Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
9e02362275e83c549d7ebbfad2b5df5a
-
SHA1
d2c242c2949bf9fc72f21b9b24964db5ab9fecf7
-
SHA256
c08e70f66ae6d8b20a37c55f3e0fe4057057575971fba6eb357641615b2f94b1
-
SHA512
494907c25b604b84efcf24e11b2c9532ebb14b002ac392b6c0241107a8b44dc83549e57f01f8b6860bcfb768141d4d598c139bf074a1fa3506f329a907ca93ad
-
SSDEEP
3072:Sk5sRqBEdV49WyfkMY+BES09JXAnyrZalI+YQ:SkftJsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423355202" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DF0AF71-1F9A-11EF-87B3-6E1D43634CD3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 iexplore.exe 1752 iexplore.exe 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE 3008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 3008 1752 iexplore.exe 28 PID 1752 wrote to memory of 3008 1752 iexplore.exe 28 PID 1752 wrote to memory of 3008 1752 iexplore.exe 28 PID 1752 wrote to memory of 3008 1752 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a211bf75288fc78fc0edc0ac201c6e66
SHA1d4d94d34fd04f5e2cc527bf7664bcb4b0b7ac821
SHA256c53f436951a3ac3dfd99b7eb0772ab9a74a46b211900c4d2a5af69b19b9a5d65
SHA51248e71abd9f221fa9ed1bd37420e9299e55cb1ddc84c81f5eb91058ce69b2b104f2b35f27c5dab680b5461c16ea22c8db889de28a02e1cc9d4f9c79c3926d7b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57e762a14f177834bde1e5e1374737df9
SHA130104dc32d6d4da864d51da8d0934eec9c9da9ae
SHA2564dc46aa68b4826ed36ecb3d127385060192b7d8f9e46336139d383b336ccdfca
SHA512ba23ee59fdf56eda35f85feba3efdace658d02367c23fcf5877a114ca93b75e17b7e9291b9ef8fce58e4442663d6f6622ed0e10cf3635401667bb354f7a52bac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD562d3f1424f72e9428f236713434a4bd9
SHA11a51beade56ab5b878ec20ab48ca51e761d3c3d1
SHA256fade31d4fefa2ff33a500b50e80e9c70a3ccf9b4e30715933a4e6cd19b4f37b7
SHA5123caebe3e2ea6c06f54422450871e99bb26c6f6502d9c3ee0f12bb1b726048ddcab23f42a3b9c63b890a55f3dd237170eb892178e52c3d1b708ff462d018a774d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9f972e8fa9cc21682892ab0b111a6eb
SHA1b0ed1ca7563564bc0d8ba5ebc67e9bd887afbb0f
SHA256cce05852692518b3e7cfc27c2c37cd60534a67024221fec8d167ce784553259e
SHA51220e267b4b259e8e722b137f0f0afa5e26df027476c88ad0c752b08f0c2511434b18015044902fc26ffc28b07164bd404ecc2ad00551cf8822f618e9a8321b2df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5842091271095043258fc7839f58282c7
SHA18acf781bc2b603ca1c878dca559f7378bd80726e
SHA256f88d011a73487d6d0047ccf58cf70493c69cc341736b80f6b06b75db460d6cfa
SHA51207438b0f2f0f2ebc23b15a808fe996e597c4ef8c52119d78d7bd82e809c23c9a3e329d300bcfde5ac07685a810097c32f6ea686628001a794dbe8eea894053b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ce123c3c9564995dde2d1a57d4e07cd9
SHA18229de33ddb7ab26d1d1fb9993bdd24cf2c69540
SHA25682167402e5e5cf9ef101497685620c4979ab87ecb1fcf2eef3702c4a7e20fbd0
SHA5121ee4c77f8b6b4013978025de3d525a59c3cf9589befc99db0c83210d6d34c8fbcef634ea83fb85a06bf1ed9d5a70e7019f9ae997cd7de2c160570a2a54dc5d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b8e802109347d929ad10488e9b3bb71b
SHA124336177f22fec8b755d7f71f1fd41e07c3f9655
SHA25629ba7e467a740c870d1c3932c78e662d444e704579c285f60de7af48bb7d92fd
SHA512776050d4ab3006acdc7cb4390d0d153511461803de94e84c3dfb1e130562b9f6bff94ff8a8abd9e77de5e1638f85340a41856badc540b49e53d28a56ea425bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537840b8f74541c04d40b630cb440784a
SHA1079468553288c358cad076f0fc03594d83cb3b2a
SHA256d36bef44bcfab4698d94b099467da8d94d482cc63256c661e515b8035f6864e7
SHA51205a68389011d2916c89cc9d5dc945b780874478d6dd88203736b4429ec1ca4c135afb376e2cd7d2f2fab1da75d98a9edbe21c87acfb38af9dcab4faa018cf675
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e77d81aa9b6e328f19eb349cb360e8b5
SHA1a74d27d9239bc8e516b9c40ac2d61c69dcdacf5a
SHA25656f28581a435139b75bf309fadb0f4fe585e8a2df8b6a58e0f0106a32051298a
SHA512d332fdee5b855547629b926a27ba6774986b049da20c9bdec3980b9beaafb5a29fa34e5ed7b19e1c8b4d5de42c002bfce035343fe61ba7ac6a15b7f4cb029edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5143f9d034bb5725a27378e82e6671d08
SHA18cce6d4a9e3652f9914805cf033c3ea2c6188804
SHA256952b42679ab29978874e42b3bcea298db4a84d18ae94228d48acb674a6ad40e5
SHA512c90b25429454fa90f2675512497ebd15d5546b5c8d286645d73eefde0a35f8020cbf9e5b51439d1126fb20a7759d416489ab1ae9f20e36831166b0f2cd92865a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570096756850d46a8e0eb9c9379af459e
SHA1eb962ff9dd394536764767e2386d1f2ebc28e6e7
SHA256283868a660066c7fdc33470e610c121af39ad48b65255b60a5f7d933872f58ed
SHA512711bb0318fe31e08ef0ef2da5dfeb0ee65893d98c7d7593e377b22fbf664fffa12e144b673a30f00fbd4926e0dbdc184d3f314ee1296af952f4868044b1051e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54eb65638aa966345045254ccc19523ac
SHA19b6f7811868974cc4b29e765ba847b0ff9a908ff
SHA256185ba8bc61e47b43aa18e4467b8e649fdc1b890a353e8a2a5a1b6382a5872ba7
SHA512442cd736ec10e46f01439e97a825769e926d8cb94c19f43a27b2c099980cc04d03579fad9e37f4f4ab7bbf967abc8a72d9f72679d985a047ef9ffb3c6d57ab45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a9de5981e5122dd5ea95b565b8ebf99d
SHA1bd1678e3f1cebdd188cf4b0993e1c9ad21594909
SHA2569203c6d3cd0f727751bb1279ce87b2c6fa7869e52276c1b7f46d66fc361563a8
SHA5120636275bac8b5db2539030b8e2b2a2b5f51d010c8323f7cf9a0c5df87c796e720998795d10e23eaf1697de013838ec7dce9f52c829e711050c6e906f35c2a013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efefdbc29606bb022fc05ae19d46a2cc
SHA11f7d6b050afe34a2f01235e4f8c7d98c475c85c8
SHA2569a59d12984924dc6f879fcc397352e580f757852f2bbac889eece8de710611f5
SHA512f77dd29941baff02a2c5bd89119d8eabc30507e0110d5dddec065aef0573c52782277c3f317c612273c4b9282b7da012233e2302ae2c4fd6f817f6eaa415904a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9598d8938c74dafbadb73f019b1925b
SHA1b14f0bae07a175f01dbd3da6f46d45d0c58f4177
SHA2566b0cba342a2e8129753d26dffbb463b6a632968d522c0453e9cfba51768e65a2
SHA512cceff483e4cd0ab9774ba2d0529adb5f550c53196b9fa546c3d4dd78b61bf8bfb69f32d8ae44d810048d69aa50147b02631150ed180e869ccac8ce6fac7b7cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5131a8420055ffc95caf5d9756a744871
SHA13a308e82df39239b28108e7936e4a25911ddb01d
SHA256b3f13f189ccfc1808baef8727c7b13fb2edc94360ed63480afd6128adaaa50cb
SHA512afc5d8d4b54ce89bf00ae735252849e536622e943249582fb83a08490b2524aabef778658e9fb692400ff2af90c94f360b9ba27716b0abc23f2d103bee06b747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad2300644ea3488a79bd72eb2769f8c8
SHA13d137fca790b3b4fca0f558b33c5048211db1b1a
SHA256a9f9165e689f654d015040baf6b0dfd960a78ffdefb5a38ef111129f213bdaa6
SHA512d517db6ac18e6fbba405348137fcb7e866e042e9b76675119d393d2b809592c8ceb365b2fafe53c8bbbaf2bc19d34444423cf06df2deafae0aaf2eaa49530adc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5974c77676f4eef3a36cca4cce46aed41
SHA1d8e6d7984573d3693f24f644c5f111294b1b16c7
SHA256442b6b1750604fbb55f602ac8a2d8abef7b2fc944050d64a46e7e9c43e47c380
SHA512bcd3fb740d318b42d1f0988ff8b2df0bf9d0d51811a0b057104c5877660a5a86e0078fd4c73bea8ee97643b1cc81e661ffac3670d3208f6b8cce129495c648c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b