39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/05_furia00-15.html
Size

1KB
MD5

c6a5a212acab08f23797fe777f75ad81
SHA1

264d4f8de081eaca30172592b56f9940b1932472
SHA256

3ae56265ab471b6856e3dcb28274c435c6523320592615183e90a84546a5bd94
SHA512

c70860a1ccafadcbce8092c15cb97e5ba2723e5bf01a881adc0b6655c870bf0d05d31203d4be2c19b9673bac96d9ea8798b054f2373ceb37e5347486ab8182e1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F291A7E1-03B3-11EF-9C17-5E73522EB9B5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0f911c7c097da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287557"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000523c24810bc1d7b76b91392871236ac50d4a5ec8727f50573aa9aa8c61f2cea2000000000e8000000002000020000000646461a5a92c12c320afe833d222a471897f25ead7167c3ceed7a0893d8fdab9200000003bfc0169235f3db417a08ca0e78526f675ae590ccae03a8465435f4f9809945b40000000569fe88c552479f7cfb4af1d110ced22bdf1b4980170ce103c8352f2a08a3cba67930f9108c52562633e9c6bd6df4bc04dc9892bba0bb045c7a1b60a7bd44ec3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b6c3ce76062d5108523d741d4321e2a7697d7c7f08652ad6eb86b549f470da65000000000e8000000002000020000000a7a46cc2b6b6835ba553c40ec991f4e0b391ed061c80825f7245903a27758a57900000001496bf81715d8526b025baf61359e53afc5059d3d754acddd7ce85d232f134e7e2b361e5b788a1d48e2a377eaef41c46c874048b5402563f12d1dbeb3861b3772a63c927be1f663be6006bba1cbb9334953091f913b65d1dd2bd30a46d4ce424e6ea5b0e76dee8b10799a7e86004380adf28f33775b860bbbd3dc64f9857e242df01dce937f7236c4b17f9b74ea41abd40000000f10760f6f083570e13da9feebbb6954949f3cdbae248d1709d815b6581bf15c1bdd8a7db173875fcb7559de70bad8804bf5faf1b20384205abcf4a06a45f23d2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE
2924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2924	2228	iexplore.exe	28
PID 2228 wrote to memory of 2924	2228	iexplore.exe	28
PID 2228 wrote to memory of 2924	2228	iexplore.exe	28
PID 2228 wrote to memory of 2924	2228	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-15.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c1bb018d7007deb733725562ea3fea8

SHA1
66c894ce393dc3aa4a3a1b65540b045a52708639

SHA256
6de1ae150bdb5213c87939dfa6e486957b57c68945914998b005e17b86096d05

SHA512
72ee44a5bee4ffb973d1078dd9838ecdf1c846944e6b9cad477fd9dcf9e8c341b656f9951867689313791d1702ecfe3bd03f2ebd4f0eba2a731494f7ec977558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0570c0c0fa5afdc628e4436b35650c7d

SHA1
2fc5d950face1e4db0d88ba022ca1b8ddd1af530

SHA256
931b17f1e43338dd72e324a6cc869451ddefad412ccbf96d49e7bcbb5dfe1087

SHA512
695a595fd3a7518699ea9ad9baf9317d10fb9604faf2d543e07220cf0e25c35f94be37b4757aeca8f04c746f5e3e4dc7e4a7556127889274df5acc3c1f169ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40d903ff03cdf7fc6b37d55c202be369

SHA1
43af82bdbd76911244e4477792607dadaa269f5e

SHA256
d0c1d45711bd96c85aca5346268b07cde44c2fbeda24855f449b66b8bbad8447

SHA512
e81f8589cb706ff388f4fc59ba494ee6d16c5987a95b8afcca63f2e7a6b7b6ab264fe13270e2df8ea3e7481c3b9aff0e32c5e31c5ee373d3691d07ce55f60f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d0ff86045c35155a4ccde5566361b39

SHA1
d1643f9fa846c521d4d28f00a9582256aa267a6b

SHA256
43946af61b31377f5a8ddd1d3a5f40039e6dc8a68bed5b89033e92686adb71bc

SHA512
82d64d2b7587b04cd1ada9439ea93f5c2c34435f385142df62f00ed387c3c67bfc0a4e886e23d30afda7c90d6f6bb0b0541720a30a01d83b21a7e0a8d7ae08df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49fa45910bb6becfbc65c2f6591f9217

SHA1
f9d888ca1cb3a9ea55683a682d0d9ffae05d5224

SHA256
6799dccb694cd20361b03b43ab73bd6b3fe8e62e694869259aa9213357754908

SHA512
f77dd61f81a9368a7a120407c7c10c029340fd9c2028439fa8b22f08e8f43cdb3b001a9b9e69d3ce73ff577429f3f5c396f306d5a57c1d1fb150700a3189d6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee052a7f317dae6a0ca8692096490e1d

SHA1
40ea4e90a3cf864c9ba956431e48f630becfa91e

SHA256
aa8e1212459860bb6cebf1bbaf78a0bbc71faaa962c593e09550ee72f7b97b96

SHA512
48a07666110dc42c906227cc1d9f1279a819bc4140878a813606c5c6b56f14e482a2299daebdccaab56410b7742e98706bd2783263fb566e91c5b68aad21ef10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7352cbf0164e6590d1509e32efd41a2

SHA1
633ea9c95a5ce306995664b236cc4264688a2ad5

SHA256
014db8d6b502411b07ddaa1bb4ebef343482392b9b8953474b0c8b423aa7da4d

SHA512
4d25e062338447d212c2544c2f699b48abbbbfe1c3c10e1eee007ed347da5a59df5e816863ab89d1c96017116f2b319e1fc31db97604688dac095a491a8d710e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58587b4773638808343c2d4678ab1499

SHA1
40edea8300a52a2bea259e641206fdd1309483f5

SHA256
b347f0e36147de9f26ab890955f5a11db711a44bb218050e582440b5771d8219

SHA512
a9f759cba7ff254cdc4fdd1dbc1c27004225e180c0d9cafd00ea00981d08cf95c5473b6198e2500a047fefe569691471137a34a0ca1ca9a2ee888c8bb0976fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a525ba97fc7bd49f9ee1675f44cb7a18

SHA1
7dd014a6482ec97ea0a4b7b3917960895ee591cc

SHA256
77f6507cd777b8a1a1fccd4d5abb2fd61906670078e24ba9996b935774117605

SHA512
2212bfb9c6d2f1025e0cf73a0620a078cce8185be4a7f8c5c54b434716ccb966fd6d7211f0e51819ee22d406e7c4298288249e94cc67094772a2ab4f10ef8b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5efc442646e2de9cfc44f0ecfa9565e8

SHA1
e3008c222332082af9e9fa24758038a5d68a99d0

SHA256
5c67db198054c95fc77f7b2a7273beed5074db1461998c7b066f9d6719a87ea6

SHA512
fa4f79878b69e95412660c8609627f63dbbdf99b98775e2edea3da1f18f9d7e3de7156462cb5c525d64f0d25b8b6991aca2b315083e0b68c7c59c257d900653b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CFD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar355D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit