Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
221KB
-
MD5
c7bfcc8fc70e831a4d1e6ab79411d678
-
SHA1
2862c96f837b67ffad4e33385b9fd90b90e88476
-
SHA256
de8d4d9b0b1444c318427faea3fe568b8ff168ea3116eaad3176ed8680ef882f
-
SHA512
e92a7adc7130dcc832dfad80b1b98f86f072c567725e0121d9b056c05a42a1cf942e513497dbaa1b3313fe9675e7d34f579858e1c9fd96c6e36edc961764f8df
-
SSDEEP
3072:ScUAEVYarrOk3yfkMY+BES09JXAnyrZalI+YQ:ScTFXsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423681237" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78E9CFB1-2291-11EF-B671-4AE872E97954} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d3ac0daf056c7a30882cb769f9336588
SHA102860585c202dd7a22fd1b0220e3032d71044a80
SHA256742d6733f00bca0a206f53fd632b87fd484c491e3d70defb458c3f125bbc3fd1
SHA5120c107219a524979b9aa75c996de3b09523d93948ab9f8552751c9316459a7fbb01afde231ad13b927bdaba072dc76b9315813ad163a5b569d5b2c7eb3150d643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51dda889576d2d0bb0d6a8da7bfa1a4cc
SHA1deb48593d3e8eb1ec22a97133c3d9e3a6f66a6b0
SHA256d279d7b2d960d4c2bbc3fe071fcd8c190c6695e7b31e55724b9c5c1739942437
SHA51256efc6e03bd2104fe1187a331c85c73178f9a3b59f7740be3e41f1ac9f2a6e4fbe5bb3df64cc71065937c022b1c72b7b54bcf6ad74c2ba7cf31eb19807c99710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546441ee926a54f37b00991177fe3db70
SHA12fa5c7c769ff0db6125b2601433f59e187a77434
SHA256b2a88605e36fb92912f8c95a048c16a714e22329da5653164da3d699c60d1d25
SHA5125fcd58e296b83b9c149e678b0301c701a6d1562523ce4dff090939a448d2a2e76e40711e029d8af695e1a2e45c84f9e9f22e58c71a98deb96dad5fa33b064238
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD511abe9118a86425ff988c3591e03638c
SHA12df3a21d5a09e59bc6f74585857f9a3154f2b882
SHA2565c9fd0578afe22984b3322775cf427b322e8881510bc448b5bb0ce533faab6f6
SHA51260462850acde2fd4bcfb35ac9f45dcac881f7d54554d8187c470c7d6cb16c9f6bf0c4fcb48dc11f22445fde1d65ad8732971167669b27da6af196402749aee21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5046c7ce2827e3270ebe0899c938e68d3
SHA190157d56b4a48eb8e2f3ee190fab642c474985cf
SHA256b751755dbfb30b8e410b9c32b09057b0464bfaa89603a8a21819fbb0e2df658f
SHA5122f0ac1abae2d22a463d9a0583cca0abdd6d7b052008dfaa997ab5bd6904462dd48c8ffd8b9e52b84dd6568c11bc59fdcfd719c21869c15d8f85447367ae31941
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb8a56abca608e529d6e115d6e79cb77
SHA10ce95595d1d9d7838155d81bdeee51e91727a2b1
SHA256d1df1f36f431a114eb4b1267378c916014f15b58232adf7e8d4dd579a8acf9e1
SHA5123a3a773839ac4e934bb118a32c9e74fbd9faf1f17aeed180006bda5a7fab3000f53c3327c6bd77eabe2fd122c8700a7779395f3a7d6f15e316b0f09825a27c27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e146887bb9f2e61a8f0ad0ffa7281edc
SHA11cf64cbdc8a59e7601759062cfa396a06be7005e
SHA25689de5ba311422076494716182dabff003611f0e7b3977ca7188b54f6eb4e34e0
SHA512d7d7b00a483e7eacb996fac6d212e0de95b636fc8dc56de8776362f1b168a2dc0619357c6001a202766c5d4a1c17a345608d0473d592f839bdfd9704b6ea2bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e714073e8393855feaa347d5e5328a55
SHA11f583dc1549085b9993185d7fddfadde219e71b3
SHA25645ad05d0380c7290e658f69701bd1a14bbf182e89440f1e6869969dbea6f3504
SHA51278cb586a7cf3aa774e1d2ab932e61f2a3580b5fd16eea47963a1c4e43a5f022a61660d4a4568b939f14f940b4a27f4d2978e7aaa958686f2d4bbd0c6df5ce119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a1c99a3193965b1659dc777e84b8e6e3
SHA1edbf72016241bf3ce0dd51b63b43a53580e5977a
SHA25628f387695de73bd91d6a483821cc5d2db3a09beb7b308175cbb7c3ba9caad857
SHA512e36171b5cee76402af2b94f8695a6b678271d2a53a20632591885c33eec933622d86c8e91fbb3fcfd960271d230cceafb281e3ea018b46be075f59caa2627813
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598c3942b66849280a655ece267bcb505
SHA1a7ae4e52dcedd56889662e6e1dd54c76d830c58e
SHA2562e5280068083fd8fd923fe0b830de6dd1ee08459eefcd1592c5728b18777b142
