Analysis
-
max time kernel
139s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 14:32
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240704-en
General
-
Target
sample.html
-
Size
34KB
-
MD5
0edf0c035dfc2247f676595b9fe7cde3
-
SHA1
ea598f865798c4360f351c6e5d13691f94dd75ce
-
SHA256
68b6ba802bd249150307bff7ec1576abec09e056a973a4b8b0eea00055d08edb
-
SHA512
ef57ccd275678997adb1ded956f494806ff8808d4bfbfe3c87d72a5ad75b3c5ba1573d588648e8bd4fad9302877f4fb2825bb38b50538f868c89f4a201f59c16
-
SSDEEP
768:VhDcaNu+EYsaSVhYVBE5qIMVbZ9Wk3ZuvjBqNa1AHvAAsW0DUJKAb3q1HJt1x1Mt:TDvN5UVOc5qIMVbZ9Wk3ZuvjBqNa1AHP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000af3691b9290c1e84cea0b7674f771dbeba4dc7a9add6696ba483ae08eabd7f39000000000e800000000200002000000062342483d66afcb956297962864966c7801d1bea194cc95723c9469bc0304cb4200000006cf2c29136439c73ffd6780c67e5f0849a42bc45de0a2da5a6fa19e8a64c2dec40000000428e342fd346c56255545d73e5cb643601df98bdacc0e056ab1efcf062484fea19c679b774c516ba845bc50ab8c3e9579665ea570f13d49b0cfddcdc5362f8b8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006b058283b5cd2fc1f1f676c8c79c2455e1a7c6abdd36407e1f7da284f2b93b55000000000e8000000002000020000000e87160c27d9e0cea96a1b57f83d5b8879dbeb5f8d1a28cdf646ae147186508df900000006f3d4d0fbc2c5f885f4639c7a317495591e127c71830976a72a3a39b6c2bbccf57a47e2cc6c3226299876d43fa4559a374bda527d0e697bbd7095509dbd0e073d1ae79b51a4d9a2c1586985f13d557b16d051dda35583af2b5e00b531abe4940350d737927cb5de34c66ce520ed45a3c8b53feb189b901536f33a641f46d6e16753002755b7ef55e08938e3c1e1142fc40000000bc47829ce146e55f25b508337200e11fc1e5ed947cecc644ec9030e23cfa24b0dc4c1215e7254616ff750bed4bce4928b4d8026510da20f5aa33057f7f1f8d61 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426641024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C4376351-3D7C-11EF-BD1F-566676D6F1CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0191eb389d1da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2732 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2732 1932 iexplore.exe 30 PID 1932 wrote to memory of 2732 1932 iexplore.exe 30 PID 1932 wrote to memory of 2732 1932 iexplore.exe 30 PID 1932 wrote to memory of 2732 1932 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53ace3ae25a712aad7061bb9b65cc37e2
SHA161498d2550721705ed9c8be1ccec03378f2955f2
SHA2564275368bb2e8bcd0554c915d2237cd3c6bba99eddfe15033bacb61138a39b7ee
SHA5125cd07210e6e4c59cffcc60ee6e3ced43ce01bf0f92e1e763da7e5246d5f6d192e8f87de9aacae709d53b6d23fb24bcda800703d6bb1da0963361140776dd498d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e958602044680144f4b96ac5b90e1f4
SHA1642c4d2eecf6f997473d06909e67a425f3fa517a
SHA256e515e07fe4972eea6a5b41a283509e24f093c98ae7506bc825ac4ea52f719a9f
SHA512b70a6044b7bf1d45497bbc9db5fff320029a0b4e5983684530645b7d9c361fb6f9ace7e98abb68698c0aef69e174329895333613aefdc3b556421d4ba2aca69b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d528f2d328d8b4e561bbf9a22d45db91
SHA17089012c1ba70cf23245a93eb84771b7b3244cc0
SHA256e9232c6d99eaa7d241c3fb4dee72a8ed3cc48f5c92b76258e695a8c48c482ee0
SHA5129ac51cc1e4e78d8decba26dac1425570b19ce62282fb43410dd1e2a38ae447c7ec0591a227bb4a6f5edf80dcb0ca1d50f315fed87a2201b5fe626c8dc79b4472
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5840236df0d4352001ce1e8a94e6e4b49
SHA1f15e13c289253f782f010f8c1681d25c719a6a31
SHA256e96aaa42221b534000cb7c0db3315a66ec31f07ddb1d3027eead53b64d221099
SHA5125569df10a444bb998d25509b10e216894fcfbf929989d74fa6b99287a2afbaafb65f5ee0c256f42b5c29e72ee1641f1d5d45a079b024d36dccbbf1850dd707b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59196da02297dd24a38ff335223adaca9
SHA1f7552a4e465d63db106bfe86d61b9e8639f9adc1
SHA256d1b898fc65cf12440000428489f6b644f1835713b02ccda1dfad620ede184a64
SHA5124a88e849acae477f707df7a31b6416016508565354a5905cafcb5db0b4d96a61696881a2f0343f7571fb4ebd54ae3e1738de98833e0c0172d346c431e2e12878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c27409218786480b31d365fc722ba692
SHA114819272ae94d75bd27b65a0e5b0e0f01c4e6057
SHA256c693c95e63c4919fc5e02dfafabd1414b95138bbe0f011aba2eb8c3413626ddd
SHA512d53d9e52f1b73c8c38c28b90cf1795c9e578b2444d815219c256e1c13fdeedc8d150757e9bf6d5e64772e2b7b2914706e525de5844488a7decfba57c15046058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f13bb0f4091330abd93f6f71bd9cce91
SHA16b478fc723dfeb9fc305b9f2e95bda35a148c1c6
SHA256222d1c6507bb8d9e29e0bdc39c658c41fa55f2b973c413061c960f48a8b71d5e
SHA51235c5617939c9718d8b0602deb66811d3d530d9eeb1d154a6e93c7982ce36de0326bd89247962df89e5f51627b6c4384f3e5f95c2211414ddd0c22114ea26c397
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a4fa63d67b23a273a69b3815fbab09b5
SHA1e78224d2c9d0513e0fcdeecd341c55937486bbe4
SHA256775c055915734fabc16770483b44d5214ff5e6e2f6743cd5e6c305fd71126b0b
SHA5124745f246817dde0ff380bf64cdbb6ef89f85d851906c1f9a0e55848355ec466056a9eb5047bc51a59205ebfd9941bb3aa382bad024b7e22243165d5eca44b21e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a4716d8b784aafd74ab2f0eb30c1523
SHA1c46c48e620d26200adead81c827785ecb3db416e
SHA2569cb5a1e928afcef62e697549ed0b96aaddc09097da47c95bc982487048e0bb2d
SHA51232eeade8bd9873b13c16aec6ae69672c10086ffbfb17a0a46fbe0a470e3be2944b17d7c7d2d3824b6828b34f262641e5d5f541355f0a7567fef7fa5228c80468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589c51d9dafd043033b486b82bdc140f0
SHA1078f7e97d5ff5a71ff44362eb07269e72fa011ef
SHA2565735a843d21cd59eea984b78d26f50c6302dad34afc13b8db1b699a87f5f9b92
SHA512ec8de5ee473a2f3f116c5d087eec2e30b2c24f57a6825f3149f62dc40c1ebc66b5a9402499935cc14fb27ac1c9bf2fa6f082636083e4e63a7327db08a51e041c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510721673784ebef831160978eaf614aa
SHA19710ab1b8b9b57b9c0479b742ebad597ee00f0b5
SHA2562280e6e5c375a0e8da8709d088ce7fa1bb9d617b963233af92a479141e35c0c6
SHA512b6d77af21e586f8d123ee61e6fa25e862b046d5de13d7d354a16f1cbfc65210662cfca561a8dbce8c6e5be352b9486f12ae8372df7e4723561061ca96246ca2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f46ea81ee07761377e9558707ca4567a
SHA1220d5d60750f40d06bfa991553599e44b01b1933
SHA25688fea66c9bba24133f068db6056c3b9ef99756adcc67ac0d2671fe4e301ded84
SHA5127eb38b43030dd633dcf14368b4f94573332b1ff28b5fdb08438aeb8f59e088fd7d5ce7e57f7f294c77060a4897b3bb6aa349a74a91648fc6cf5564f82fac8b19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f24f778f022659bc2026f9f207ae6383
SHA19af9c3e2be7290c8cdf634854f1cec53a9824fc6
SHA256d12d910f8aeb3dbf21b00459c3352ccfae287a6280685cc006f304b6d0f92577
SHA5127a381ffd741ccbb605e98efbf91e763bd7c8c04fd546775c2ed4a39ab2842834902ba776f7bea7d6efc83ecb5e31e2652c900239b3a46cc1534a02013f0628ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD522f9f4538a0c567eb8854dd8f4ec51d6
SHA180bbbbfad73fc3027e536fe47f620aca85160714
SHA2560b1dba8be79664e0485a6dc4816a5d06156fc8c6d5d746d75c93ceec2a65350f
SHA51250a41300bdd5edecf3b7b7c5a28fd69d6ce2d34419b600d3f65031290908aba8976b32777fa89963529c5dea7c9b0c32d4d6e9fce59febccafee9cbb3948115e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fe88169827c2c534aabd57c7d39b215e
SHA19141704d11d522baa8cd5c77c4eb064593f79de3
SHA256a04e8feefe92022f8b9916882142a9d65bb00aa78a2f4ac75128cf2ffe3092cb
SHA5127eb9517715137780b90c0d8f6862397ca89d55f6966dea93f36c0f697002d1a223bb39a1f81939ee9a20cc9f21ccf89175919978ff15894e7ad5d5f858311260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc94f4b1824074d3c805aecb9fa4d981
SHA115c3170ff592f4ec2b0979c4491909bbed4ec887
SHA2564fb3d4ebac00394032839f30e119611d2c1ce20df077d42f798f195963771759
SHA5120e5124832ca8bae8ad6abd629d433d50c93144be736d459e9298f6e15006430c90354465253cdbd0a2ecc1a80540f4109343313ed7151f1153f8f2b8daf62b3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bbfdf266a1368729334de8e419c2c78
SHA10d4dcf55586405d20c8e69346cf8d250c69602c2
SHA256a1da5bc284067a4d9f4811a550774418b1271c2f9abcb1b50a7bc6a4c0257215
SHA512b4734c451e0cef37d3b2281667460cf5d41f6e46c42ec468375105d24d7c9ff03da0e7721072a42031e9f828c4767ddf069713dd1024625521ceb9b090115e07
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3KB
MD5676a207c15726afeec47ba5edd3cb8f5
SHA17a488b82a23f60170586338d09a2524059acad24
SHA25695e0bf8e716eb5b108eb5aea8c2e6bfcbbc4bce6d89c981090b1ffb7d32a07db
SHA51204514d84644996847882217e126be0ca3530c9980ec2e869b3f2efadf93c1623cc5fe588290ed079a70e92cd826bd697f7bc368df8cf446c1e4eabfbca776ef1