Analysis Overview
SHA256
373038f90abd4f4195e51d793f26e657c876997a0591ff4309f74aeaef701a7a
Threat Level: No (potentially) malicious behavior was detected
The file ba53e28462f5be2540824ccde6aeb615c2f3d161.eml.tar.gz was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-19 09:37
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-19 09:37
Reported
2024-06-19 09:40
Platform
win7-20231129-en
Max time kernel
121s
Max time network
127s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b680c0140377d419b25a2af00a00fac00000000020000000000106600000001000020000000304794baef73a3cdf6482247de3eb8bd8f97fe81e94f8eb922f79ed06ac2e058000000000e8000000002000020000000d0cade1c1f36233119a01cee11e2621ce4a5ed5980b17ac965a35f3d41adc1bd2000000049557d8a2784eba9e587da1ee46abe1a073734462a9ef87495e259e6e5849196400000001ca41f1ecddb31d5e285b308555c0bc6e0d2fdc091a66c8a142d7b973a448b7915bf4fd1511b22d9414a5c79e2e8a33846dd0937637891bda6627ffa3bdcb3b0 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424951750" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bcd0732cc2da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F4667B1-2E1F-11EF-882F-5E44E0CFDD1C} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b680c0140377d419b25a2af00a00fac000000000200000000001066000000010000200000009e7d327ca662409d0e9ee7f60e53fcf1f281a7919870ecf0917301dc9168ba3d000000000e800000000200002000000005a19ad2f7390afd43c148c9c70be5b4908e31eab3795fdf633c137fb3a036dc90000000411718f7f269ca86f2af0c244e639d3a6360454d7b9e0fbe645e60706445ff13f7da7d1e42b631bed85b863403cf7ac74433b847fd231cd9b86e92cacd5b1c9f6d96d975efe60e963d147ce4d7930d166de8f8a7ae317932fa4e3e107402500584ee7fbd6e66a16872af5edbd781c39f9707e46e2253e86aff0e6252e76f0b3ff89aaca64a4ec4d0203eea9f61cc6b6e40000000632843d92715941a695767f49688b7987ff2304b3edc95a0ee9249b0a9ad4388253cc9504ede5bf5ab24e348fd4ef6e93976286438ba453329b01669996c22f0 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3044 wrote to memory of 3024 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3044 wrote to memory of 3024 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3044 wrote to memory of 3024 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 3044 wrote to memory of 3024 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| BE | 2.17.107.114:80 | www.bing.com | tcp |
| BE | 2.17.107.114:80 | www.bing.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar1FB7.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f4a36db577d6879188b50e5b1fafd8cc |
| SHA1 | 3d3424a0c9d6817948ee9c02a3730ee6796f5210 |
| SHA256 | 57a6bbb3e8b0cbf9a35fc9c15132ccaef097eecc25b569c28ebdd91f4db78828 |
| SHA512 | fe10b3b3c6ea9636617be3c0d477fc9e62a94ea5da6c7c05ea84cdf524676fa3c20d96da670a368bc5508a577dc15694084c68175db28c032c45f8a1c89461c1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f7f51d0760f6c92d1d551c3aad720314 |
| SHA1 | c374f5d5f7a861b809b8813596db8b1a7166296d |
| SHA256 | 5d765799679e7a2783614fec0c4875d554121220cd944f415e64ea5d33d27c6c |
| SHA512 | a40c573316f4e39619a945d195fb6292de8f0cce98aa25824472646a054ded7f84c8668b487f9ae6d564fd3ec7f6f23ff5dd6f2fd2667205190d4b6d447456a7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | c9817f46a61d924cfc4d06dbd6a73da8 |
| SHA1 | c3c4a9ad304f219cd3938dba91c8d1114a36005a |
| SHA256 | db8e4d404984d8ffd03f7b23a32357aa2f0accf1f28d732a5b3e743a253eab43 |
| SHA512 | c4830050b03801f6820e6c62a8df71c58727a8ec86e4d98bcf710cc95a0adc5d2ebb8a0242d49c035b8d9a6b69d547fcaee414f9b1aa392524bc6538d62032b6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 28efc11f0af4e91d4972d37bfe687c96 |
| SHA1 | 55a28dcdadb8c968a46cf7fb9768e3bb1be204e1 |
| SHA256 | 695b866f8f52575954014c7f506e7cc08ecd11871991b96dc72b2c377759f697 |
| SHA512 | ffca9ed3b0f2472a47e3fa8adad0dc5f3df5cb872ec3f3c1ab723f0c082e53cf57c948fa935e9b8e6e758ec4ef0da66479eb54bd5e27fe7944bfa8fd0cc9d9b9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2da8e8bbbc3d19c452ac583118dbff9d |