SHA5124fe3dd1637a9f196dce5ac36e6e47ab05f0318837cf93449f8b87e78f7a372f42b1bb4c1a9b31f11e8ae7fb73cf384512501b741fe8f92f0d40758089d4a3bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50155f302976ff2fa0c9aadecc83d6d54
SHA1e8732bc60c1c5ce4550f06af47a5c4effcb718c2
SHA25660d6af5894a75a24d01dce56e5b3b3168b80954f1facbd528b2a4cdae9941146
SHA512db1531f961856d85b92701b0abce4ae33ac09757b5fdb0870d5543ce2d946b7ddf69b1f018db6812bd663afdf59db93f06678c131ff570bbe6286b65975cf884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0d3e9efb8e61e69c6d693db654bbdd4
SHA1c0e4286df4d645ae97c25b8d35ebf44063b8ebf9
SHA256b5d0ba0b77bc758dc64c576290091bf8d321706ab1219f6d4b8b453c156c878b
SHA512523d076fa8955d4703b360329c157d13986def60f38fd0e85841efaa95e80a2e81e96a1665a5a0a6cd67f4cdbcaf26c1f7e0b556ce95aaef94a50ce23e12b71a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e698c522c81d19df6c5a8cc477a52a5
SHA1894dce1dd6677a7b97d0f5c299af0604840d65b6
SHA25629d3192865cccd67179823b4e36be187f9eab6f9de2d58f3ef250551fcc405f9
SHA5124e60e602f347381150e5f232b56cf9b4b20440dd9e9c17190ccf7182ddd19eab7a6a8af0d80dba83ab88143c9bb414483151a3253db2a092cfa7f6eaafbebfed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e110ff534746c3e4dad6cfff986eac35
SHA13dd4c57c2ff35ed95a4acdcd149563b898ce0d78
SHA256a82a1eeef5c8c3b7e56125725da6d3dd6b9bd930edabc8a4bdc6ed9b54e905c7
SHA51200b1db84927a511564ec9afd0275db9de2d06de543bdbef5f2e49d93d56a90758aa9516cd5e001b4a548d9b7323e9d2cd9429a0fa30fa6459d2cd7cbbbf587eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55db5a774866f7419879e1549ac62d126
SHA10a1d11468752875c95c0b60cc55e9559aa44b640
SHA256d9f8330adea1fcf34c06564fd24c9367466a4aecafb0e7db971e4c0873ac4a28
SHA51247d010240ce66dac4a32425e84412af13faea6067f9dda5be1e62c5cfb6aa039ddca0ba63169eb3eadcaab01a78c287c1df4c52c575b247707fc451a18d52b24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f69d80d0ae5cbfef4188b25d1d992ac2
SHA180b71935551236fa2aa7270edbf7d26a79ef3a46
SHA2563a09d6e619ffb7664010e4e4d7d0ea26126efd0446bddfcd94d1c4f9dcd97ae8
SHA512e412d5724ea90d2a98d5d6ab6cae64b8916883f375b1608435f7af6483413bc0dc4e604d2d7fd50e8d28e00180aab5eef80fc13d81fc973ba5b853a12ff40674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc7c449cfe7337d5844d26e1d15c2625
SHA13ebfe1acf6e028d55776142b8cb39ec6f9c49734
SHA256a12cb1e7a521556837a412f827c771ea2228c5c28dbb63b90ebc76e3715db07e
SHA512fd190cec59163147c0afa595cad6f71f6032aaaabd6d865d8a044b461cf37e5ce8dbdbfa74c362263c4baf52b1660b6f42353eb99d70ec074f09a8766159bae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bc03275bc5df2a3c6f9442e2a8283ae2
SHA12bbabed6bcc87ce1deec12f79217c4493b0a978a
SHA2564627343ed917c144cd7285313746595000b7c6a78744873dd2eb81980059450d
SHA5128dd712603972726aa9babbf31958feb600ad33a59af38d0c831df6d3dcfd82168301b4c7fe2b83abc78f6345f4d61f5fe7f2c19d01840bc3b65bcd9fa303a39a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fb6fbc494ab439384de9a078bae7ae80
SHA175ce562eb12241e4be8d4de3996f5f0cd8cbe732
SHA256214c5e135c838d17089035df62d693fda4b73f8df83985c05bf8c9c2f62fa802
SHA512ccd2c71d58d329bb46948893253f258aca8f3fe46e341138fe82fd9cd1f27e1400e77c7d2246f234e0e3302b7696077d4bafd5684c3dff9acd4157f5316f9c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5716b9fa4d2c7bbf601275e7a3c071e94
SHA12768a156fc6105d993d09aeee10d28181ac9def1
SHA256f5a95edebeefb0e31eee3056034c178526c5a18670b2fe888c931248c40b1219
SHA5125a4281c0c42524ed01e5b74344520659c0f98364a0ef8f353508b23a552242b8a7487ba2d340be30675f0d04518993d71ea62f5efa687b1c451990521dd439b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9ddf1accca0fa8996e824d83d57bbf2
SHA1d2abe6d05c43034f91f1b7715c515e31691d4368
SHA25608512b5c1a988faad0d361c8d75b3c6472ac2e586fe20a9e5295ae1875f74e82
SHA512693d5c34794b569b4e65a02b188a23f275895920e8a3d1c802c49f6b0bff9eff9334878fb3daa336c0d958a00112c3f27e756fac84c46c9ed25a6b2f69c7673b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b