hxxp://www[.]gigh52on[.]com

Resubmissions

22/01/2024, 22:09 UTC

240122-12xg1adehm 1

22/01/2024, 22:05 UTC

240122-1zppdadefp 1

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 22:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.gigh52on.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412123230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d094a5ba7f4dda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ff9118ae09c76804b53c956ace9d6ebb8c7d435d819a2d3c18f443431f1194d2000000000e80000000020000200000009c8d8a3240d7f75f8c584689ab74a309fd7a4e4a3499c17083b7b224b8d02de59000000098db47e76ba731fdb09cdda355ca0408ab391d4a214e37310295a9053910929c0b0e31fe3316977c4d1eee01c5e205e7c05622f2f0fc8612e8a58e4ed59ab5a2b805ae5ac93b0bc09665e129dfa0c58a2258478750b9c363eee1dcb8c7cb16373a4fbf7f16ea0a8fc2e52273020288ab06ee974e3c5766b7d692b546c63b8e925b961281853ddadc2ef27ddea028f4cb400000000a46c03e1e3ee0ea41dfd29b541ddd8239dd1f48522a9ac4f85438de19bdffb3d4e7e0602c7f1a4b2a6ab6c40f30374c40881a0bd27c1493e324ae8e6d42f1b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E61EF981-B972-11EE-A586-F2B23B8A8DD7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000072a5f2ec082a79ca86e51638ff044c2e73efdd91bd370e5c125deb7768160476000000000e80000000020000200000006d21916375d6f97b444c4380023df07a28773a7aff83fb061259af4946d9e9da20000000efd4563c14d5ff37e5cff952004a365656c85f76c1e96949d32008880a9bf38f40000000a868917034cf6c9a0fbfc60738662f3274defc421a7fc06c8aee141272a6ea23ab0f72aff0cc12f9b676cfaaae1dd24413968a5ad4ce674a03d7a324e086a6b2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2284	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2284	iexplore.exe
2284	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2080	2284	iexplore.exe	28
PID 2284 wrote to memory of 2080	2284	iexplore.exe	28
PID 2284 wrote to memory of 2080	2284	iexplore.exe	28
PID 2284 wrote to memory of 2080	2284	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.gigh52on.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2284 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

DNS

www.gigh52on.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.gigh52on.com

IN A

Response

204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12

8.8.8.8:53

www.gigh52on.com

dns

IEXPLORE.EXE

62 B
135 B
1
1

DNS Request

www.gigh52on.com

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7faa02055b2365dd50a3750195353481

SHA1
b52c7a74b8d20953bdb239a01aa3d5b04b99820f

SHA256
4857666db2d8b4a34a65e2561c0010b1b7709c22d7673df6f7c786caf9ec73c6

SHA512
ae4147590bb54fa342f2dfd635b65396a9f17c99da0480d71b580d17a5ca1d003b337765b6872a0631e969b6034b4a0615a7c40b9214159a8d73d247cec254a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe99869c78055a9396989ab3bc2cf216

SHA1
6dd942acba936db58b6f999cff50947c7b2b390f

SHA256
0aa60c25234ce85e869fef5afc7802dbda2ffb23b754afc8ac5d641cef7597ed

SHA512
18173501def2cc14bc871a8b23770ed8bad7ca1e1121b7d5be94942d1e9c5c076d712b12022e8bade0cdc3a922cb254015b25301ee03ce62007be2aa6d89acfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbea4f70643aa3ddf8602a3f5d62d5ef

SHA1
80cf4d92ddc19153214d63ee4c0ce1bd1ad62cb3

SHA256
0151b6f557688f87c406e27bfe5d638c2100225a9ed4f412ace3822b204f56b9

SHA512
60dab0aa2872aca7668abf490bf12681585ad4cef80b28942b8d6347f40938828f4a76e30ef6666bf4d36db13ffd314025c42884fd7084019b9dede6114352c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccd38be077d74d817efefc8da4932ef7

SHA1
09f98a1a06b3c3ce5df25061cba463702b55791d

SHA256
acbc4999db9b028724861e1e141b12cb3f652c221a03165370d1ffd300be616b

SHA512
2db6ca9148d8d434c88e32c0e3b54d7eeecc6df362e5c05575b5e8d45a0895adf4773901836005876a97fcc156d04a10b6a74f952ec494365879ce6eb57dabec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64cf3b3c4236992226029db3306e4e76

SHA1
5055d7625dc8b2ef5c0bc092b289c77242d52770

SHA256
b30da69e70513f23e9dbea8b91269c6e53a81b9593a1ae75770a9e2da68e90b8

SHA512
8e7c61b78a23c78d54bb35b6a34f50072358ec385bd8b1b2eee0b1b27c50072db271a27ea2462ec79a69cc4178a576fa55414eb7c0fb5a079229f389ab6d3574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16e19d6e8014bcc7881adc52c5388b5d

SHA1
845bbe09d3c83c8024b62e60991961ce78e36f0b

SHA256
e7de69d162521e56c6eca617416ba5c8f1d559e1e85602083c7a223ec82007ff

SHA512
7149dd9ebe1361174ccd057558d8f2b2bdfe8270f3403fa49270dd8a58182b61f53da2101814aedf04e679b1418d4a05d8e78534495b7a65df17f887b40cae50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcb0839bf3bfc34dcd0d43cffa5e4181

