Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/06/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
16e725d04faf79d6e4926873d0011ceb
-
SHA1
fe6f718785ad3bd5173c81b14354cd86d4b723c6
-
SHA256
7d1174323a73fa038ffd3e73f97dde8aba28ff2db8da79880ece23085dc7614a
-
SHA512
8331c185b2a3194446ef2477de198e6d67e3bc1cf54efb068d481433d50fc08c9d6f27f45864ad27b7d6062bf77175b857a64f47fa41d0f25e74885d62a862a7
-
SSDEEP
3072:SUO2f8Pf0amHGhyfkMY+BES09JXAnyrZalI+YQ:SUOVXksMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42C5CB51-2A4D-11EF-92D3-66DD11CD6629} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424531547" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2008 1460 iexplore.exe 28 PID 1460 wrote to memory of 2008 1460 iexplore.exe 28 PID 1460 wrote to memory of 2008 1460 iexplore.exe 28 PID 1460 wrote to memory of 2008 1460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2008
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b97053ab8f2bdf77ec21ba9d4d3cf67a
SHA1f6580d74c5c86afd63f7ea4487e7c73f3ac43a3c
SHA256e746847ab59c9f2c1ec765fc5ea7770438d54f97eab06355deb5d93c7cf34f2b
SHA512e12bc70946e5941a24e358eb422e94e563fadf4857fa08106fae39b8022912638d95bde7c4a8aa9c866292a64da2fa26dfeb1d09d230f6558ba534ebb67d91df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5674946a137619fbe8748a6bf8e8f9e17
SHA173a4469d48ae5df74ae7591d5ec9fc60ccb21673
SHA256009d590688dd111f6fe81dbf064cf270f695edc6594578610dc1e7b939a58dc1
SHA5120e601b7adb39aed5b07eb4c327c76c6a772a3dda7ab77c2ff1e0066d00c845980f581880160a4b53ea88172054e8a6c9bae8e6615cbda42b594dd95f0a06a764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5401b7220faffa032c5f0688f1faf25e4
SHA1c47751b0de48f59f15dac69ff227892b1dd6b1a3
SHA25696c89345b18a5fa4c5d2bbd295f723c8dc6bb8e089b27f5f9ca816d128b6366b
SHA5125ca6d83484224e66b2412fdfb548a959d632270a0d3415d4811747d4eb90ab3c12e7a414e68122547962f24fa06faed8f97e15ac03a19e9e4b06cacd6cde10a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe18178007f15b86b41013b779694fd5
SHA1ece2c3590755c1899208bc6d7f1483eb7bd5c2dc
SHA256d81164477e6418cef89350ccf864176a7c36b787c0785223316a48ad1830dd01
SHA5123f6f45b8fe1e25645ff26b2a580b20609a5e1808bf6e2e0813f0a8ccbbfc5f4b3cfb64acfb7f7d54a234a9b2c4e801794c1a55a8ffffdb17ac17c106ddb7b448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad309f2d6500cb1a3273ea3ac219118d
SHA10e94c739424e7757fbe31c97d5beb5fab2997b7d
SHA2561bcce9911e8a6cee0b1641a8ae3269c156eb66d63c7008090ea0d69ce7c1487b
SHA51242c2fdbdfb811ee4e9d91f6a71bdb4c04bee18fcacabafc069e7206a3250439b2ba78766c9bddbfe4e190976ffb8cc2d8d636e215ee18aeaad5c40b7c14983e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f89847e4ed1f282548b42c11cd19179
SHA135c0c194562e96b8c324bf364079ab0842ac5567
SHA2564c8717a3964a6dd20af256da333eb246693b7a5eefb55c0711f9978bd15e64e3
SHA512d17ea54c66bfa483b6373ebb167d3f2750688c3ae279cb12878bcb8825e36f862d2c465bb25ed1fef7e3ea3eaae203e4c60b978257fcd3ab6b1a6fe45a8d4ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD578173de8401f8600b41316b3523a94a2
SHA15d8b9271c7f27ed6f650947bdcabc02c94e24af0
SHA256d259c8ce0f968987d7a8a31941fbcb6a3a34cd56b6ad880249ac60cfffe7c03d
SHA5129baf14bc647796431b6b6cf25aeb683c5cc6ac9b5e30423b824c4c045dc209977cff6702fa8c92307ae60f9cbeb284c9e8f8b87528251becc0a71324cdb22dbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5565703aecbc7794ec514cf6eef7d9ec5
SHA18c63af08c210aaec640eb72be09b28ac1f8b1fc0
SHA256b3f25a8ad1962d4eaee63fc43ed6cc72a33239a630f6007735e33a2525f1c957
SHA5124bf29a51370b002c65b3f48869d4071d8680df5f2525cab892e81de8259fa8c8f38a0b92f16508c75aaff11774728f9791fdd997974aa4ef1da37e7369c8b323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD516ca7bcc41540215b5d9404ea3ea8af5
SHA1aee341246b27f384c88d41a01c4560fb7e68fc1d
SHA25663ae509df3e906425ae13ba81ad20b2cff220bdcb44f68a6a8818452de30e934
