Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 09:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://assets.bounceexchange.com/assets/bounce/local_storage_frame7.min.html
Resource
win7-20240508-en
General
-
Target
https://assets.bounceexchange.com/assets/bounce/local_storage_frame7.min.html
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423999675" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000033140bfb229e92dc9e6ae1002a4ac502782923d5bdbde04b0846fc4897ebe2e000000000e800000000200002000000059daded3c0e6635fea15b1a3acbd5775bd9c0f78d5917ac1a18af05d374eca90200000006be3cf679809cd43e9db17102973cb29fd3ea95920909ef15a3723cb0e735eec4000000071b9351d2b0e15ebbea184588eca03b9683169071b60417683d127bf3519daad469077f4d9932943c97ca7932ab4722b24665eaa3f6dca3fff1ea82b3a38db14 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6F8F251-2576-11EF-BAE0-E64BF8A7A69F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00cb5bb83b9da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000052152967140d5aaa6de357a9d388557f2d726b98bc50325440ab7a69791ad3a7000000000e80000000020000200000000b1224b7dca016719874c160357e706684b282842d09b207d5ebcb924b26ee259000000014acedca59e90a8cbb862db76bbcc6240af68780241f2b5bfb1f3dabbe06ef43a83a369951a735dd3322b94e98a89f61aea7a212128d64b25b7b54c667208e63739d08c572cfffe34b6e3e8a98f17696f0b3d68b0ae98422a3d14a26a70a8831dc309fb6aaaf3d424986feee769164f03e5795e3ec407aff7adf279a39d053cd1ba27d7e242fc63d10f94bce4c5943bc4000000066bb5d0dd5d430187a6fb702221917ce44899d964b21529facf07204a90130110630daab339ac15ca89da0312d2d00b2e48dd82cc353b3cf4cb7a171f83796f2 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2284 iexplore.exe 2284 iexplore.exe 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE 2304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28 PID 2284 wrote to memory of 2304 2284 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://assets.bounceexchange.com/assets/bounce/local_storage_frame7.min.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e52fb424908f0d8082e1ab7fa7479513
SHA1de9bcce2e12202588823f014ee53a260cbbd4fea
SHA25673acc086dda9c3cbd562a671a589cd834b90d5c8d38ba9121d8d68df775a734d
SHA5127b4702671e3cc10c830629f9ac8efaec0ca2d54ebdbe6419fb9d0e65b58e97e6e7e70a460168dc637fddef4ed08b759694c8b1fbe0d3fd66f2f380d587fdf18f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cc27631e0b52a20e43dd7aad5979e1e
SHA18eae4e5cd77fb4d87b19329afda2634f90cd694e
SHA256573b877826f4f549f402c8438bbe96b682e6815baf7eab1d87a31d39483f4c54
SHA5126052321bfac400e340a86fbb15d7982c0cc7f531fb203b61f38128bfa975b443ffe525ac2190e218c153d43f2056611ffefb5f30819ba5adb175595c87f14dfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5347ddb51c7d5a54223d5301b3ec12543
SHA1fdf11d81704fad197b2e7fd87e946e14828d7c99
SHA256d88f7cba2ea940f5d789b5889b1e75cb41ffc961e5a6b856ad27a9693c22400d
SHA512cf958eb9f9174c3194e87f920ba5c161fbf487df2899481d18d7400b5737c7c5c4f31933d8f7cb324fd6367241a3a249d91fcab91f2175d3e42041a024823efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e6516686e4b955884b0840c23490512
SHA1b127d32972117c5209b625fcf76be85e062474f1
SHA256e9a50994b614da8d6a449378e9b933084b97ac753d1a3a6ceff2a75abfc8335c
SHA5129e4d882d8f7c0d88058930ff0c91936ac1d83e090e8222357c03f701dcee9317ba5c6e31d3ada8ccdc1e3d535558f1b5d185448529e033f47170070acce4faf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58e6ada94ef63f3a21f6acf5417b2dd48
SHA1e5a9c53c9beeca97f4b22f5e3bf1e3086b8403f1
SHA25647876fbc5c5cb9d6de8fc9fe59193879895bd83f74ab9fc6663775988d3b46ff
SHA51233ac7e1a12bd42a4ed4010661e4de3dda404870ffba4a12a4502b38f1cb083669566c5b02e33b68baa92fc5c1eee94759cdd0d276c36896c272f7cbe8614cfe4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae76e28b2edb446f54e54a641e9d1063
SHA1704d2f02ba8235ddd0e46cb9cb59f9bc2f14fea0
SHA2560f6a0582a508dfb8f0a1f68c636c406bef26ad123b7ac57f5fe4eb9a8b16ba6d
SHA5120912f5e2c05a31591d4ed60ec78d3c469b279e1985c0e80360ac6fee506ce05cf6aadce0afcdd30bccb4fc0f1fe71030b04859a86d577864d126b6863c1aad7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5896f1efe2da84191061b57497121ce0b
SHA1464e7d0be714f830f71b9599372b20e26dc07273
SHA2561fd680e8b0ffb795c187ec27012baec51e9cb83b62e743397586522beba9339b
SHA512eae7cda87854c9c18605ce8cb9ae43d19885990d91688d52f6a532f9c1cb922e4357e5a4a4308e0c343cf1d3a631606989b49ed55a1e2ec0c6bab411dd64fe30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a50f60d0b0a33c1e012c14060a6a2bb
SHA147d8458d97a922f608097c6259ab7ae8b9c4938e
SHA25606789bc30fb4de11a8d3eab9f0e166a212801c80dab2e6faeda2a0e95f1f3a52
SHA512f9a700b159b2d829f0d0a1bbbdb801bfbcfa1100d3d74b30720d4d1fbcddadb8d84d5df4835b6a3806b63f3b05578c6bc4e7014845b5086b0c9ad73af54ce847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9715ac9cc2486d96737c2f5ad712c5c
SHA1b05bddea39426776b5a66c4df58253a747aab2b9
SHA256e082aa5abe2670d513599800719b20dd8e1509fd35dc5d31ef49ec9d529ac706
SHA5129f12d8edcbded3b006b8d6ef7fddbb32b3c8d1e57eca4c144b49fb3bc278f1a3a9a79cf11604cc0b1d3f9fa5770f140053a3b1b53a55b8ed4902f80392579a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58cf3f3c9b661016ce9caec948683af31
SHA1f881a48f3fdcc563f688a274d204e683dd9fa1f3
SHA25677e5abdd30b9791aca544109ae9ffbf4ac25262b2d0b19ee5ede207b6853912e
SHA5127e4ef6b9e5f013b715585ae96bbe86f13b3df2b299efdb1e204f5df0029b76d150225bbe3cc619aa0b22bbb750655f404223106d5f1884eff507f38e65476602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50870eafe4f5b5cef35c1d80b29dca67d
SHA13f3f386cfe77ca2a504071c6756a5f397e410c95
SHA256e1d02e6b6c488a381917e315ae8ce93124a1ecd6137e874232fae56e57f664b0
SHA5127c7e4689e6d6d95b5e42ea8d9c8b9a6b68fc107e9be3a9bd8d7d70e51b5958a5e8ea148c0b7ffbfb5d9062e587ef01846d99bfd39ee7c810f1d6e630735f4ba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d52022daeafc6cad38e141c72877eb4d
SHA18dfc9396a8490501e9c1f95854d870aac6dfb3e3
SHA25656b1a8b8f61d504873a7f058d1f26a0d958505f475ac1b30d0cf8881370002b8
SHA51222c6c6226b7bdf8cc00330fec63b068925d7d19249250dee792665f79ac437aa407cb2d30259b93feefb0e3dd219b70f4018f30ae4367f9a888c4bae3ea4e6ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f5a6365546d375f2c5e3e1b84b517f2
SHA1705c5a2e8b489bf378a22e9e9ee5259f40454929
SHA2560a0b53abc40916946236f242f667fa3c9fe2d90a6ff0d70f8d02a7857a9622bc
SHA5122d5bdb8263973314dff288d86cb01826e775e4ee15441c0ce8e6c51d7f5a0f0a982fc19a4b55c736d2f5542f0bf8160e79190d67fa016da53ad1323a7f45f11e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5482fe1ae9c53309df5483e1d9fe7b710
SHA11f8d7d8bd706fbcf19d0455cd3638931898fe9c2
SHA256c142b0947b3a123994cf3f957fb0bafda6a85ceaeaebc7e20e0710ca60c3eac3
SHA512d142d5d4fec42b9f7f13ffdda77fb3068fd242cd373f9a4c8d9f3d73c994ef45438524e62ba7fd436ccfd91338d99749984ac6cc51b00d14fa19b464a19f03d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51377eb6bd373fa3a69f52f8b450ee94f
SHA1a1fdb561b39f85a86e3546dd9bd11e88784e77ba
SHA25684af02d09c519fbe9e1d024a941c7b952021c3a73a974d7c6f34c29475422aca
SHA5123a013bac7952a38d31ed53646e893da3bcb7c52b66176225dc1f4771b481e5d033932bc1bc551d500731eb11a0a0ccdc8bed693f74707c07e67750f7ff76824a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e7d84880d2080ef9864105304aa3a26
SHA18cf826837fec91d4f9edd629893c0639413f2556
SHA256cf0867c4c94f1ed5ebc2a93cf718568f344115c6e3440955c798279f58cac1dd
SHA5123211879ec1f6660174f526b024804514861e995ab27177243cb0b06686abf38c635f30aa745a7b2e3fcb76314067f90e238770f1011ef3c4124bd630e5e03ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592ee102d38e15c5c288e91e7e61b4688
SHA128387db10175bc922c917dc3f180ca4e9c34d1d6
SHA2562e4dd8cf654f1ad3a07a366a2dd90974ded46dbda7d35bde71fe5a17c94b26f4
SHA512f661dd4ead739e4f70cea310cc08c094bbfa7c293ab9ef48b995c0285bcb4a78f26af3df24eba56e629f942a71cc5455e80b034e896b75f1d3d003b9e646e565
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b