Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20240611-en
General
-
Target
.html
-
Size
320KB
-
MD5
abe77c2ae7306fbb84906500f5383efa
-
SHA1
c73428949ecbdaadcf6983b6e06a149331bd37df
-
SHA256
5bb35dbf94e4afd60c919c8ea19ca615fc32971fa2877a89a1e7c7e6b4151018
-
SHA512
6f6839ea40a1fbb5fb29399570400c7edcf64cd8565bc2982d3079a4f9b458cdf2a4972fc2757b515380552ddee54357d83ad575a83087d74fcb84a6a09592db
-
SSDEEP
3072:ZjVmvoYzg37xhYBnlAN0tytQ35xXa7RmxSAEdq67E3ZbikZ2Joo6T6EAWzzH/p95:/37xhYBnlqEytQ35xnpEdq67E3T
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE72DF61-3994-11EF-968C-FEBBC6272832} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406b33b7a1cdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000046f95dc260a3ab3992f1bc18badfec55900c2650c72946f0d6600fd91bd1e6ee000000000e8000000002000020000000b0e45586e24142763d34205a0006dd501982ad5e0bba7a78263b69d716da6635200000001f1adbe3c011036b62e0981702c8142578f4a48b7c6d1b901f74168a9c2b2ed4400000002e12b78705dfe1b424e5a66e1902aea9a4b2a9f524ebe12c20393955071da44fdbae9f7655278b4a97494c84891d4725caaa085db7d1e36c35e4df108a51a5ee iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000080745aaad2c7b53822f6ec4e591e7a3eff6b4d2ecdaf40680a8a82dba5219e79000000000e8000000002000020000000405ce01e5e4c1944654eda679dcae46c863aed1d3436b2f2f00fb0177f858b829000000091ecc843411e5461497f8586f8f8cfff9d3b3a775af9554fb1248a8eb995ccb46c24e04c4bc97d9951388b97ecd810dea559a3fcb502c757d0d2f8bb7776cedcd61cbe88d714f165420f62bcba4c7f770e8a19e76f6788155ecb0f33e8a524ea1255b09f3bf40221e35b11f58274934f925b7d84553668707267f5a438fd832b462db245568a8fc3ba33b1641efb77684000000037be122cffde71d4fc87bd4e2aa48927bd49f81daefea732e15f5fcf780b64138878ceef5eb5b3dcc80a9ffc0b07af9fad0b10cd1f631dd8e3cda248143bec7f iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 iexplore.exe 1752 iexplore.exe 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1752 wrote to memory of 2652 1752 iexplore.exe 28 PID 1752 wrote to memory of 2652 1752 iexplore.exe 28 PID 1752 wrote to memory of 2652 1752 iexplore.exe 28 PID 1752 wrote to memory of 2652 1752 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD53d7112c23a3b49dba40b208c75022c2d
SHA1a427a1d57460be1c725301b4a21cc516e58ba90e
SHA256c456fdb6335b213205e907edefd6f6cd8382c04129079ab124cd1b5e94241aa3
SHA51215e277622fcfdb5eb9ae5a5886210570c49227b765d49d8e3e165892e3966b57378e27389b339f293e0e0fbc712921bb594d364273f6d5f5dc51c06536605b12
-
Filesize
471B
MD5dcd40f56c1e9452d8568be6819a2d85e
SHA1e7a40551bde00752f1a3170322fefcd03c796140
SHA256dfdf2939ecf3e5b1421109cd63d86140a0c03fe87b532c7ca7a5db8c7d85842b
SHA5121442fdeee791e446f95f5818f225c8169da29fb91f611e51a81798b99a1c823018e62775a065bd7040e674579d458f6c29116cc26897d09df5f5bcd1c3e44aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5a088ca6b56e82ee665d3e12cc8551dca
SHA1c31810b848aab637374a39131f53e65896ddca97
SHA256fe889daf74283c6b7ebfbd9ac4839de4d6d4cac6db0a7c840dc4b48fa4aa1650
SHA512cb5e6c32d5025207d661ff16e2b07b68b74fc01a758b628613d4ea2f4625ceaa9398d925d8027999f0c467c7243dd2ad21e8743df936527224c25d51f18c2f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\675D3640C79F3F2CEA3AA05E5FB290DF
Filesize484B
MD5684b62687fe710de26a1c601ef58a156
SHA19c07ec745c97a7951c7160fe161870d26f004df7
SHA25639ebe87cee80e2fdc275d4b4b9dd53a3db8afee8834ef2fbab812410019ef04d
SHA512412bf04fe542e0fe6186a60154a457e4d53cb3078c29d9dbab2c885595cdb398856d06740cd7b5fbe4376a2883afc598159ebcee2a721cac5c794b5b83e7ad58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\675D3640C79F3F2CEA3AA05E5FB290DF
Filesize484B
MD5a0b0ccc44ec74a37eda9644a92e69dc5
SHA15c0585f119e64f61c824260f1419ad415621b865
SHA256f7c0be0b8591b619dc8472ea52c1f7f0940e4b2aa7d2c7f99e076aa71fdd6fee
SHA5120157edd023580759129bfa8d741fc9a42802af402818bbb5242b0f933ba9a751ec7d442f44061059d78e6472c656e1bc5f2d721179d11373f5c2e55f8ec7f9ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a008b7b2a5733cbc8c09b2b1ca1064b
SHA14471c576535ac66ba44e39e30bb2193c7eda36f2
SHA256d9829ee32c7ef557dbc671257fe001cc5e8ac746c4c25ff0eda1cd9dd80c1b03
SHA512ea9cab4a406442e5b61583c4acf4127b3b472cb1216d825325cac30db711c9a4c2d1860590dfc821cd55b61629f61c2bd7ec106f2aaf4a5963b54128e35b55c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50399f609856d9452bd9da84993cfdbde
SHA16a1f52bf956c868a716072c9e395df923c3031b7
SHA256fa0757c4ee32686e2bd2b721e91b86ff2a19b7562e9827105f9d1f742ac30f17
SHA512c14f6eb8172bf59113d7f4d12f1496e47129aef74b791021ba8e8e8ebe22827d3793286f47da520a236fa8234bdf05f7cd51d1141ea0df121fc63f0d0f816c2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e390372ab3afe89fdfbd365d810e5680
SHA1404b994c9ef5a6f38eabcd5f4546b7d96a68bf74
SHA256a08f2a6483449e21a46d4a9207c1032c861bb538af90b5cb516a951c68fe5394
SHA5121180a89c7ba2bdd46f004d31b97be3bf25fd35cbcf2b2ebd75ee3caa1cf34710b959f68b814a2b4c9b647af800e4c2777077d9bc2e3f6073b795fbc5d8c95dbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5253a91e226f48e90b22d9ce64ae4a7a2
SHA1643ca5b06adf81aaaeb32d47372f583422ad8e70
SHA256afb2ff49fda8ef5a7724b783aaaf2a44c1730b7871a413edddf9559b9f9c434b
SHA512ca1ed87ebf2ac1562d2f561968ac688829e8b68412c1d3114b9e6f1b341e1c6a31f33553bfae50631b5006407a21658c6ccf1e9ff1813459a8fe8661639beab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bff42bb17a3532f0bdfecf1ddf0bf03
SHA19b96b80bfd7b54ce1abaecde2b3fe3551b7a7732
SHA25605b9d54acc0daf69ad00337393044a82ee518500f418341d833ae94a39bbaf53
SHA5125198745903a424a7ff21afb8b0e0cec02effef0a2622f435070af52040bbc2094aa19649937342fa9b8001302ce9414c0f92542262f4d5bb3c28804e1b602ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50057c31b869b669d32e58395b1dac80d
SHA1f792b40febcfba06ed9027bc6f87715f5b6daa9b
SHA256211587b1a7bed8b9c31e4be4b23b1b715658752f854ad22d9222abf71503add7
SHA5120d100bd28ef1667afdc15f48c9a1f43ef57bf09d05fc042ecc9b35fc3922b6bee9265021ba3655401a6f2d4607799e36073583f3cf621c3e6f1de90f2f2e17c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a61c550e40a04d04d6360c5b39d410d5
SHA1ad48cfe537f38452046dec6f523f79b388d38997
SHA256f27ef69e1604df2999627211b812ad630b72e609ba6cda4460a8ed7e374c8f39
SHA512ba9c8c0f82fe1ca465c47ec0f5560f2daa3d72a6a69ef2930f88a375df076a1d96dc37b24fd90c4bc8771e7883c755333c605d1e9839f07d3c5a8e42434aba44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a024288286713d160760097b22c805b3
SHA10518f882ff8dcb4c6983210ff0a64586cc163b27
SHA2560c3407f9bed18a700947b19f6c2e00badd6de29d86fa9f8042da8558e1ab4866
SHA5123aec5c7fb1f2e8babfc06bab387bcd818a04822f0699dae925332a705068ac6f876da4c450002a07911b1a5a1a7c513dca1c4adca5bda3334312867ae80dd557
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534f8d626d9597d9728f187f23d8d846d
SHA1fddfe85ee41df499e1545dc7fca04f76eb61926f
SHA256635367a627b4c7e7a12085560940809727a136bd0a748ab5b480c0e7497b92dc
SHA51289f3bca8f7785afd5558f00fe5d7b3f717a3641b4120c4d09e45f46b78c9525e2009edc962e219d6db31926afcf1c5033469a983c7868828ca5effe996e4830c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cd177f98610de530a66e3c04d2b11bc
SHA16d0a3fd51743a8b7707e24907e36f20042a1dbe7
SHA2563800b75399ae8fe07c95803b5cd530780987999bfdd573f5e341876f562486a6
SHA5129b7647231e157ac823d509f11e7d0070f545ddbfead2da49309ec79c35cfdc6eccd74719bdf5798cf852efc8ca4622dd33b1d2fad9e3501b983ea27878dd8e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e90d471234167b3edfd7cd4eaf0fd235
SHA1ff218b5b43020ceec0bcae05036f939263ff1a7a
SHA2564217243990afc7e37cc87462552bd786e30dd835fd317e6c18138b26c92819a6
SHA5121ddbb58af79e845c192cea73e4cef6f4a62a616095d1fdcea07d4df40f1170974dcca38c5f678be97df7004ce76d2673ca251733bf927266b3eb9a798e4e7adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585e070f7d342c29f33a9f4fd866cea81
SHA165860ffbc0ea64b845ca85aec421b033a3e32577
SHA2567df4c706c50a28776ca7663f0c942533256ed3b9389a3fc196344097c7e8bf5b
SHA5124aed46f03af9e961cf77096ba0ea60406480d0e43fd0d60d100add7aecb041b9a6c9c4c1caa163ce417704290e3a97348556a17516dd0ee197f1c072525a0231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57b16f2cafd0b0562e44775ae5c60c9cd
SHA10dac96891d43fded6bd4a06fa649e9b0a60d5340
SHA256b0e53beb60dfdeaef0f498290b459f5556d0c612b6f92bc2393dc6a904f72908
SHA51269e8ffcb6c9c93c1f62e22218aa12ea5a3c10f894f868d660fc7b57f9423962062301b46cbe5a9a8f90999238ad24a4d409843f7356f99d89ebedfea3c27084d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5928e06186bca3376a0ae6be40e1657db
SHA16044234e4c1a07af09311c2e6f146a5fc89389d9
SHA256f6c92b62bb91ed4cf7d2e141521a2a3e64326857b6d1952ad678453fab896de6
SHA5125c2cbd7cd8c7b929d7f030a5c3e7db24d2d3a0c6adac33dce7a3bff165eb0e0d2fc11ecbc2ed452c84a281a45f653941fac9dc0f053f652e4ea58e9801258dcc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b