hxxps://www[.]espruino[.]com/mosfets#[:]~[:]text=MOSFETs%20only%20switch%20current%20flowing,the%20source%20to%20the%20drain)[.]

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 10:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.espruino.com/mosfets#:~:text=MOSFETs%20only%20switch%20current%20flowing,the%20source%20to%20the%20drain).

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d056c2313eda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000fe471f4c1a1acbaccd2bd2b6588ebd106d8cf61a6fe3cc80a22fa6f5b861b0c3000000000e800000000200002000000007d41afd1ed0f46dd18225a589046199d8af67aeb07ee415167e1f5444ead3e190000000691cd21fff5b8ecfa00efea07186932ab9b3477a0aac12cd46250d14b629ba3a486e1bed88d4a3a7c000e6380a70245e27b8d7bec8ab422c89268ab101cf796a397ddca1d91bca29be0736d1e63dcfa4ec2187c8a27a77fe1dce8210988e4bf50b35073b9e7a133f1d528423e0112ebf8bc55df19f25113dff53d916c5cdb5e9d1e07c231824f1a16786ba28dada5702400000006d990fc02830358f271471011722025724cef2f812d5d16104e02b0e317fc961144ac566bb1a1d6e112ee289df59c2ca1ffd647493a07e5fb0d520fe2c3ae21c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7D65CD1-AA24-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410440471"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b7cc1869e2f5abf4dd0c4ee6032dcafac34e67268c106558690682f87c433f45000000000e80000000020000200000000ba5dee8c101112a852c7389146d3e421e82a133cf12aea5685432d0fcb8bf1820000000c2f9885b9b414e47fa4dab0bec8d248c34b85fbb36505410f0441422c99497bf400000008f6c3ebeaaadd053599d8beced866c90be7f8c614d3d3946f72b94eb3fa3e89d3a037481070c9a147bebee8cefd4dcd869691a1c08af0327611ffeb6b58a19dd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2128	2652	iexplore.exe	28
PID 2652 wrote to memory of 2128	2652	iexplore.exe	28
PID 2652 wrote to memory of 2128	2652	iexplore.exe	28
PID 2652 wrote to memory of 2128	2652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.espruino.com/mosfets#:~:text=MOSFETs%20only%20switch%20current%20flowing,the%20source%20to%20the%20drain).
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a60ab669d876852e01a6ff15829bb038

SHA1
cfdefa13e1e94b350fa6b9138f8b23ec2905a0fb

SHA256
60b7de0b0dc8042b224f68b2e973f04096f12b85f0282f3c5fc3e39fd2270f9f

SHA512
a59bc1ca6f0a84fecb936d5158ee98c7f1117501d7f3e2370714c1a79a59c64345ad9a1f32973c327742fa9e29d64d3166a32787fbe04af2b770897131a3ed79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
333ec174fd63f6019d8ea446992770d3

SHA1
4bf87cdc908b2406d1ffea187cfc1a3cb3cfec60

SHA256
9933347b47ec65fca5bfe8cf4b554eabc011f616dd4bdb7392d0693dc4039102

SHA512
af9db3dc96ac4b802bc40971eafac02bfad4eeba207edfed91c6354dfbf3bf71b2ed2f992c14f41565bf9ea3fe14f5d06aa787036d0f5ac88e8d2d8bf9cacc1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4342098e90b1205e7cd9a0cc63a8b9be

SHA1
67730168e112a07ac77c475c52bb94107fcdfd31

SHA256
25f34be28819286391dc9c2e704ed1eb6402ce63cf260790c93a80c123a8e917

SHA512
6d6cb24614ee3565e583feb0d7c7880a4b8967126d51962f8350982efd74ffc6604aa2c3c0d1bad48a73df112be67cc2f580f837f795c88200e1e31ca101ae3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6dbe611baf595d3a930b1637175d499

SHA1
588b2290b99892e14fbf5e2d6ddeef59da075206

SHA256
4414ed78b4fd2f3df0f6af76515ac57486f42d333f3c19c3287da73670a0c83b

SHA512
5fb80b38570c17843238df79f13e529bb85dc6c7433904159222343aa31b4488d70a691dceb4862097fad43c41ec95ad3f0485d65ddd8dd7f040a890e9abc4fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abe46f9831d688298b452091459e78bc

