hxxps://chriseric1[.]github[.]io/

Analysis

max time kernel
0s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://chriseric1.github.io/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47663591-AE66-11EE-B218-C2500A176F17} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

iexplore.exe

pid process

2168 iexplore.exe
2168 iexplore.exe

pid	process
2168	iexplore.exe
2168	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2168 wrote to memory of 2308	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 2308	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 2308	2168	iexplore.exe	IEXPLORE.EXE
PID 2168 wrote to memory of 2308	2168	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://chriseric1.github.io/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
2⤵
PID:2308

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1b64034280414f82a6abe53b873fb1b9

SHA1
f1e17b879d931ea47bcbee40cf5b5b70660a5adb

SHA256
47ba56f3c2ec98e3d9df5930ecd9a19f611413f650ed1a435d361bd845f1678b

SHA512
d4ab31a841b81bcdd17012176b17406586490f7fc3ab0ea716b300e447e32bf5250df108c7d11ec23d1b6a42fb4bc3ae60977176790e70e8c2254943b4393843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d5e63dec70bf0ffddff51ec42f029dab

SHA1
44eabae3916009d9f89bbb87d110e96c54054965

SHA256
e73746eb66a04ee3b41e4e6a195a5f597cb5bab5d5e32eb72d816a1a103d515c

SHA512
68f1422ce4a5c411055d0c48cabfc55653c2d92990ebdca130307d05c9bde931d0d3bce4eda66a3d2759ea1a4df35c793d39e3ff10faad8a7564ad6ccf5e6f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f6b08d73ce3aeda289f82d0af44bd967

SHA1
27c2d2036ee57aa77d23a70099a517f59e24f784

SHA256
5fd1615546dc390e3d1388da744bb40db5559bc26c7c9f60279dfea2eb7e4926

SHA512
7912f4067cb4446fb34fa6e2effa842cfb93b13f5f474bdc3df0611c4e64c08e4b0a62c8a62d1e03e2bc88e735e63209dcd1582c58de58e7194e3bc5104a03af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
aa22a604dc1cdf9307ee8ff8059bc05f

SHA1
63cd19661154bf309307345ded049f3cd0b653a7

SHA256
c1364284b67563685d86725b2fc891811e94421f833631b3e99ce68bc525d492

SHA512
6383cdf698756227bff84ab857aad6a27f982d12b5a2923ba19be6ccefbc0e9383c97a3ed895dd1152c57a6c566de1e885864764439664e239e745f12b701682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9e5179198cd1b5f4c622e0a33408d880

SHA1
be92eba3db6bd8d54bd3a00f600b40030506d5aa

SHA256
c508c9b3622dd69f6f8ce390133455abd71c69b7d06081630b871d08023d5541

SHA512
b1eac2f93f37b881db086a7e48a893062f2bd90f7357c0c1314b280485a061612275678ac56b438006f06ae4a503a079c6c6ba21c616301612c0997fc9ecc4fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5c758c4f29c66c3374dad67233ac1a3a

SHA1
7911c7b39ce24c41e2f315df626176a2d6004fed

SHA256
c9d8bf211c0e4bf5555358502bf0c6cd11a15315a948b55a1a3123942538e55e

SHA512
2cfb13218bdda79fb6b404dab6bc1792c76c1d70e0f0a83757fcafddb8981390bef033801c550c2af4894eb0e45726bf40995fb16237962708361940e8460fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b48b2488fed50d45451f43afad697720

SHA1
8054eb2e4eb80d69d912ff2a8e3c6a69b6c3e066

SHA256
b4d05592721d9f0afa00df26cf438d327ef5bb5fbaacdcee2e2a7363d13ea5e3

SHA512
0fd9eb321e93ad365cd9de9523b96a9da8c2b158e7c3ced7b61145c69e7d30d19c822902aeb01d8f9055447167e314ee31af373f2ae5151f69ce7badd7431c38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fdedb8b79dcd365cf4067b5f505b7fb3

SHA1
bfc553afa93f2b9a7e5690c385027c20a9e6099c

SHA256
8730d0bedb30af4b771760bc0e6290ecb8ee5eaf2315f599519d5cf6d40ca031

SHA512
4155c25ccd9bdb8cb434bae63c22857ef61a3309b450c6a6a61193e0dbbea5287f5973b9a3439044b5a4214dbd4476a3971cb1b66aba76e13fe03587403fd42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3584.tmp
Filesize
13KB

MD5
5583e1b629005b696aeb82beab24df8a

SHA1
87fd36acdc437f0387b7c12f9b39ee58afd95467

SHA256
2935bcc20060f4d77ab9328c794e18dcddd11294e9b4ac563cf4f0b1f7985909

SHA512
408b7d1add114d02510fb30515766df13ac4a67285e3db35504126195b98ab8bd8a887d2a028ad93968402bc361fd0ecc10427a86497401758408138d78e855a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3585.tmp
Filesize
13KB

MD5
77fda46c495fc31be2fc16bdc3416804

SHA1
6482e3b420f1585fde214fdbf330045c8d06fdb2

SHA256
c0e12ce0d0adab1b43c0294a8e1a09287462ef6b2c86d654aa3c9ce19637b35d

SHA512
ffb59a17eccb4a8a9875398433362d2b9fb7c8755e7802132568a88e2c3c4ceb67c050c035ecff905bc359c5bee154d106f10e5b23f777dc95d48bc5409ae6d7

Download Submit