eabb567d402c51623e0563016748fdb1b8d701b6bcb0509eb65f8aa05d694162

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lenin_Script/bordem_net full commands_files/i-3.htm
Size

544B
MD5

fc9af24a69d59867e76a471d8e4fbc41
SHA1

d22f3a0a75009dcf8f3c4d4eae065421cf278dde
SHA256

58acec798eba719aabce2b35660e51c60a7fdadc61b9812c895b0632f59f0776
SHA512

e844850539d50ece15c3f1b0d61f1d3e6b6b797941a8d8e411f17cefdb47d68cd0966223bcbac011a547ba6746ed3a2258715d7b346dfa46c7e4e842d1534302

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000001ada67c328e19e61d07772fc319b7e35ca6f360e4cb77f3558c26faab1f3005c000000000e800000000200002000000095b7b8781294fef0812f6572d4b5e71bcfbf0119e2201782dba4013cc6e44fc520000000c24d94bca7781cb9a5e519a64f98e7da15666e7f1914fa505daa0dfc8db3258f400000006305154d47009a9339716652f89ca3a9922898fcef128c66f248208a50ec966e79d6560d0ac9000714e99761e307140c73e8d4feae4a4d79e4349e773d4d93c8	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f2b6721f46ef6c4055993ba8ae183db3332605ac1c3a13ac613ae5e0c62ba6b6000000000e800000000200002000000092c761c8bce5ba1518d215d0a1d685295ef0bd774756d1e6ae8c27d16dd62b4d90000000110a93b98769a996a8bd5ef153b0fab1093088e2ef4fd1c3792aa1a70fbe195a72708afe602beda61c462384dd1e4df208880be438d2cc1d91d720323c71a7b1bb0b6466557fe157f648ea95716804e989f8146c2747733ed3dd3522e37a4e417f2770fb160e52e281e1552a8d7479cfec930df34539abdb18b432b220596a225852cdf0765ab1de635ecbd3369539e4400000004cd18b167c12e1d2f003d62f9d5ed3df8a7aa0aa193936b71dfc1add28daca677b55919b7413d3b005f10967a6b9719288877eabe6cdbab48c9155e50cece943	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C580301-A54E-11EE-B449-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409908520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50d8f8315b39da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1072	iexplore.exe
1072	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1972	1072	iexplore.exe	17
PID 1072 wrote to memory of 1972	1072	iexplore.exe	17
PID 1072 wrote to memory of 1972	1072	iexplore.exe	17
PID 1072 wrote to memory of 1972	1072	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Lenin_Script\bordem_net full commands_files\i-3.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1072 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
441f763ca7c9f86b197efa6f2689eb18

SHA1
597256843fceb83e8a1b74b4ca23f46b5218c9c3

SHA256
e00b44bcef4e1f69500262af5de334cc0e861e2433b5699b7631066fe86f3401

SHA512
a37068a243090b09446b13454c34ff33a26e016e9c66657e5b57740eee909bddfc48ca9eb0f4bc72dce8abc256ff2666c82b90ba371902036ee92d3a55bb9bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
743e76ee3dbe4b63e85b262d2199590b

SHA1
6fdb9855a2b43a873784b9b4bc4f53c327f75a9e

SHA256
9a26452eae5e4e824be3966fd613c568960f28c6bbba751ffcf5a5488faf6eaa

SHA512
c4c502c2210ab743fb21a2d3ed219b96f497a9e46438d6ab0cfcc8b1afb42522da54e1026cf5456916bdf90aef9de6156240674721e5b22bfeda993765a13374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e29df78499f2fdc8f17e0724e86ced74

SHA1
c8c879cc73f8bc26b79a33ad58ea9934d47ffadf

SHA256
bdcf059f67521c95dd929ebb7a449e9002fbfd3fabce1d87421306fc0380ad52

SHA512
6c842225d7aa93fb8521af9b9c64db5e71f685889152214acdb7c356bcd4c49c67d62328c5226958700a55db4da20c24b79d7f6de27fe6b88181657eeeeadd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66988cdbfc7110d568975ead1e09f66e

SHA1
f830175fa876cf55bc9100d2f98b3bf0fc86cffa

SHA256
3ddfd36b5f16c3c0c67c4737bcb2c72d83bb74f43ebde38e5d22a226280d0ba0

SHA512
a683c3cad8ea6eb10a79b7fb0db5b7ccbd2e68bc4c599ed119241ba34d78642daf21900b52de8fec157ede4092e50e5dbec7cc8812604c5a5f7a7933a3ab28bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2c2a3e41aa1144872d36ea01d07e4ea

SHA1
d9e358877963c322f8fd936530001ac5e613adf1

SHA256
a1eb205cd690c0c74c8e7283289641732a5d82474dc6ce2608143299a7e768fc

SHA512
052b213abacb420393fdfb4be09fd117d230a42d042605146819180b917e33d34a1be30a7984743145bfa87dddc4313868fc4d08d26c440b2a492cec5152579f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63f7c32535723cfdca43998d2b3efaef

SHA1
bc011ebe2d182e32df253dc23f8821c46ed55ac1

SHA256
cf446698de7bc3e5e83a203adb277325bd0855526c62c0d48eeb5e79a862bc8a

SHA512
761d1bc8c39877ca2266bc11edce8e1f1b5ff1ae2bcca0a3d4b96ade49ccf6541ec11763705029a5b70aa1ff173dd53577492f31b82386b1d3baafebea25cbe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40bad5743d49cc9b4e45ad59214cd915

SHA1
3e8c352b85885b42fd504dc804b7c6e2bb2da8f3

SHA256
d11892315a2b89b27e1f51e6157cee6cfce3880feb07e6027c188122d8c55882

SHA512
8448c895f4f0cb0a559bf8b37374062de0786ddaea62e57318e5fccf777146d760a39141f47df418704845139b60cc41f11719a1d272c65c1a0c32c4df2e4b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b47c17496ad3a03a4d1e9831bfa5033

SHA1
14da3628127668383068363b04ae9889cbd0c66e

SHA256
497a7280534d0b77b9a4d1c68ab19a32629758b08450723c9f72af40ed31c4a7

SHA512
2512db35eb21c1cfe74fe41d2c181f8e25e12326254d7a75775b76e70cf7b38af8f05fec3828c5539deba98742c5e17cc61902bb110e35232f92257d8d991164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dd0864ca2ca1ad911f0883c54ffbd46

SHA1
c82846ae4f6be047fea51fec9ce013533f2b75b5

SHA256
2a006549a7fb605c436f54438fb5e22ef7ccb1b0767f491edce74c0698a5496c

SHA512
0b8ac3d304e44a90e7cd2e40f9153f3e0b2ea438832e16d692aa5e9719927560d789042cc3b3505fab217b91b5a48ffe1dcbc6b1fcc50623bc36dbe329a9c7b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82cdd3ec73bd34dff484a2d136e39767

SHA1
c5340323bee9e6a5c1bb7688f45794a63dc53660

SHA256
f76961e72b5ab10de2b4b536f042f6b00d3af4c3d749271277752565c2c00deb

SHA512
436ed14dae0cf18e91b15926c93e957ec648b1650deeb09f380b462ca0e9f4340116e30d4858cce71e79b5009d00f26783c33a32905080c7af74ae2b0f47facf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bfe6b83ea053cafc81d4b969fcdc473

SHA1
71f8635cebf448bc2d717a670835f2e1df58147b

SHA256
ec7524a318c79689c53b08526bfd1c9f315b8975ec182a13c34a2bc0047f90fb

SHA512
02730933262fe96a4cc8f40be82f15fc678ad45027b8d137aec75248846b70883d75f8f9d9f16f6595f4b2c7abceb91d5f5c8b7dea4cc38aa47ec45995d187f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae853006a1a3a1b4d66e6cf35962c46b

SHA1
16aa16c6b4f833323689bbf04f18cd4a925bfbc5

SHA256
8016624173fa28bc29dbc3c045cbbc785b84518640835205b2da2ea0ecfc2ad3

SHA512
582403ae266c84ee2cee4921fc319ffe35166af718bf4036a4a283521dc4b561cc576cbd5628e282b70a0039074b739b19f4e2b16950ccddaeff1a54f20c650d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9762f689803d9b41ebb5ece33655c98a

SHA1
1b6b4f771b127f392e827ac694ae36b36814500f

SHA256
28ffbc8916da349f9ab60a4e8e1dfadb3ce758fe5c15039bbdb50db52a7301ca

SHA512
456fe39e44a2a706a434514c6d942e50b11444efa97aecc05c54453bc8365f40f3b4ae19e48807a4bdabdd136ea453a43ac5c2e74dc1e31d18a86fe4ff89e408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1c56ac9e49221645505f631e3a33a92

SHA1
dff2a4403eddeb01822f6d7b855cb8f5332ac70d

SHA256
f21acc95e4045b688baef145f69507fed7c312f3376495e2ad5987c442576b0b

SHA512
91b85694affe46d8f3203e549e86a1f23b250669db32f3fba345794697dc55a0b053a3a7f9db0011c5ee50cf4eee5bfe31837cbad513f833536af89cc3a2164b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
922e8eda3310616656d719a0c1469743

SHA1
6699b16ee1a6c900fdf19885ee5d06f717514141

SHA256
e1e22a118cbac1abb3afbeded44abd79be8924d28e0f27ecf9680ed27b869d88

SHA512
a3ed142dfcd66b9e5abeb2a297c8538ed64db1d31f791edd809a7222d03c3691862a4d37d35a65079e49d455313b10b5eae97c8570902e04da2eb73e285acea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D01.tmp

Filesize
15KB

MD5
29ad12322a0d67c8d626230e358ed600

SHA1
9ed12a8ab9728b54dd911b8ac68d9a2fc6bffdc7

SHA256
254f3f83f75a5c81c509aee08823f9c56ee5bf238529aa15a15c2e90d9f245d7

SHA512
696c8e5c40a5d6c179757a55b7e36affab0f2a887bd8d65330667bfd655eef4323c028d47fb6cf5f64175e19ab4641f1136c0b25706bd696274fc24af07e01f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D14.tmp

Filesize
61KB

MD5
2a13ac19288894df44a14671834bd9ca

SHA1
8e77f8eed4ef29265d9f15a9bf203c6ddb4c1156

SHA256
84cf33e7cb94be907088b55cd7fa07299aee66a36e438e7fc1574f3c2102706f

SHA512
638e23c72f3e977cb5de978102db94f881427e9c33be2609cf8e71c2a77cc0fa5795ff169c9856db6f6dac48abe4219f9027c43439616ae3a19b5d0c031c45cc

Download Submit