SHA1
382af7475a149d372d7b0c3215c6808b4486f2f1

SHA256
d81a3863b4a28626f043f5086750d5042b92a1c063c90b154b6dabb19defcf79

SHA512
b0dd0b742a06864a583515cac6a36066c49a15e75cf10a6124f8f38a4c8d476dda6c07642eb5b297ff325237ef97115f520c7e9b77011485986e8d856da3a3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92b981321e908e89b64bc7dd43c565bd

SHA1
d941f62082ee1ed5a604fa4151ac67f1e238ebc1

SHA256
d2a15f8b806044978b983ac098207267593174b421c2d6394c7421a27bd50907

SHA512
88b5bb4a3157986790cb2623e9f5c1376f3350714a0e454d9f47a8882f79c7d06495e3a6aac7db14fe409c5a51e151c44c69a57857898f2a099498c0bc82edec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91bd8eb03284082addafeebcd3dd0057

SHA1
c09978d8eb6b99af724e1c9b7604a02cab041341

SHA256
49668374b639ab37b5e02add68b50c3faef4e2f02520177acd97c2e1586168b5

SHA512
2e2cb3510225f20fd5d6062fa3c883a821d46684f45ead2f52da3f737da567d03aeb5a4502b640bc267006698f7fa6f9535f971e94f3f56045212370c1131bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
853740df88bc93862a58b7a8136ca8e8

SHA1
6a5e0ede5535c8e9981f1920d75d25e6463e3f3f

SHA256
93f598f7e322c9645fb0b3f5b502e647e0ba4a36154a860efc5e46c798920ce4

SHA512
dede7a6567f33bed626307b9515afbdb6d6574716b746e449eb658179b5592048ad7082aff823ad2fab9aaeb1532fcbe170f75847623df74b77c4adab31383aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da3431f248a231d48a6989b4f4436324

SHA1
52bec1a893f971fe301a6496a543ffc116e4e344

SHA256
c6bfdfa7f60da494887b47c45a60be7ea17862927af7d284984105819567da79

SHA512
283bc682d800ef05c7cafc5e898276e22f0ef64770f742d207b49abb5b2dadad56918d829127f23a78e254ab3cebf0f067dfe1e0bd5bdf5e89c42bc481e34809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84a63b02a384b03a2b74dd626db0a329

SHA1
2cc17718a55240e967abe9a4e8ae07950b528fb9

SHA256
d87b91e1fedd9c9bb3e66acd81abfece4dd739c7b3e43009a9e7b54c59c2ed3e

SHA512
8c7aa89ccacf19348f6b73da502a4e3e99e7195923c413d1914ea373a8d1a02c38417cd830f24c8e4a7f7887b3bed96edd5adaff0c7b194eb8ca0da049b7228f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3adbb1b63779f788a339010cc170fe1e

SHA1
3f776761ce7f82323b604d76e7fb279c62dfe0e9

SHA256
5d243933b3659f7401931538927f6c1fbe5bbbb9e63694294b1cc91edbd7cd0e

SHA512
6a0e56f11f5188d5006b2407b0ef65cb7f095b4833bf8ece7502e3439419d411119128fb84afeb8abc58a6a5cae0678de192b5f189db2265b6f1b9e3dec34cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3759bd6b15d276c8030aaf2c9a699f89

SHA1
795f741c5e45abc68e8ff792221ac875d1c6b416

SHA256
757820ef0098d3f42fe970de6878f98b48a663776baf9755e174cbb3a215b04a

SHA512
efc6283147b5553add7e39463e9c0e246456d0a422dc111b5cafdb73f0ac7f2e2f7d9e5397c7d4cd6bc11971359896d5c7eed90efb7965578524989edbeefa6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2098322e0fd9164d56b5cf72cace42ea

SHA1
3d224e9f5eb60022da5707b3692d04fed88911ee

SHA256
4cb14472cce0221b3d5e9334d643424572a112fc8c2178d890907134eac3f33d

SHA512
de821821b553037e26160d529165d35e315efe1a7a1d3ba2d4c4cb8489b78940c7f529b551cd0ba000017edc50dc749a4b2387cc1638c8e4c6f16b90c819f2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a56e91e99975c9d63a0adbb4a5fd6bb6

SHA1
17ed3f575ea4825049344851d5bef1e80144391e

SHA256
65b1ab4212c77d2735d59773b79f0010b6dccd1aa0b8431e785bb8d6e6296518

SHA512
71845ea33b6e062eff08a12763bd83861d4becbe325b461e8adbf84980fe33fbd6e9f7e0f956ab207897820a5fec9f7413726f61fe0cfae3054f6da6c83dbbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a07ce326c3ddc3e0f66ec7a5044779b

SHA1
9bdf874d63302004d8eeb109424385d45a4d09d8

SHA256
c916fd1cbc67efb9a0bfa9c978473a72083489cbdf46fe919f725fb6e90a8798

SHA512
34cc25a0b29c60ace9962257b298a6cebcf4f8dc9059a8d36fa449546d90c58d26a205ef56d334dd4001f2d186af04cba7e2ddefba55c2ba5d01c5da0ee26ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb6ecaa289ddf608d2f22f463b0755a

SHA1
1d9fcd14268c635577344c94f14177b1849cbc3c

SHA256
0e0b59a63ef91dafd3d7695e77a805daa0c30f9e764d04b35703bd802bbabe6e

SHA512
d78357ed719794f22c503141546770db620e4d88d14ac9789aec6f5f46311443f383e58921474e4d1c20921deb397c6931c2b24d736bb2d5935c93151be5b42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab398A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A1A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit