eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lenin_Script/bordem_net full commands_files/ads.htm
Size

3KB
MD5

b685c33e8a0997a4cc63987acb5835e2
SHA1

245640bf294fac0e48e1b8e579caef5af6c68090
SHA256

6d43cba5d05391f68a967f481bdc48cd21053cb9d5bb20858f893018908afbeb
SHA512

af74be727daa240430da53a2f3e4b09d3f961ed8347e5674efe6d4475f510fa06636aaa7ce18d6a23c1d777e9ee51b9ee59228e1a9c6f155b427f05cf37e5daa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FF672A1-A54E-11EE-88A2-EEC5CD00071E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008bc684f9608d31d52f404e526c251bc196f57d5ee1876186e3925121d4a0c62a000000000e8000000002000020000000586da217aade85ce56ec4117b0d47c7058ac35e7b43df25034292ddc6e2bfd16200000001fb7c61ad71d32c81025bf426055bc5ab581d3c9b0bf7c7e248185f5a7e667b940000000f6d7d71988cbe40463c718ca90a8fc9f53d14425bbcda6caaf8250ecdd5ee1ae9187b52491df214f20756b37fb4529d781c5ba5b9868c69d15fa2af94e8b017b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307a85145b39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000055ccb34e39e486523e757515daf7ffe512ae88524c7aaae056e4efd212d48882000000000e8000000002000020000000c87ff905ae19e7ea7b343261a149f73a7330ffac73e5091496ea0859cd2a1fb090000000d9dd62112e67e9d392ffa1cdad8bdcaefd37130f4636a2e3cfb1d064276d8ccc1340a181b0a8454ea30535488eb953ba3ce5422972160d98e2fc61f212a6ff65e0ba311bd1aa59fb3c3de38c71f9aac9af48233e5d7f2b55550390a8a550dd6813e60c1218480e68c3a3e5b46c49365d74a54587e9c3db69488520ec7683d7826281753e69d7a845e152a90d2941363d4000000089d5660a2b09d69a338cebe08d5607f0ddaa8b4637a1e7c02018257f23b34573c85bbdaf542bb9e9403c214b425d991dd77d74e85975ed6681027ee8d4d969ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409908468"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2412	3028	iexplore.exe	28
PID 3028 wrote to memory of 2412	3028	iexplore.exe	28
PID 3028 wrote to memory of 2412	3028	iexplore.exe	28
PID 3028 wrote to memory of 2412	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Lenin_Script\bordem_net full commands_files\ads.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68340847395f75a092d02180a906b9e2

SHA1
7f8e7390073b126145e33d4fcdd226596aeb6f19

SHA256
cfa384d1936658540150d65c1373b527316ee49f614dc892dac7b3c4d766c1b5

SHA512
9ab6579967e65c199a8b9fe09838d4e8c29f63e72baa8796f62a1f0e77c394e63ca67c966ab66d92d6b316bbf620cdcdfe78e601a23ac1d5bfeb4e58bdf47cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd680d09833fa4a32ed5a2f0c82797a0

SHA1
a9d908300bc4ae8bd16ccbde1da645af7eabb66b

SHA256
147818ed4239a6b0de2aaac9a3b143f47a58de239b545d58c56a781449c8f3df

SHA512
d2c350de2ab0bc82b4724f56cac4bbb15fb151083d8c084ef7446dd5c13ff8959032ebb948b1f2011666e5c084ac081a7542d4c26ea0a477d7e02bd9ccc94cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d37153169897f978ee2321b290fd6731

SHA1
458c0df76552f173898064a3ac8557e8e1ead34c

SHA256
c9289fffc3b3f00d7bf17709878eb4b13d08a8ee7d005987a5a9976899cb7967

SHA512
b15835cd31fe19c3a209a59b20a584f1dd1b880b2542abaa8d7406f172ec6525b513ec3348c7adbf3072dc5b3b736929f555d62c303930d406dce7e2b8ed3046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eff0c6b207bee84c090474aaf369754

SHA1
33d560ed2b419c4e3dd421ed726e84adb8c90fbb

SHA256
b1f956b595219ebe8ead1b535a89a842a985bdeaede2bcc8ccd6df579d25165a

SHA512
ad576184e2fedcc94f540b304247ced1b8e8617a4a48b703997fec2240f9c466dcbe666d5a2df8d1f1b2c598349ca7a225ebc4aed31c8cf91a7eec5054b4bdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8da5f1bfe79550fed846399a4e65b281

SHA1
682482a03448383b0abc5c81da207ada18ffcc93

SHA256
ee5fd2680cc42ab2c6ded25696ab43aad23544d00d2e6e87127e67e95d944d5d

SHA512
44940510d1a7fe8c12c01424ec747a7ef31880f63a3009b527e38006050a5dfdfa4113f141a976e53704e7462860332f1e652341d9381fd6f38fd22b479a919d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ecae44175dc2fb9ac2c71650e632536

SHA1
edd5bffa83c2588fcdb24ac4a98262244a8166db

SHA256
649338992820aca6fef128da45f25aa59815af82e4308c051fe3ae4b00826322

SHA512
b9ab06dad17c1d76b2c98616ec97e02550a73d56e44b4651601d1529bc1335ab60a76be28743d76336a5ea95cc576f31fbff1b1a6f164944466b6eaf25c27979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12280596c92d50fbe00e259d5ca91cba

SHA1
828a576dc3df8a0f526d8bd25d0c129c89f646bd

SHA256
2656f13710bcf228a87067cf61e3d8bce8378fffc013923e4df7c92f15f9ff85

SHA512
f2b98de6f37455b5ca279d59dfd17c332499d4a13f0ea7ede0f067ae3b0fdece88ab7ec6a0c8ac9d4b611b1b2dbe039d333de34a47999c317f109c6eac955ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f001b8bd671bab6a51b8a75b5897fde2

SHA1
d5a623a785c9a235c437790b418f0116403c4ed9

SHA256
44938213675599528a61e754f55e5f5938c3c16616ee1e7db2c91bcf312d113c

SHA512
adef544fb56a39bcdf6e6ead82f00210f48bc57aac35af9bfc65d000cc65009b27b669d0effd10b5347a82abcc8e134f7120fb457b7f6f898819988aa743f301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfba0c618754542a30bb82b84a238618

SHA1
e8acd7b211da78fd52f3db0e883d038628d230ab

SHA256
bef4cd55b5c7ffba8b4c1042c574108a043563196bdd579e7dde2622a9f3b4b1

SHA512
5bec6ab914db3f3e931b379ccc27bab72257c06b3d31a4a16fbedf087326e7a05885d4111213b1623534cd1d944dc46afab5c3d66e3cf71f3a3fe39087cff79e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f5e438b002db62359ef2912b40f7ba

SHA1
ce1940f9a67e701d5c8b93b0a80f389854919281

SHA256
ccee381b1f618d6c440f3ed1ff46879364490d5c6c63814340bab7a40bd20e65

SHA512
ed55f2c89a0c651db12481613b146fee19a708be9ab20c140137faf460e045d9e0896852d05419a3210596c207aec4f24b51e5c26b4d5643965aed7981f6d864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80bf9c94572e0e640c4d226489a9a59

SHA1
39cc334a453513548cf49b612ac9796aee0e9fdc

SHA256
6682cadf7e42232eff764b904fd2373d1d6d403107cdbc7a04364af061d1628e

SHA512
5f5a928fe6a8f459d276661336f85d340ae8a33d5ce5aa00e59f31c4a450286b4488c501e4f3f4d4591f61743323d6de76b01da8b6208d87122ab9e973304c5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275aeba5ba53c20356787492630f6ad3

SHA1
64c52da6446e6f52c0464d7124c0d43f93d03471

SHA256
dfd93f265e0a891f4a707e34f66ac98474dc0183ac502d7ba2591e9717a25f9d

SHA512
c9c40f39a0abbd3aee0b9d7419c27708183915505397b165089bb6016e7591ebc5121bf3f778e5f9d64f7b92e5db064412d55af27e6e3d6c8f25a7e141a8648f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11d45d04cb01f380ce6db7932c17756c

SHA1
726dd9038c326432c0ec81fa70728aecbf8d0a1a

SHA256
8185fc832ba307fba318e922a603f1508b01b6c50c84380364c38c4cace47766

SHA512
e45097cee757f674970316a81bec8cfc1bd0951b9e558cc8f61f91385b41546e9dc5367c70ad06f10fa9bf7b44ca60f39831ccb724f10a848d950147fa83ad4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39943b5835d84580b71416279ca6803

SHA1
94cc944df75917e333a50a206a484c6c81ac5a7b

SHA256
b4f7606730d6cf881dc847a63ed4e03e2a2a280ed8d7708e05b4d8960b0ab81c

SHA512
44b48dfcd48d3481160a8adbcdb6c485ec1006a04060edaa21abf8560bce2885144e8e63e618c9e1279577842239e399d1ea5dc924f18356e8cdd209cec2c9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f4582d83404aa16b075c081392f590d

SHA1
a7a2d8d58372d8b7cc23fb81c5102efce86a41b2

SHA256
34961dcbd163073b7cbe9a8683c0db44e8bf904d25afd69f630dbfded97d63df

SHA512
699a82949db7b5e5ce043cade547e3b4df00b5aa1b4be10b1ae3ce56246bbf4e691f106a857d4a9d2bf3fb78d2a37d649bc754f1fb4c5dfe8dc14c3816617361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
290d5a5cdb552dc10baf26d16a2a678a

SHA1
e9f0fe388b7967fa8e9c8ec50cb5188b673562fb

SHA256
4f0c645f2946fe8dc52d9754460067e89fc96db1ff6bcf1dd81bd16690447e6f

SHA512
72787175b3dbd3f2fecb390c50fb914206d98723dc5e1b2c60016bedd7053caefdaeb9f9265d5b719d4f48fcaacf85b594f157363962336985a404550aed82f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2745.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit