Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
5d24f153770dc59a2718fe3232dc81ce
-
SHA1
6a89e82ad2e23bf7e3513a33bf221a72c8db2817
-
SHA256
06cd0f8ff4a56bacd24e4a1af8e25e0e105a5b6a2e7cd6c53a46e9161585af99
-
SHA512
3f603557a7855998c333f8896427aed7559bbf1b7e577c97bf09cd4565d1dee380a021c33639d2a209ed04742ca2ffb615098fe844a20a7d1eec8dbd9d601986
-
SSDEEP
3072:SxV6b/RkxgnlyfkMY+BES09JXAnyrZalI+YQ:SxV67RscQsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a973c1e0edcd214dbc1775fc41228b1f00000000020000000000106600000001000020000000a86523acad37a27bde683c68aa86ee1c73b4b70d00210ffcb15848779f5a7dbd000000000e8000000002000020000000cb45d81335b1fcbb8d02f49b12bdef80bf1bae69e53d9a7ba6395f7826d817e82000000089ea3834b5cb223df2a958d9894ba36a3552f14e29e63ec4432393d7812bc0a940000000bed43859fffcd7d8ff62d417781bfafc77d4b13b42dab313bd3469a8d00d26028e7861ff773ec1c0a3ea65ce7b430615a63c39c8704d88e063829a40225080e5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f3dfdd35afda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a973c1e0edcd214dbc1775fc41228b1f0000000002000000000010660000000100002000000042a5c0e2b696d87de07c3ec6a44da5474c20f6d36f7823c4e3d9c1daefcf309f000000000e8000000002000020000000c90ffc63b6d903e8637c0bfe3ce3ac8fec64e75aa87e880770bb735adc3561fd90000000d62a5ab37c8cc5dad454670d0ed5522584ffcc202db5974ef3f73d0c6f2dc4d49d3bcd29cb61b9f059b796f6272cf135adf3bea3a1e5b117b3b7b78c65a4f91e4123032951551bcf3928f9a286e6b415d828a654d77f768b443371683bbb7bc89fc7e2f0e3853e6a6d7d47a5ebec26b9c51f6f35751b4f9e288432ff38edd45d28e82fb2a2f3f28c57ef5f112111dfe840000000a3b563f5112b9bc0aa405aac92e6adc2a23509b04f06f17fd99777604c4f2e7bccb31aa96a398006729c34f6ed99ba72ab5d8ae335d063d82698fad280afd51e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422866608" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C5D05F81-1B28-11EF-995F-5A791E92BC44} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51411f78863e387156a1fd3bd54a8b8a6
SHA142faf66910d194e13efb09784bafc2742f8572de
SHA2568f64281f37ed59d7c707a9a07afd7a368837910fd632383a35a79ef140694346
SHA5128930db94cfb2c11e552d081637b56c867fa7f98b361f9787e579a0ee120a65c381411b4b7cace7bc349d415b93a19e51c9f10cbbdc738341dd4403782b7e46b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519aadee0cf57da4242163b454d6a69af
SHA1edeb57f67292006306058864b23788f2c528533c
SHA2565ca990a643044c3c39097211edb2848b148ba63833b2a9e7e1adfaba1cca6dc3
SHA512fada549fbc6d08fad9f05d891c242bcf584816998b1af165e1eb700e210b6a43b4f063ee31b14931d090118ba4e6ab2585cb61e60ef1aed4cfc0a50779ab6740
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bba0a511408984c64c578343e2b6f3a9
SHA11067a23a970e83cb19ee31f143f027bac791e5cf
SHA256d522d4adfc71d146ded28fa1140459f37b6494122f04aa5e79c405e62a3ec993
SHA512acee8aceb718d395826ac4c7519f36076de7f87b74a64b2785e957bbdafb118e2432eb200cb0ce2b2d154a618a28b52fd05c314ba0d5616dbf5334021aee0d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8ca9ba3e95d6579af88df0cb893d287
SHA16a114de58056e411431a2aa0f4789330ae16be15
SHA256338ebc772b1b3da2f88df867d3cd93aacb9664bc13bb14c77202b294ffcb366a
SHA51257d46f3d04aaa93db4e2366eeae8f10b6e1c4790087d62b97a25162e10dfb5e66a30206da403f8e79712dff92d3afff8f1959e6fa43e470b77378c3a0982c5f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b52b5a5b53805b820efe26bb6b558f75
SHA10d6ec7a044b52a822df84ca6ba9693756495f55a
SHA2569361432399fb0ac9f39c792e6838654ef0eb7da13f86f180c6839291f0e3d003
SHA5128f036b8e8f8870edff272b0b0b0c1113bac36018f24f29b4e67d7e6eee97d9e8c049395d0f40c5f26a8db1a3931652b63b5498f6465fb569eb251e3071b6d5b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cf470b150494222fe2a53cbfbe86495
SHA1e464d95ff72a043259a743ebe84f1ad4ee89dfe0
SHA2561cb95ac1b9de5510fd29be0c6e362040613a258798343912fb19b610b565ca9d
SHA512b3eac1acc9f5ee1d7a21188b02d4ce791debb3e3239ba3a60142376563e62939bdba817f21fb394020ac0b318e25ea5873b09dc87b03adf76f024fdcdfca9601
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5477f09e591ad72e8b2fd75799a87fb6a
SHA15eef27aa89c88a26a3ddd7f6b6329de6245a3e0e
SHA2567882102c8f8c65e79b4cffbead564ca086e8d67bec65d115877089bae625251d
SHA512c9ea54c8b776b7efd61d4b75ea8ef35260887dfebe370c55b746961ca774e6bea8c8bf2c12ab842d31a71d1c5e60a01ebf2b5c0fafa4c3ef64d588d5a3305482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5427ec9a6016615dfcef69f4078e6cbd1
SHA161d6054d696f17bc6f4ec29a7b338cf974f8111f
SHA2566e61f02e70ac798c2e7de6feabfac306018c787cae6fa2b8b889f30f90dacafb
SHA5126d854621b95306e47e0c406f60dd0c735e1018b3bf96808d5d09712300180eb3468965d93a758a5499117e003fc6a4ae2b9cfaabea5d607f2850058ac301e22d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5538467cc66002d970031f5eb570e6b77
SHA1bd351f376d9e01023183677cfbe0ae2af3d12633
SHA256ab40b02dd5fa3e599781ac8ab427c43527f4252779b49c0a4431a5c859b1c19c
SHA5123dce0b43574b80da4f1eea89bff6de30dc5364b450aacbbd3bfce7a74e87dd48757a67e72212300b1694d60294ffbdc2b263665efce6ce007cf650eb3be75f67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c0f97b16bd3ca358a29f63a061a66a1
SHA14434d9891620bee91ca2190bb904df8ee392dea7
SHA2562a82cb6e27f04a1cf53edd7a9773c1949f80d9e0ff3536396988b44dcd31428b
SHA512bd7a2b49153deb91e27f0429a4a7e848f24daf79f29501fef9d04d61ea58582d1578cd395b8bdce2f27a47be81162cb3bdf4db7569c55d669bcd0c51c84bdf1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592deaa8e29bfbb95d3fc70e55bf4d99f
SHA10bb80ec54b4f1f0e58593464a6346e06b6ee52fb
SHA256d53eb16e66f0a5806743a3c979824b6b65322ead730040d9f18367c922ec6e2e
SHA5124243d86772b0134eaebc11e25d4ec2357f14c96df31d6e56cfa7fc8e4c343756dd3e5b472e9064bc956aaacc32ce80e664873390b7b8d79bcaec1085f1b1a46b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5636f3ec0a822e804710e8b5f916d82b5
SHA174a8e1b8e5dd9d57a5f736cf88f71cb74ae7e70e
SHA256f1e09618f25af1c34896ddd57c6e1f35f741b8167f4abc925c257d46b3819451
SHA512d6686ddd1b757bcc0a73514474010c5ad5c04dab835e46e390d04dc6c6b2367689aebb663d62be4af5eb26171744a467e68e17bc0fa8ad6788700f07d77e8292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a0e37a3e8af30784173f6b1308d66a0
SHA192ff4b63accf4555b8530b8def87f77f478cdd91
SHA2566f1e4166a2f5e9234168d29ff5b0496a3a5e4f56de0ff62afec9f9ec5d521434
SHA5122e037b276c52de41d59eb149a9a953ad5186981b4c53435e80f3c1eb853a70b38bc0c2c971ac0c71064a90b04b261cd0170be4376b4f8ab9a2c8c1ef4f33005c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ec8d1b7e0a05b642943ff1ec62ef2c3
SHA1a69bd0eb9581cd36357c5720261d4448f01aede8
SHA25694c1b846822500a521d276d803d0e09e777c7783055332509356cd6c91b0e604
SHA512448c8e580bcd17df0bcb431d7429df022c75e30ac509fd13712e896a26b5394d14833de8ebc9472ca7e0e69353ca841a9d297f204785fe437aa5a78c398e0302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d68ec41c18cce4c8f3d53fd0e6a7bb7e
SHA16bfe6c15973787bb59d3933f359f38e28cc59a0c
SHA256576a1b8d870ac9e5ba567861ad3dfd9016aca8697987c9938edd7d8083979777
SHA512fc099ce7af7249dd5e1d6d3602f09ccab0c5d833d9045acaf5864001a1228af49a0a3e1db09510d6706a137b06203ea63e2d72c21890b308bed8830ba5185ef1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a