| SHA1 | 1274a37766f589859c40c339c03f21f335506494 |
| SHA256 | 351405cf3e10b396d582fcc8081b9dd447a4cc73f3a8245e25658ec48be7fb21 |
| SHA512 | 0ddfcfb00114fd0d0fb9d77811a6ec133b89ca320a58a69dc1f5b6d71e215aae41851c80dbe185909dbd4976854a4d017400c6ff14c97dd46499e8fd0ff4f680 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 9330bc6e6cee50a9eb083a5f746f49b0 |
| SHA1 | 14deff15657d9bdde4035a39943df00da40cae62 |
| SHA256 | f9fb9470fa7c3bc75386dbbc180584237c9ad482f6373b5e4736ca328362480e |
| SHA512 | 0bc510a12f14a985ace7c9a25d04ce77e9de56d5913cb98a27c0687c437332a1547972f24188051477e7ed2273b8e0b894bcb3a61fac9e059d09b7c44b638384 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3ddc1ac7b859906be25f57c99c75afb6 |
| SHA1 | e719b968ec8ce6ab1074d238d7b7b5260366aa73 |
| SHA256 | 95552bac3fd033d409e55c2dfca2bae0f8a48af5747fe04d75b6c656dc7deaee |
| SHA512 | f7b9e7cc1de594a5fc4fa9745703f00d54825c1e5cfd95742f9d50d971c5f2a2beb92cbbe7000fcb24f1cfea7c6334f35aaafbf39f6f44ebeb95d318e3bfa069 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2f2fe63c9467e0eaf70dc9c2c98f058c |
| SHA1 | 3a97c154e12388397d8e0de82dbad8921b9929dd |
| SHA256 | 0b28d153a5fb3643bab1e38102f5164b2cb6f443b0cdc9a5a967518e445199ca |
| SHA512 | fbdbcce05bf7b0b38aa6e632e5a591f70f85b7b61115dee80941da4fcb9624c99c70f03f0f7be7fa03455f3b90653da6853bef933106b19f3af8e5509d65dd2f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 647a1a8c3b357fd56fbef19ad0a0c4c6 |
| SHA1 | 7a5a1891f54ebc2a74f991f63fce2fe60196ec43 |
| SHA256 | 19ccd27adbde7beb16f335e5c428e3ad84e8526621ac1bff156cfa1f84d4f22e |
| SHA512 | 6a68f00c54d65c28ad9341ba1e89fcd4924728f928eeebaf5cae8d27a50163142b43d7511b27c55aa189534df0e484520e959eb7a7b213b2785c183eff27aae8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 81fd562f5d15d6d90705b304244c5cb3 |
| SHA1 | af0081abecdfc5b796a34ce2274da8ddac6e8eff |
| SHA256 | b6e044563c7b25b8011abbbd8cff05b0a129eff036667c2f6da3e299b52c1575 |
| SHA512 | d11aa97f3087a746231b8aa3a7fee32c821d62cc65b4df8cf4f45595c9896b13ae93a7bc4c93b271599400dd168c567719f811af3006c14acc0ce4bc779bd965 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dc79fdf637ebbe381ccaf5a1d366f84f |
| SHA1 | a4a104cc340b8e0406c78249f27def8a2f1b8168 |
| SHA256 | 213d7542a1b65bd49bc5c405e5eb1892b6a28e4e7b9e9277d9151508a7c2160b |
| SHA512 | 6ae194d1c7fbbda8958243abb0ad5efb3a75e6c11b0c731987df71b59c83572bb7e2c9386e9a590fe1b07b018e1d2f5dd11b7c759125b407c99e0b306bd4ac7f |
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
| MD5 | da597791be3b6e732f0bc8b20e38ee62 |
| SHA1 | 1125c45d285c360542027d7554a5c442288974de |
| SHA256 | 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07 |
| SHA512 | d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d2ba44052e88eff7e715f30c876581b8 |
| SHA1 | a555f22bdc02ebe8a88d4d5d7e3f533f6e08baf2 |
| SHA256 | 229ac22be78a3949b87a6e42d73470babec42c04bd8a16df7c50dbd82fd220cd |
| SHA512 | 84be0bb219c4bd744084df1b82b694455cbeb9bf7794b294ab8caa4288abaad4d774ca4b9efce50805f78e64d1fb24277d64520e33ea304a079ffe2263811526 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7569054f704c1e34698529021a3b2823 |
| SHA1 | b1a9ac5b79cc52d4cf06d8fcf4894f191940fd08 |
| SHA256 | 04178091128a223cffe7c66dd46387b4f7583095e89331ca9fbf60e2942842a8 |
| SHA512 | 6e4eb38020e49a41449b2baf985710f1809c03b50aaa201ab2f02bb45d5a8d93207940c119f7a112a28ca892237426f8f92d7d9c41e82566eee25f16e15164a4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 5a76a9ea0b00cb6fde4457de25c5503a |
| SHA1 | 22a7df5d9690869728d015a3d32fcd5067ee3a17 |
| SHA256 | a516e4792739061b0280252d75e69ca3489d022e2b9ad683cccdc902d64a6895 |
| SHA512 | 1d0090ee438969ab0a240a8698554208b02d66f7596cfdfe919d448fb8c2974084e889940f416147ba016fdcc7f129973b5f999e444d2e76282a584b8c8d8f4f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2960d6277d4bf4fab85d027821e6c8f3 |
| SHA1 | 0e90e6a73a29e06efd87da79e261d2d5ca6f572e |
| SHA256 | 7d98194a9373400a6e38ae4124072cd802337d82f7e7f7b40cfc4b60e57cf202 |
| SHA512 | 4765bb5d794598a37ae60e8791b0dd3c0519dce06cb01d6b00e53093671fcf67338421e463a70b93e6dfc834ca6cb502b5351c09cdb9c71f7192b963e00c7d3b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6400f8c2bb632ac85d41ee99afadbae0 |
| SHA1 | 6a31ab3cc5b1e58837625d57ecad929411af3a99 |
| SHA256 | 2bf906a9f753f4710ed2f269e8887854173c17b18c7f6c2959e22cf1602cba5a |
| SHA512 | dc54a766e5f1ae497b486d435f396ce54e29a8d243cfbe79552fd83d48fc3e463c754790488c22c3b584ff7e0c7308ba2c57d517f35d445c522377c321cc5385 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a9f9ce6271b77d09a1e384defb214409 |
| SHA1 | ca74152243b8e8918dd81da30890d1b398855bb1 |
| SHA256 | c4b3c0fa211b2a7683f05fd6efefade11169e79fdf231a7a4ecee53f0ff45b33 |
| SHA512 | c35307222401c443c6f0a03c8ab810b5f89120d2a1f47bbea58f648469a4698365eb4c4e922be22162e7f12d2350a304a25e2d7cb6b3f1724929cb4cbc5cd825 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cc468f7d8671db9bdbce396f5ee8c4b7 |
| SHA1 | 9312018d427d75e1982615cce3ef6483e8d8ca2e |
| SHA256 | a9fbee80c9201864c7348267de8c2741f5594b25f98e18a2ff5b585b67d74cc6 |
| SHA512 | 9815859ffd5bdcd1494a6a192e75ac19aae112b2ab07cbcacf48644e70fa6261f9429bfd578448d5368b2ef252667270319c267d09b114fc79db45d3777efadc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 855b50827b678c98ee4ce4f6b8c19246 |
| SHA1 | 2f65ac82b25a65fa67ac8ac3552e65de5dc8c119 |
| SHA256 | 95d83e149117d7df9f68b0a739c2a5e344980d6662874c4cebdc014708b56c1c |
| SHA512 | d62321905cdb4b6abbf27a861f4f27d4f305fb05b431e6fbd632ff2656713f1180c628ad43f22d41a133168a2a7c29957a96857910c36d09f76a2f18924fdc19 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7c56f4d069226f6bc112052d631c6e99 |
| SHA1 | 086143dd81e23f23cd04223e8b6156780797755c |
| SHA256 | e927f4425f7e1041c61a3d4a4c496b8d80fc8788dd01811f6fd2dda6e34c64a4 |
| SHA512 | 6baf8366097f3dde48995c7a5dbf922c6f442f7da80dfd343188565d8a1aee5e9be2673e35844370e2c5b89d18ea9cd660cc82a2d4f9b0f334a5317f1d993d47 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 676da269b71fec2cb76f27353c6c02c1 |
| SHA1 | c0af91d86770f6d9f333f555a73f4354c5f797df |
| SHA256 | 635c25e9fdf3971866aec3d76a3ab2dc6b00e49a3bb249400d2d9d9183dd6f01 |
| SHA512 | 8786279a506821ff633ad73154d1bc526411ce9063ca13682d8ff86f29dd742150fba74b1dface2b101a52a1717a6f432cdc9fc4c95f195616910483e366bb0f |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-19 09:37
Reported
2024-06-19 09:38
Platform
win10v2004-20240226-en
Max time kernel
14s
Max time network
17s
Command Line
Signatures
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5432 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4644 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5612 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=3752 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| US | 8.8.8.8:53 | nav-edge.smartscreen.microsoft.com | udp |
| GB | 51.11.108.188:443 | nav-edge.smartscreen.microsoft.com | tcp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| GB | 23.73.139.27:443 | bzib.nelreports.net | tcp |
| GB | 2.21.189.233:443 | www.microsoft.com | tcp |
| US | 8.8.8.8:53 | 164.189.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 188.108.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 158.6.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.189.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 8.8.8.8:53 | c.s-microsoft.com | udp |
| US | 13.107.253.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.253.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.253.64:443 | edgestatic.azureedge.net | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.253.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.197.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 13.107.253.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | wcpstatic.microsoft.com | tcp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| GB | 142.250.200.42:443 | tcp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |