39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/05_furia00-10.html
Size

6KB
MD5

2d792f200cf84cd92267d7481006ed49
SHA1

4d5527792f053c83a33d3c39eea5edd0f9d0ac11
SHA256

f43f7445d57fa92c75a1a1543ef1de56ddc4a9199506a77042262a116242aad9
SHA512

e51584d689d4eb4117c84de6c4950bd717a542ee83b3ab23e7a9b43ef2356881d1717bd634583b46abc9a130d54e70d9763517059f32cf6d8c076482b82034d6
SSDEEP

96:t6sA2is26H/LZd38y5HmdF6cZS+rFjcOE9LdACWTelA00L:Us120/t18mHkwovr1cOKrSgAl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004dab6ecc3c786e79b046071ff216df9cbff617f9ea4855db466e147e96a7212d000000000e800000000200002000000091d06c0a662a32f90388e4fb63eff6deb67cac408c8b7eab6088d9f2ce276d00900000005928bb9433c412a04351914a31ddbae6e8920166993369c6f0e8d2ff00ebbd03f4b68237bbe29a90a34e0dfbc07b0368d7aeb714bd34d4238395ed5aa84c2ff7dc7e8d29d7972d6951ef44f02eb578057a46b8b2de91ba3c2bd6662cebb01d62ea12827e2a6f0da93ecec217801cf682c18a5dba9b9c091620f239e8e558da98c821beb1ae369c5f8b0d7f2ded2c0dfe40000000ce082b87cdea4f94d444c689deb7f87c05b8714a53b46653ae48d94eecc3b23b2e75188f4ed7f6f139c737d1987968623d5e982d5f7c5cd1ed00912404efab3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F398CF11-03B3-11EF-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b886abf35f0ec7164df51c1401e277d2b0b437c40d0845e4257b51d3de2edf15000000000e8000000002000020000000c77452b4c1d41b25ebe4c0aa2d50355e37c2535756fd4c4f2476d51df3d684412000000057cf21132f4e91980a56a6e92a9fa385c038990e6cb0cbfc3d7184a052bd6335400000006924d500df561c4525afe28168c75054622c42bfc1054e24c275d7472af1db67b4680a1932899e926d66c57a32d8aaa770eb31393caadcfec1f3a1f5b11065dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509d8dc8c097da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3024	2212	iexplore.exe	28
PID 2212 wrote to memory of 3024	2212	iexplore.exe	28
PID 2212 wrote to memory of 3024	2212	iexplore.exe	28
PID 2212 wrote to memory of 3024	2212	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-10.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e339a5a849669bb52573cd40e971d56

SHA1
819393dc44e85c7f7a608d85f7a6e00a08c3266a

SHA256
bf8aab6fb7721b58a268a3da056c5f8ffcca3f9efc74dedb827aa60ece002e7c

SHA512
a27c3824841d31c4cd69b8f0eba5db9216cb9fd58086a084030b8382cb3227db15492350b1b985bc3e374ba20fab8bb8e925619665624970bd57b64fdcf6abca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62162b33c2b829f438d60da2f031b372

SHA1
78cc995fdfa4d843bcdc44a103130fac1fae785d

SHA256
e354b45663f5cc9f17d25c460d3b4e19073e0efd4b38df9383c88d2f0a824cd7

SHA512
a73f858cf393d2225b7c2dcec22f02db36af889a4ac64b5d7f2e5235b8df60b31df64e6c20bbb013dc7e505a441a59ae7aca51b8938d4717076ab441c80af08e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
291a961ae9a37e2c2e1b7b248efbe6e6

SHA1
a24cc5f3054364b93a159b5618e1aeafc0b02aee

SHA256
6e5a6962b5ec42528cd7e2af493415dc318fbaa16c805256420d49ef8c4410b3

SHA512
95a0d26bc504b410b7055823f4153fd9638f4018939cf2bdbbbf26f234ec80d56a8158867b541dc6da5e367b2319348a0a27d9887adb2236ba788257ca8f2998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3e54193df277befd6d99bf17c1cb34b

SHA1
aa92ed91eb1e23ae2d481a800bf05f565d19ff90

SHA256
0732ac03b7ec1e91828b8020bb9dc41e1db29cfccbfabf0257a5aa2bd3750e33

SHA512
dc3f5e050dc4a3895367ae3a60984b01f1ed093362ddbeb04de2d331d65be47787cd3d9fab6ff7002726a35a910871668bb6ef33f5a21aaf9c4fb2e3d08f7985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9dbd13a6ee1834ca27c36a82a5ace3ca

SHA1
bb6a45b018c30cd3f11687598f04192b009d72f4

SHA256
630d70e88e264ced19c6506689ea2b764f319e879968bec65a0250b4e8fdb05e

SHA512
b7cc896ed90fff2062bbccfd722aafe67f69a2f755b08de2d979ca4ebe8799ebfe33fc2c5eea396b0847bf629c0cb537e1f9c8b32267c246fa339cddcb29429b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d15cab0cc7e4da453f35bda1636e8496

SHA1
810fd856520f56d3e6fcd9dac4dba1aed49dd50a

SHA256
fae30f7af37ccf3adef061f7cbd02694017f8edc2bae767202780d5642ebe31e

SHA512
29d573c126d3bd0a95656f59daeb945df12d25ea9abce2eeb67ff3c2345912e494b3d00c30445d09fb378a0bcd235aafd25537501ef198a927da67ff1c24832b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cea0fda5171ee34bd2160e50a88a1b24

SHA1
cf07e120580e840e71116b0433f99c257a5ffb17

SHA256
43850d99e8eb3ae324e77c505d344dbc1421eabca3291d0f823b246c15860b8e

SHA512
a0c7a606545d92fe0e6647b00ce43d6094236b8cb29590f36cc505b9c87fbeb6a6aa2739cdcf759ce1d011278ac9608468eab451538df9192dd798df36376a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5821411974e251aaa5b4271c3d7f7c5f

SHA1
046248a6115f30fdeec902080f6a8393be4dab6d

SHA256
658fabaa7b3f517b3def4b8334cbdb5e84596a8f338fa1e380f839821dec066b

SHA512
50d06202227504ca30e4475a7932b705671cdac9c2f9161d9e6823347297bd4e2afee6907a3e602b03fd4da9e99490657c3d08bb62ea71b340044a2067441c25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
623aaf0223a7e42c7c5fa541756452bf

SHA1
f0e0cf22bc36b4d33a8206b8ad87dc7d7051ff70

SHA256
a2dc7220b4a78af31ef947ace1cf440c0339e6bdb6e273626e722212e89c91fe

SHA512
65a552e7b6400b4f1ac40b5ed5483a676ad2da913a3a14c9693bdcfd2a36e6d9d33b2f639f806fe46addf46d85ee179b14b795425a849ceeacf3662864bc45ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaed3ef50b469802260cec9ef0ba8628

SHA1
c42d401a51b4bdec11eb459818150bd8d07d652e

SHA256
f97dfaad7d8a16cd612005faa2dfba0c272f958d3fa6ffb102fc6f7aeda7719f

SHA512
ee3a621a895905cc63a7f6c91b5edfd88ca5b892463bc423b51ed67015bef96af47d399b60614b905ef4ece8b523d83579b8c10916b898e58d2c26735f6e8324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac9eb574759e081c11e1b3a6df5dd09f

SHA1
844cd102b5d1d9388946b66af25c2aa246516fff

SHA256
3b5c6efe9aa95264f220bdaffb38c154d00d144252746548e49fce84864c5e37

SHA512
0b63548f40744a17bfd4cc36950b22daa6b2dae784fe5c4ff8911c94febff27ed5e8e57f0b4bc85750f72b0791590e68019bb90232ffb493ccdcd901857e76fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8af3eb688ffa1d17a2a230c82a8c2f07

SHA1
c88e757fa3d7a7866536aa62692e14d60f7f7a43

SHA256
d7b1a37f4b6ec42bb8a41f7a606f76d7f2bfdb5ee58076147e8ab23d1ac4a2a4

SHA512
3d234b7a7384de5cbcf190df5beb55fc7c45405a0e8b3c0b18e7e35ad1f59e00e0fa663d2b5e93284f2de04511225e43d1958a37a0860a3566f32581f36e26dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA601.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6AC.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit