hxxp://www[.]gigh52on[.]com

Resubmissions

22/01/2024, 22:09

240122-12xg1adehm 1

22/01/2024, 22:05

240122-1zppdadefp 1

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/01/2024, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.gigh52on.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412122998"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000085f94d6b8891539161690137736ac0c04932c550513c8d1bdbcdfb572ccaca7d000000000e8000000002000020000000908d710127cd4a24d32f652a41c23ad5885db46a05287c0a77bed54f5b9315b320000000a154ff12c72f72befd83bcf2953b2edc48ca7dca97a1ea4053b178ebe4d864b140000000c45a30f28afca49e4f351217395caa77730e70d6090fe31a9b813709997862d95bb068c7028d643297044bb55bddb8765e8a32e67103b09084de82bd3de58ea2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b1d52f7f4dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B367D21-B972-11EE-B751-62DD1C0ECF51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000698917ec38ee8bda333a5d11589a4cf3d6167f9ce4c89e747e7ccc2b97605286000000000e800000000200002000000076e7511de8d4c7d58cbb238357255487f30dc9835bdde1507abd83a79cd47d9390000000333329ac3719f7683051c23ac7085fcff3b99bf4b0715b6d777de99fd3f011e2b308e5025df2094ff2ef17b016ec56ad80c3a7459175970ee7906a6e331dc456f055f4c7030f99e8ac824a85f2fd1a29515c22f815268d2c25c6193e3c9192c4a62ab003522be525f20532becdca6bf9bfce2c83f8d33542878f17d5b3bc803e9a091b62755cd354723a874585ffc6ab40000000cbe9473e15f45d0e2eca53644df006b8686171eee73cd34f1671eb0c2ffb0b19f1678dca9eda340eb8ef83d18b0e86f675a77423d8c16a015ed4785c76c9905d	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1724	2248	iexplore.exe	28
PID 2248 wrote to memory of 1724	2248	iexplore.exe	28
PID 2248 wrote to memory of 1724	2248	iexplore.exe	28
PID 2248 wrote to memory of 1724	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.gigh52on.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afb90f87cac059768fb753effe737739

SHA1
ffd451cbfc447be5d1a049d4db8d6677b820a509

SHA256
9fcdf5d9bbf21e2c890891a301b7a1331f5a08aab3fd7a8962e1105548a27de1

SHA512
ffb02ab6ad08a06a14dbc33932de411bb72b475024cdb7187eb9789f3409d99d49086382cd9b2166b755bb5dfad219e42f08f2088d0df470ebcc4137f6e0bae5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f2fcd74d4399330f1c86cf2b1e4508a

SHA1
c88195053ee1dc19bf4a3ec71d35ac6bf5b6b1bd

SHA256
483517fafea02cd52d2fa69d3872e0d74e749892814244a69a16c066e4a876bd

SHA512
cbd5a87de8f2174be595b722c9418b94b6969d06cd2f828bed6f7085b8b745060ccd2e4be99c591babbc13969cce04ca3354b1661bca3268309e6435dde83d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ed5c33ad3a1551808efdb5ca9b27080

SHA1
167a33cf7cbb43f50440b917de9d7435f1f20622

SHA256
496cb31b339171de8d3bd8c39ca1d5a86f52a6ebf3920d532bde392d8217ac4d

SHA512
b1f04da386cbae8584be200ebb80123a6b49a5a7da4309a676d0358bf299254c42581cace474b9989985e616e1a525ddf9c5cc58f99d016a04619ba58806cc8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9550ba773c1de0b56b22ffc450f438de

SHA1
cb53cc2bc492cee7c59ed88e27eca9a6fa7782f8

SHA256
288f29a32b60669ef3dfb67083625c02237dffa8092128aa7b8440ce7816e046

SHA512
69f4963d4f3b6c0702a2c60f949c5ff1d46d4faf284b37d89253b8375a5ce6d501478716ef4d580f32b877a6f7b255ffdac444545c1f0603d75bb4cf7bb15a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48c9420b654c656fe4bc06f1b572a688

SHA1
a0935a1acf284ba845a7d722730fa68a92ac9ee4

SHA256
40cf0cb25bed8b73ac29bf8d9074ac7a7565e6787c1989f90f850c04ad790769

SHA512
c23e8f80512204c92a90cde0ac20b17c3c1fa69303244e97c24021cc51aace218c3eb09beff5e1420077c320e7492b2cc1310a8487747f9651030671fb066a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80ffa213001e950401e417ad3b67309

SHA1
18ee42ec8ae47ae278dccba5317216d9185dadc3

SHA256
9e108cf0f1a5e087004a9047fa175c69e14eb26db6c2de53a024c672cb3102ad

SHA512
7df9b22d0bb5aa5144d43e749645d8e3f5207ef1ca9a2aaeb09a8b3103129cf13aa9c77f26cdc491438d655c0c5fc88662394e5e9d7279e6ba84f027fe8f2c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b36626d09a819f13735300f92e8530b5

