1e2fd8dfa0a6097aa4811bbe6e8
SHA1569703a7023458f628a277f50c3032a8cf5341fa
SHA25610213e09b67da51883099f3b9f4711d93b298a4199ecc86599cfd447eb8d52d2
SHA512591779a4956e656920c86ee4a8ee49ef176d0721ac7dd08153f93ff74f76df1aeb3f37b9caf6221201b32e63d7935c3488cb0bac3bfd4c28fc001f3db1af4802
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb3c407cc1512795c23fe1b72c575f0e
SHA1ef61c755fd1bc08e4924e39964ca0feebbd18fe3
SHA25663d7d01c4eed7ac3b4d74c68d19a23c63fe437f03d6fcf2285051eb47ebc86c0
SHA512758ddfb96eb6d6110cd78a932ccdf5976b455281a513893d0367f12944c6c16d906921e478000c3f6dadb12ec7c70e4e9e7e78999f2ed2cc4656686e14fb59ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5199f4cd35857876ecfccc127042437
SHA19a448975dfb5298e750cd8b4452d2aae6bda33aa
SHA2566f0ffbdfca0c1ae143b894b88b5cec3ab2213d31c5050ac5cce91738589f3f07
SHA512dae8e88eaee9037387690fb9112484ac01528b92b3d683fdc45139bc11b578be3c3946568c383a120fe458c8ef6bb815217c530d0b7e61724074cdee52856dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea96d1744fa652c687eca020e946fa4f
SHA16cebdd19f1bcf97c7556fb370dc568b3aa821f0e
SHA2561b2ed85bbc4880a2c3e84b542afec8a3c6a5cd375f061b9d0d08f95514523e9d
SHA512085eb6019047df1cd8677d80a3553a8f09def09fca2a52f8c0521c7f4c4e976f391944b114ebb75e31d31d81623b0ec85f121d2835b95303a0215f539c8c4da1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ae93fc446131645a34ff5545e8a298c
SHA13734fa4b914feb5fc0ebb04b5ac26387ec581012
SHA2568ee836354386eeeecd35707c827d72c06fa7e5e5f72dd5a9198e38a75acf4909
SHA51296d0779dd414038111cde1d399424ff4b0345e71e5e8783b1612ee321916edf204e72f00d813636d4b1c87109363fc7b8f1f2e5482fa6476fcafbb014e230340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5160d581ba3d21c27082b231fcebf1e47
SHA181991d595499e06205c5e4ed635788db6160743e
SHA256fc51fde717d3afa78e63682d3be01c95e55621cee2634e5410a3641e13029ca6
SHA512e94af400a678912c95676acb5deddfff64bcd23ab43b2e84daeffb40af5dafc025853b680f22df5dee6d1e3da16712c3c5d6d0377ae12efbefdb709f8f8405c2
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a