SHA512abcd4c9e4d9becb9b00ac911b7842ba162bc73405870486675355dde78fadf81a214f07ae2a05b22ce050d69470e5ef8b7b806534536a524de06bed4df481901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e8726dd8d4aeec65783ef38049fc47f
SHA1976f9e5b201948401a9896bc101dd58b91333168
SHA2564408770d5d9151f727f9dac28dc29e18535eb6b0dc6302ac58899a695cf06833
SHA512467b26cf02f70d4bc3d15d5a4ef1e50a45cb9f738ead46dc26840035b3bf010e80121d0b7040c95d8b552a6849249f97eb1c298a940f04403c53c87b92770b14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a119e51d15d939fee5198a5b00ad573f
SHA124b0196f1b4eb9fedb68f250d36ace1b74f7dfc3
SHA256c8848c12a571d5fd9d59ea4bea9c00a06aad767621f14f14cc33eaf5b1e29ffd
SHA5126216ea12af6a2399e38eda0409d6ad998e8638e7a547516cf4a7ecb6380534a66edda9f5d4b0f8615bee676ca809b93b81166ab5587059132847c0cb523d90bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e5c9f6fde3e2162942fc1c9ec7d5b86
SHA19a205cabc4b93a2d943d0dfbf302d7d0fc251408
SHA2567e1968e8d7ccaa414e3ae3bedeb3c9a6624690747490323d4b36c4fa5af34038
SHA5125837677616cafbab0512d6eaeee17a0add4c392d7f88a596b600813458ddf02de689859d800ca916f6c5584d300816194b114b99b546a213c5a037023a50ca6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5445fd533f9f23bf0f9cb9d999876a289
SHA1bb0a469f2ee8ec0f5bdedc23f7de5e3c653d226a
SHA25686f4676ffe8eca64bf36f9ac78af1507fd9bcea23566e922f97b0d0756e3674a
SHA512e6c2545e0f3241d1107aef86d9aea35c5fd329b35fdcbd070cb0410d06d53a2fd6a9274c307c189439b15d3d268c05c3fe13071c473db7e1568b0c34ab2ed750
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552fba2cb19a53aa6a9a94218c7deb9d1
SHA1d43cc97deed3187bef60748fe5020bd5cea47adf
SHA256a40282cc344643dd3c18da2601bb416de7cb34a3ca22e177b053cfd97fb7824d
SHA512311a70b29fe5448bf71a62d12a0d140ec81637fc77303fee4d2eb773c9d616030467b8b8ca68002db581c70e57002d8423c21d721a65ec3a4918e8342a3e509a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD550a6e2012968c86735cf1904533589ab
SHA1952e0481e6080da53e818956770c7c090281d2d5
SHA256893e073ae34bcf75f205da95e07ee76261a16e67c5216c237f0341b72ec83c2a
SHA51200a5b88692d69a8bea247032e894b984bc8c9007830d21123277edf91cdee282ded792f84e573b10b1f54b81e9624531f08189c49867ef412fe638a8146854dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5936c8186ffdde88688f5bb144f569618
SHA106aecbd1005894dc9751100ab6fc8b24ff432aa4
SHA2564cf12154c4099693daf21725b4c38f554f65599c6f84e8958e88c4901f3b410b
SHA512697057e5c56cf7bf922e9d8e1d2397ef0438a3a22b13d44b2c572cf746dead36dd0634dc30e3ccb84a20a7eb3ec91c8337ee6fe756530f15c4cdffbbef739422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522e9033e61ffd83fb49271556ee56113
SHA1226d07f6e78f314c36c2182cc919ca12c4eef9c6
SHA256defae02492af680dd59beaf80230a87f2308903c8665dedaddc67c7dac46c79b
SHA512297f764e011b7dde3521a49633bd40afd4f4ca12d6b06f8a60b6ee4ac6e9a1c6153d22c6f9c6ed6e793562d70053d476817a67d077e431a976473c53e735db0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5262efe5a0fb881206c942cd63a0b8ebb
SHA1bfdca20ce40dc8db30b55f2fd5eff09b3ec31c3b
SHA25659480147bff9f35f6bf3d393e7959232b8f0b4e4311ab74cf5d4f138409267b9
SHA5123eec92f83db24a4bba8790e1838ab5b04bae022a52502a5171db3f3f163748684927fd4421088d5789490affe0924b7cba86aca5ee24c9632c3ca4864dc4edc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD515eda66740182eeae80b61ddef416714
SHA1aee497a5e4117df44aabd659d96d7f8a898a42ab
SHA256d9fdab9e76cf6e42c816001b5b506a71d836c64fb5cfa047eb257a9c7b6b1180
SHA5127ba1479fff96426c6fb351382f9c286bce50d4a8e2ca6e7fb7033ba13f380e5e4fa88b67a6f5ea4959cac5ed154076284bdb2ae0c1622a6282d182f9be43a017
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b567d4d1b63ff444bfa16aa2754ee55
SHA12911d4dfd0e70a7cce8fb26b20654152d37b8289
SHA256aa77f567972e30b041e7685f070595fe3d9f0d695551582cc532e659290ad4c9
SHA51285f3ad6e0665cdcd1cf370181ab7d6b5dbfba7cde57eeceaea5fe6b6cc09052baca982deb9205dde856765abc027032148d0c1715ac8016350439eaa314a3ee0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b