SHA1
71707dcffbc77036231f144fdb7c9064bcb27c22

SHA256
99e4fc2a1e6d2efbb6e44b49da633eb439b05e9aff1603dc32f405c83e53197f

SHA512
c896b12bd5297481fc7ef20837ac3c3d794438c45629b1b454208cd106f32ed8cbedd38f946242567c239f343572361956971655b8382033b1a47eaba4e99d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dde73c2e43b3a9f2a5a8ee518e345cf3

SHA1
a52327b953ae64400160a3d6b2e69bfa19440960

SHA256
be9ad12aef6ac09d449ddecca2bb9b8288b7bfff74c6434779d91bc81af52ea1

SHA512
6931d3b5b17cb2a6cdce249d29a2959923c82ed6e1e9e899972d15704d4d56456b2aa282193a2f4ae5e19fbddd198f4bd1a3c7e8d947e5c2cb629f72e482c92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36718280214ad523abf6b093c6d8e3a0

SHA1
18981f32b209e7453ab39b74f48e5976453c3578

SHA256
12dce16bb8bc4f45efc94947666bb203881e34a47296dc75c8ee800950e56140

SHA512
7a56c031d8d2aabf2a927e06db822b67c02aeee3e61a2ed638c94e56abfc76a9aec6e96c9d3fe7f1e495e66717f1d606d72f2cd57614ff74ae0450af9660f8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2819ac03bf7dee934ea6e26e5c622a6f

SHA1
e27a3acc539a9fd6c0488324dca83ac309f8b220

SHA256
99c573ba1dcc8d87168f9ee6bae1a519c3f0102e4d96212d3d8d959ccd4c7cc0

SHA512
0add24c64167499eb0ff196e8dc6bece2627d4eb535f750eef0a6604fed79e93f8486279e24ae317e52bd9758e6c8ceaa69a730c72889bee4ec75886ffcedc73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4fca325cd327c08c50c754463e16914

SHA1
3009fc62fb319811f7d067f732ef8706e8256b46

SHA256
8c44c3369e8d22a9b539f61845348c401d7a312954da9cfa9a1b30432a70408a

SHA512
2c783580956e578ef97963237ae3d8c58d349cef637e6ef23985956ca3b4d068c4954a16985424429af5610f2dfe1886ebba18ea6680a2c6c02b9904303c57bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa15b33ca29eac88f8fe8d87fe6b458

SHA1
9f6aa948cbdf1ae9a0026d2f257222f1c6cfc502

SHA256
85a9b898b2a5c7ee52cc4c6f69218cce5aae388591e591a1b6a79751090cf020

SHA512
e73b4c7e9113e6f77a80ca6558fc5c10b31679cbac55064d9116f55c63fb5fc5d9b5585ec7ca5a6c4ca46a5fc3fe1afc2cc0521b5abfaf9c68b2cc76d0c6d782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e05603b708d982206c5083f459c592

SHA1
1f7119183d3a851ffd9077c0af9c2422e7bb82c4

SHA256
2694726c9dc6f9951026f51348fba0d7c100163570c43aae0363094c73d87b28

SHA512
8e82574577cac570829659f7364f3fb0965e20514385c4aab761df7b2e7861fe1abe12d4f5aeefc3bda7060e3f9398eec7c6fd1d6c7324f92815cd68523dea32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58bc59922efefe2d116f21057575932

SHA1
1b673f70de51f2114e9f70354cd5ab98d33c159a

SHA256
fa60f2b6d4975923bc066964395b3723d193e558b6c65548e24a73fc48050f9f

SHA512
38215e5bd7fdd03b26d365e041b1d07e3fd572cdddc81d9c1ab97043ece1851dcb026d655379c4bf1fa4d3b96cda906e3cb0fa4e0778f497e24bbdb109a84689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2666a6f1d29ff2dd7ed0a6b45f1d288

SHA1
9ee5d5fa789ece5146121d617264a2c131a55e5e

SHA256
8e823489fc6cfd26902cd4db5b20e87bf82bf14cd1062fb79daeb12545111e3b

SHA512
3e7c587c903f38d8cc507bbce9a2ca57f2e1a182f3172f870af47cc248c69789d39415342ac533b7b694ae209340749fd493559eedc77cd655764f3b8cb7b4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8FF3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90B3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit