Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
40KB
-
MD5
6dd82222f7ee152b5a8760ddea03dcb5
-
SHA1
d7e7b06ff82d4513e436af608508f8c610dccee5
-
SHA256
8cae8e5bd383f156048483beb3fbea7cf4e66b95be23ca433ad35e595f3eee12
-
SHA512
8cbb94266c71d7583c93e5ca59277f5f0988c4db20ded9477d5a1d283aadd37ff650d26048f29367a167ac01e8045755b1146fad131c4e9f732926e6b3965edc
-
SSDEEP
768:Sjmh0OdBcM8K+LdJVbq7cDBc3Z8vflZ+k8U1wtJ+VtLQLjJ+gqP2T2j+PlTWfiXm:SjmSyj8tZJFqsBc3Z8vflZ+k8U1wtJ+r
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf670bd43957a64a812aacd1a2c3106b000000000200000000001066000000010000200000009fce59d6c3c56da46716793fe87e4d781c850629d58d6d1534ae57915e3ce856000000000e800000000200002000000087a2a35d53ccfb10de2f544b9912547f3a9789001cbc68b7ec0a633f800c441a200000000767ecf4c99ab22024dddc203a6a7b9034c8453cd136cd92a57ffcafa2dad25940000000c7c91136b768ffafa002389ef2cc71cf8ff6b2e916d5cb40e8de432f4572dda8b091b623071590ecfdf9e0b46f84ad87b2d3f89d2f31d0ae715c90685b57b9c7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a163073db2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf670bd43957a64a812aacd1a2c3106b000000000200000000001066000000010000200000002cf55b48a5a9793978923d747c1b7554cbc16feffa2a8cb0b278f7a673bed76a000000000e80000000020000200000008d82997b58b34bfc15c28f3aafb6dc70c945b69ae12aef39b45ce398e8fbcb6b90000000467c275f2513953e839db7e928d28bf716b763fca7f5db35139e9e16c693837eede0356052758260b3cf93307a888f632ec1b2a5428f195b91185f0939b881909c06fc0c0b5e273796ce5b6e243e81f98e8650cbe9a3d59102701948173243fc36443d9b4ba6d570390a4a4b4fb25e36479b51a5ce64f282d451409e8d060c362769c28200ae2f2bab42dc4159e89bd740000000cd52545b00fe19084b7d2aac2a26a696b4eed337e299404b3ab2b59296f9f68a03115f249c19a9f3c4f1a084211812de31d426c6312848ebde93c8d812219c5b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423199546" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F37B7001-1E2F-11EF-AC06-EEF45767FDFF} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2872 2240 iexplore.exe 28 PID 2240 wrote to memory of 2872 2240 iexplore.exe 28 PID 2240 wrote to memory of 2872 2240 iexplore.exe 28 PID 2240 wrote to memory of 2872 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae7ee0260cd4dd0a20434601378e3337
SHA1974d5abbff331336db0a062e2ce8df1cb7b958d3
SHA256a923379738c4ec378c6701aa2444b5d4c21270865d728c5b6078a9186f1a9256
SHA5120447fb21d077dd51cdb5fce70ac398377930bcf215a6db845280d0757ce122c1460dfc9fd7b5372793b36f8e81cc8027453e34ad08e89c420ae01e7400951817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5819e22c564ecb8a661d5526b3aeafd9e
SHA1cc577b124429750fa2bcd65e4bbdffb2e6c7ce17
SHA256626da96728b5b9600ae1f0773431f673719978feb7a67bcb386a519c9cea3016
SHA512d9a9f0eb13c48c9e067a89d2f36b44b2d6de4e67b619d00b26c71911a303a8aad2d2d1b33156e58f019e3d0f6d96ae3bf4503166e1b1dc9bc70a55e7f3d22c4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5528f48c33c3e9dd63ce0676343f52dd6
SHA1fdce53cd9132fec2563c5f0dc327cd38da2300c7
SHA256732ef1de5d32f08636bde370fed8577046755f783fd89a6a214b99613c4fdcc3
SHA51291aca4c6ffba1b78e9fb640d1cd729f48956e23ebdaff0ab7da8574978b810e1a25abb2f00fdd72f16713cc2df185bf1bd4d3d15c75d976b6634ccc7c0715f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b11f02a957902795d4d7217934f1177
SHA1607c52be188b9e605c6f1ef89c54f4f2399acd4b
SHA2565b8224c070c8e98230c4d6f86757855f75afaa6217540138a50b6e52b37fffc8
SHA512cebaccf5a762da380b5ce11a9c6a96218f81e337bf250073623182361ff2d7755547a68867be0b710f82bb948f8127804e1203799c0c9b931982f3db1049692d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539e8f03e5476eb666245b58764325246
SHA1418424e859fcdb73722ec4d8f255796f7eaf4490
SHA2565604ac59a48f564281d962acafc07bdb175c4fc33c447aef3c5865d74ce1bc03
SHA51220fa3c655add13c5ded940999c677ff085a2b6b01d0ed09e889fde00b660f774fd34c1786d35f5c62a0b6782277b2b44addad94666c0d161831cc98983351f4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c0630543970feab409ef5df81959d3e
SHA1fe2db0a1be501e9567db80b63dbb54b5b1c26a38
SHA256cddec66ce334dcf87e7f61e8c974d0aa0af0714578307c861faedd3a62788e0a
SHA5121cc2776043ee00e399ba6ceb0d705234190ca4ab2738879f3fb7a435cfdf1f42cf805cc11ca27d64c5fdc069b3905aae131b092d261eaef972b6e6c8e6909907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568ce08e16360f2d54f76d3d1e8b85c4c
SHA1a4c0cea324f7728e306e090240075a532b3ee725
SHA256796f5f3f056ccc21b18574fc67684c60182729386758dd96fa6a4fcaa8498f28
SHA512943985e3f3f57a9924e40986827a5433f1f045b43b7bcdc3155354c86614111c2c2c1a9c82b03bc5fbc1aa8c5d8653618b31ddd9ff492ae34413a201af256254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2f443486dd41b093a966023e32867f8
SHA1cc4156a5dd0e858e4f81e5735611ff52a132984c
SHA2566b8be677d185b035aab0ab544ae0ca0df4e7f3d00481bbf584452e62b9b1d18d
SHA512e9341ec64b4c5cc75f74370942cb5510491f0eac8c9c42146ccc50c5d727425d56e9fe45ab2d2d0bd5bc3942e0158147b1191736bd3845cc15d264ff81c710dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1ea106e85c40bbb769429e449635c45
SHA119412eb4b35d54008b6762bf5a97300931a86ab3
SHA2566bc0000e2548a9f3f5e095dcdd8762dd470e00bb68863fbd9b1d082c0f80e419
SHA512febc5db8265ce7bd276ab49b25119a50cf8a0c48f1b7d69670d1fc8d45468fc6b680bf19a810cd6f2dbeb8fe02aa5fde469ee9cc2cdbbe3e18c374a6505c60e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51665c4c9ad93997b86e2b79820d1846e
SHA15917a9b43b51b1f8562e0ff43d30d4efb65360f0
SHA256a407fa7fc295903fcefd1818700e4c93f359ef412ea858fce353d390054fecd3
SHA512d00fbccb1aedb0b61cdb147eea56aa60da74984ed77b27fd04a90cf0c019fa111fd5545e2d9cc879ba1f0f2e03df4a62a3b21193b33d4b0cf1464573828d875e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5df0a3098107ccbae42c9e59fc5c08219
SHA1e8f3127c794ce2a3f937a629547096d319a9da23
SHA2568f78ecfb930fd8575b1a5cfaabfb4ef8e70a7f2b85b65b06eb5b80f36c4e22f8
SHA512f87d4677425d765747330677df5afcddb814289683a5fe2c7eb4866d296dfb9e446f1b4ca4da8f1b2774c1644dd06dab2f81a9cbbb94ab09bfe0105f7aff43e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53244948b715c50184ea51d48652280fb
SHA1d1b76d8888d5c7486f46d32ff5bb273a3aea2f0b
SHA256cfd6c07bf5c20e3512bcb963d9ae9933487a8c273beca07d96f255dd21aeca10
SHA512018729c1faa58fd7171373155f949f8984d9827a9359dd267e03b18542a53a3a7802376b0931dbe1b78f9500786930ec3844bb2f009d151e1321b4a370706e73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e823363992d90ba4b456d148f30df333
SHA1c5112078272474239b6088b53849e3d028e11ff0
SHA256d32825ddfbf79d79ca07dd0fe76b26b5b02d8b834e4f0dc8dec795f038772a61
SHA5128488203019d91044f1f5260bf7ba0ed956b8203684f66d3d5857a133db348a986f27d9d152a68857fbf1adc1b9a55d70a8ff830ef1cfab328e889c6f96422fd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1479a86a10a8d82933b428c6ad907bc
SHA15f039d32d8ce1037accae1b3197d8c087fcbebe5
SHA2561512066d2da5008bd3d4f470990718e42f3ee76ab2e9334a64fc9168695bc4ed
SHA512612eb9bae062b51657737c6b1b3e2648c994145c9b35a16ca0ee98f344e58d1a249494d8acef5daaa14aaad734e8b2d0f21ba66df8919a090f8434dad8bd5ce3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551ee7d4034b54cf991661fbfc259fe93
SHA1edc365160ba4ebe7b5963db67ed5c5291b5bed62
SHA25670722687af278ffe351d8ac33d7d44dd0a167f58e918da22c6f299640f9d43f8
SHA5128391b52e92c58f9d10e0aef24ac793c2505fbb62d035ad086e05b9df7946235a4bb3f9986026b89dde7ec5987d5a6b639ac636befd99827bad9983fdacb6e6e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD539f5bc33c46912f604baa864f3494454
SHA1530050dd444e61802f17b5d854f24755dccc54cb
SHA2568b0c6ec2949190f61896c69935bce3e642b763f9e7db2196199d66e36ea83e1f
SHA5127cb55dea9a2abc436a41da28534b3378ae1fd8b9665527caa607f542b471fcfd9262f4e5e0f5901a594e02ee62b7db3550d4b0ca42b742db640e803526d34299
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b