SHA1
26118113f5d27abbc77de07681f303935c1e8c6a

SHA256
f0e512ec4f817041f00677de2089fe526edc6cb531200fba2cda2a96edd4702c

SHA512
1f4aac1a052ca6bf15c47cf532ac4503ed608b92b88e3270c1314f5e9d16728f7d9cf04b0ec6c1eebfa254fa98df7c5a0064f61f26f6f90fa09a3c80ed5e5a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6007f989e63735522ac66a40c5dd1e22

SHA1
12b48728b3245c17f6190dfcf02b9f49eab99c4d

SHA256
4e7981daf9807665547fca48681764eaecc42b861d3582aa245a0566b3ba4996

SHA512
a280b63a2ea3f07ed5bcc3c31314f1ec4043a2682dbc3cb1b810596d0a51717726c79f97735c40575c75854acb82b6e414617916bd8dceb0749cd9313663c2c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69d89079c3d74eacc7a8415d76cd3cb3

SHA1
9e3c62594deb4ce3900c289ce435536c1e6e6327

SHA256
b2fc97581c53d46dda0d51f88311cbfa816ec250d3ad64d2fc177ba5892e453b

SHA512
42811d936067a5a1ebb6a0597e853e2b513b7600803d8fbf610458018cee91883bbbf8631dc2683cb64654e71ee7f794f6756f41a42bd9fa8e9b63f30c672f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5617f786156f3848acca645b7fce8e1

SHA1
7aafc3745fe4c898b8ad96902be9abe5b4e7f8a9

SHA256
8b59de4ee1c7b83fe24b7592c3c39cba2ad026e30256386c3e4498be1e04f374

SHA512
0ca33f2f457a1c0c5c97d45216caac5d1875fb25f266cdadb76d052ce9b7b6ecd0b3bf84764edf6ce8d89fa45c2f8457663619aedd11757f971818887f5cc630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
560ccabf7d6e5ae1434626af9f59b363

SHA1
f79a5488fbd58bfa9b03f1e7c2e790ef90708ba4

SHA256
97bf7a3eba4cbc520086dabcbe7f0f7e7f2810b27180c70a41cd7a72b59567fe

SHA512
3a4e364620462ebe998727733e79322800044c6f118e266bb23c20ab88b2c880d47025038129a5577761e20c9312dc050bd54facef478139d76a94916c3fbc2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3618d48b0fc9c21d93951a5b839f2902

SHA1
2e9a0d08b66fd74eb6e04d7dd17dc50a6189e1f5

SHA256
299455cafe84a10f477f2a518e40c1348fc2c2ad74930101bdc49c1ef5fe6fd6

SHA512
925a7247f335cab201101c7210b2e1aa6d3a8845d82b15017768b96fc7f34623819131f2c194e2dff91b753ba18317770d249116a7d20e18f8d62099133b81df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34ebc4a63066cbe2ad3871f6cc10e925

SHA1
d3e5b7701f0508228acbf1e1b292a2dcd364c7ce

SHA256
9c0505851b914983ed7d3af58b95f09cf22878bd1629e19ecd02f6990c48f827

SHA512
b175f822af89f4b3f7f4e7d9274380b5990a1b9488044406477672985f2b0b06185c9e3c759246fbaf956eb28ee0f45eef44701edfaf0a8c809b2e4a776e7e27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88fd33906f2aa3ce1896846226aea042

SHA1
afd5bb0775288e5e67217ed2b49b86646e01af7e

SHA256
e17f635e7f7d8f2417632d49f8ba18fb77904401f0767cb4fdae4dab99e74e0e

SHA512
0c1f0db70095e2db85d320db5d173c25c0ea7719245e6435d4a3d3552ba13fd25cc466ae1a12eac28a0d9b17d60681a20898a92837840bd7772e0fdbb11406c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad0f8c6b118ca1d692a9bc4fd87a596

SHA1
314b2845b0f4bab649c69e02a3835cc861771d21

SHA256
52e4fa81a50d8751b5aff244b6299aaa881d64bdcbc926d276f7efb6c4c833cd

SHA512
85c173876e1a96c5199f7840dd61fb820d030d3a508e45ef04610eac8a180fbda4f93754cbb3c05c1b6bb90e0dfc568bd178773b2fd73e357b42d1f2aec707ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6a1fe4b35bb76b9623a51c0b6814987

SHA1
6211192c7b098680344a7cd98ddb5d0c69506d8b

SHA256
ffbf3598c168279890fb6512f1ca16786fea58e8059cbc9f3e41f21617e227b9

SHA512
a30eb77a978a6b8b78fe53ca090b8f35269692020d41953669ffc78276e9d06d42e8975838a973e37dd9d8aeb91eb9f68bf2f62c3c9371f3ba7a5eb0b2c772e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5672045b7cfc0693bd55471c8b85d0f6

SHA1
07574977955bed8bf541032da1ff094dbb0bd63a

SHA256
19c2ff690c8ba49fbc801fa51aee98bda991cc021412b7731b69f9486ac4b00c

SHA512
27975e98e79e98f4a4fcfd4565306c40681daaf0fe79bbbeebdc4717d976388cf34ee2403faaf67449242a03642a422a08c045d76e7c17b10e7b34dd6e6ddd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3546.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35C6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit