Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
214b4c5fbbde4d344072980e14a0b31a
-
SHA1
2b7ea6f9f996d85c95ab20492fba0d93ec28bb3a
-
SHA256
0c63a5dc37cc5e4d4aed8411cea176b807329fd4ba3c11bcaa1a65c170b6174e
-
SHA512
04c925596a1c1b9b1c8c82b44ad23728bf61085dd20d763ed71fc0db4883afccb2c0a6fd105a692be8a0878303cb8953e593f657505f803ee510c7c38d83d6b3
-
SSDEEP
3072:SAUS8Y9XR1aNyfkMY+BES09JXAnyrZalI+YQ:SAXl1sMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422878163" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ADBE3001-1B43-11EF-BD6B-4E7248FDA7F2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2100 iexplore.exe 2100 iexplore.exe 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE 2152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28 PID 2100 wrote to memory of 2152 2100 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2152
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54329855eedb384cb8bd1f5c59cf91ee8
SHA162a265b28abd86bda34efc2c0f01567a92f61380
SHA256ab60e904e496701b9135775961b2505514243c473e45f13708d6ac554df65223
SHA51294f29968c25af4fe112f4b790bf1940bd441fa67d2c7878d331f488f7fec696656a9bdcf039566ae4c95f9ea9e5509b7d6ff998398a1c6910c97e54e52db02e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56695f487300928e71a94c4802db028e7
SHA11e3332ae011bf4d461afcb630fd2dc33ca470dd1
SHA256f52fef5a626c22af502b747adacc25a9027749bd8474db3e6e3eaf414304fb4a
SHA512bf4505263c2db899fc8eef367e67c97f8bb07484178250946db5f17dff046d63a7688625f3ada973eea7c5e1d911b7b2d9d5e30ff4dc95b67a70bafb9bcc99dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2f46f6cce6f17abf6e322a195763438
SHA160497cab13a37ff5b9f2babb4249e464a063fbc9
SHA256743582b4b5ab318f9e631c8554edc4bceba0b75a0537ef4d95d096a1b970f436
SHA51237b280f33eed16b7e011b6e98ff1a322abd977b838519388324bb699746e1f63b7394255b6f7a740f3002c6b3d8c7c8aa097120094a6b5b654f8afac054ecb93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ac72ef277073179e941f10f3f02df0d
SHA1e3b0e6bc58cb4d9de4d558874bb257a18c2bf2f4
SHA2561a094a6ae000c8b1b2f86d23a846475d1928a54cc624c36104d78faf7f2ec05a
SHA512449d0353452f451d1fbf90af837cba6e01d36efff4eb89db8a31e1f8dd920be97ced51e43a7b06ebafba087bd5629e01bff2ca2a271baf155a60c0f5940f6271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5251aba4f42bbbfcb43f361c047f2ace1
SHA18bd566655c0ad18c85db9bf012ad36550d0674c8
SHA256fdc06d31758a132efe18903c40bc972ddc8663cff316ec406771b6f2e5d25a44
SHA512d046b362487974db4ec9aaefdbf2c228cee226da091a0b0e589f2de3944b65cba46af65709beb04a6586aa82ad57df89e8ea40245826df12fa7a8f52ed46115b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6c63f1229e37a50c9ee6ae10ce5b8c4
SHA1af735f1debff761fa416d92ccf112aa5eec7f116
SHA256d4e6fd45dd67ed2872e7faab0dca14ce45b8bdd30a59b3b305224c3a895df8f2
SHA512b15d4e88cdc2ea59a431f04c5148a4648386e0ab69d8110e111e04957a09d8584dd898b214e987af1193c00b6d699fa3badc9246021ea962e23a6fee00cba506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a208b9a775e42e0c7c5a36fa9e581b9
SHA1bb61035b563d6c0534a1ce201aaf2ee3f773dc66
SHA256d67e16acfc98b6ed1ceb1b5ffdbb90f3c50da4d57d65fe45d89c93f6ef3a7703
SHA5123fb37eb3130775b44cb116d469f55b513f4b01603b4b02b88b0f7930450dc8ca9314eaa3d9be30e0f7ab159b47379ec243f6acace729d09af717d7c8905b1720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d13c85ec3d985a76860248f5c822fc3a
SHA16b91e7267d5955b4c42160fa20b823b43bca13a6
SHA2561f6ee32432732129374064cda9b6cc61d4a4351c33e966e8290cef4cf743a493
SHA512b158a244c7fedbdd259bc1338cfd450f4f801e4a9b3e60f78ed41a9edd936f2c5ff44c8933601d84557b56c17457c39f9c5c0f2884d4ded91aeb875258247ca7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5819db9440f2d5da92603c1360917ced7
SHA1ea562329cf01301c4fc88eb938476d3a80da295d
SHA2568ed5267926440897280ba6627f8b5849c54f74290dd1c3c9a4ac53b736b94d31
SHA5123336999358d27214a3ae7dad0ec45c5e2b7d0b758a067e235aab9bcd5aeeb23d915f6dc7d1e7218d640fdf3fc948f1139276aff5087ff7d23af38e85ddeb31d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c33874692be37b9fd0a580ea783fb7d
SHA1d74f43604df5c50970f83a51ebb45a5d0f26da87
SHA25684075544853d2325b19c8202d8e1a2b142ec1bef263a317ee0531691b8ecea60
SHA5125cfb1ef8b992fe7c02652f7eda28d95bc1a058cccb9b2071b76a699d1754176c4e6a34f8ef82d21eda2aa8bc6fcf922601a5a625202b1d4420dbe528851a8703
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504808e9264b2a0487efe5d12d85a4b13
SHA19ba151d9b5cd1a454a4839959e531f314a5a3a90
SHA25611fe68470234a28fe4d286ed666715a183c3e25924fa6cb1d961878589fb0161
SHA512daf67231eefc35b1b15c696481d32c2d5a765c1f9e99569ad1a122d33b4f84c77b4738883c4cb3ac66d2ceb980d43fee827ea00a1633496f1470479d61ead339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506453b6384cb36bd5fcb84312e47c738
SHA1c480c672effcdafae00ad05f9c9c733a6ac0d4e4
SHA2569aaad82e35b742f6f08ac7118d978cf2384bf94842a95b3af9ae9e9d747f7bf4
SHA51283b39b4f3179f3b2d478798b67fa0e59dc3703dcda48cda87d612f2abc4c823873ad4df9685bd238fb9a8d5e73b94191f9a4b0a43b24a509efa75a944d828e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a0b8b4e25230846302098e9c6f6af48
SHA16c600a890ea04d9abe4fb605cae1501c7b8361a2
SHA25665d4df14348781dc7f2add718e552694e75ad93c2e43306e143b44a3bd13b5fc
SHA51299563b79eed15b36bb8741e2b1962d8cefd2836e26dbeec58cddd21954617b58a40493d102cd721d228627e32301f11659a8d97da85d69e7c3db689ea53ea4ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6e6c06338325198a2d1d9fc1486ed2d
SHA15a8bcb43cc51b2e9f4c9e8abd45709229b742732
SHA2565b203332093893014e4ee111272efb79de84ce1bb900435093d3fe623b9b8a59
SHA51246fb5c40f0153320a53dd321dbf713bf5efcf23d43b49c3246afc60179836b9a1ef6cd683cf04d24ff31a377ca90a86d0dbe16f1c2a87a4184bde2384d7a9a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5dcb547cad659fe60d9205aca13d9e9
SHA1abd327574afd3cb155e896467a06f01e29c14763
SHA2563407d052eb21ea0e3b94fec4f1f02496748af19f3672186de445a328d517a5b9
SHA512153626b2a82350fceb79bf01743dc1348c49ad8ee498b7d311ca730d9046c551562ad9cf33adb770d7ad3f99c10fe5d9503f0a2f7f4c93aace8c7d5597f42b35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1888c39fea58b416dd355296487afef
SHA132ad6dc97ad36e62b8defd891850c3cb9fd18bf3
SHA256c9600c25c6f31cd882ae2e7b7b92b1e7ca3c4de09566a9d32bea673ce0e24f27
SHA51294a753d322455731d934a51ac664da7aa9002aedeebdffe8f26bfb1ed0871505896d4313fe23e331de86db84fa776c72c618e70020fde2dc492af5dbf4e47415
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a