39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/05_furia00-19.html
Size

3KB
MD5

40e85cac937fc25ce7797549f6fdffac
SHA1

80301c591474bd3a013dfc591f589a37e8f45114
SHA256

0c2675dd014ef099c49ce755c06c3c4954c0279e481a37121245880e3181db75
SHA512

3dd2105873d978f3a70c78684cc7b449bd31251ed0db8ad5c19060a21d630c930e1564c336bb02c24905f3a2b5763cc5eee6c37f0bbb229a07b45b78228d82f5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3C5F991-03B3-11EF-B238-4AE872E97954} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908a42c8c097da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287559"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000d9d1810b17d1e6b86b521a7469d527437ae660762df9f554f011bedde1d6344a000000000e80000000020000200000002c4e51d618b53dffb648aed2b4eae471879e30565b6986abc7481191d417b868900000005ffe536f48b901d6b928d84ef944e609255f3709402d86aca72f239d3186346b9323033894887ce90d8719df2305937787d95eec5a59b541374d8e0b71eb2ec735a1c0250e61463b21671de60eddca26347e49d8175365edad36b8972f92eb7b9e9fda71c27d1b7d7ae1f8b164bcd4c1e543237f9449788314bdec7d9b4df1be53ed4809fb30c0e7597a2fc3064129f640000000120b62ce8f8d8906b90d2c120485272bcc022c8cf53b286a8876b7d4f49d206530623b8993dc0e644697b131c004043c5b6eaaaf82ef0dc6418bd43c1f5e08f4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000039537cfe82481cb51208694ea7cb5ed51ba4472de595547a93d38a285bb99af9000000000e800000000200002000000045b96047edcfad8279a6319400e0e1b8dfa7a4a90a49ba91d98b6f957cf029b220000000a9df198bc2bc432a4a82519171c5bd9059463d5450f7a13ff0610c6b0e360ed140000000b748e5eb09337da7a48451543d5e4486dbe65b47e00e864e3f4f7bf8cbfcdfa2d0e5b7d1b057e6c5b67befe531a40cb4761ed9ce00d827191aebb0e9ac6ae0ad	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1040	iexplore.exe
1040	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2936	1040	iexplore.exe	28
PID 1040 wrote to memory of 2936	1040	iexplore.exe	28
PID 1040 wrote to memory of 2936	1040	iexplore.exe	28
PID 1040 wrote to memory of 2936	1040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-19.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c80200e163316fb1e83b97dc87b31e0b

SHA1
24df500c397b07ddac4296099a3a3d70b13de51b

SHA256
aca92eb0de6ee00e8cc2bcbb103936ea8d41ef40c28afff510e9acdb8bfbedca

SHA512
606b6a5fa2e40ba9f13eef2570c29546d747241a64e0bcfa90fad55859c9a244ce75b2db3f44190afe2cd8ddaa0b81f6c818386e8c7265a3522871a043228a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a388386be2388b0fc48e5a0058f80ba

SHA1
7b6057c184f517c97f5ba102e3b157b8e2f85d7c

SHA256
f605246464add29006acc2ad60fb408c7e924290103a5770fc4138962e42e5a9

SHA512
310c7a11aeb4cc258340f97f3f8ccae99d3058491d8a8b40a04193cdd29a02b412dcafb579b69e21bf0684746cbac10765308928991b29ff5c4e06b89155620a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e5fa3d7287b163e7c1a0b8b5967433a

SHA1
f0cd8ec7d89bfeaa79aa5f675420df1ac15e32bb

SHA256
e88b9fa2eca29adbd0cd34e7f804b2c3eac1e449b2964281c018516fb7f3a46f

SHA512
865ef4112fb1a5c6674b1b7b81e76b7df2dcebd8ecdd79c6dec0cd3e6409d2c35d21457309d918db97a25161fd8b09609edc2d0630a1cae8d6d830a6bab24f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78d447ed91cf56cd310cbf1c1efd5d16

SHA1
302d2a107c64f83e16f4e7a9d7d13b51c27af13f

SHA256
2564b6f27dd8d2ae0d62af1d895a74ff4ed492836e7ff58cd00d5c1d7556fb8e

SHA512
c509ffc15311df20463cb8ac924dca595cbe10dc9bbb54d681db68e65680a8dc68cc7dd6c7769df5809494de738bb0af2080ab63a23e06660ddb40a4c47d3779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce6566ddf705ff9e805d543e6ef9bbb5

SHA1
93761476a1957098904b94609bc8be94090634a3

SHA256
db1a359a9df2c625d42818e2ff94ef2207f5833857355173bff375547982b098

SHA512
ff196b33bd796069310bec4f9ed0673ba7ca6fb5341d8d6410220114d496e4db4af2cd5c3cf8095e63675cde8ff2604225e65be17677f61986c069dc8977017f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a39c2558d0c1715012b68ea793fc6c3

SHA1
9f353d69197ec2ac89454636f575edff634acb86

SHA256
9f13de3158daf85fe4a7545fcc23354320277de48ec1d3960807c9dd163bfb46

SHA512
ebb7bfb3e225fa21e9eb9df0d15f17e494df06e285f3c5c6f274741a5463f1d59831693bcf8ac8a5fa7a8e2c456265329531dc746b30bc8b5eea3fd9728edea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f52a3055c17bb1723d13efde4035b306

SHA1
4b537bf8e044a3f2bdc3202e2611c6c4227d2c46

SHA256
69df2cf3155d342fa8671e8bddb79ebe048b7e9b112fb7a6654efd3ea0d74d74

SHA512
9f955c265021b09f074c87e649a50b6f483e7b280500b1eb39a66e57b94a0f0f1a14dee8abc261e054f653cec8552550d041683809127e4937e8ab74f1aa8882

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edda600506e7a0bdf6115d074df93c2d

SHA1
d98e4a8511833a6408b9eeee1071fa9b58b2ddfc

SHA256
ccf43e4b7169a2c03be1adf5d3d8d5b1acb9715abc7ddef4c916894439e392a2

SHA512
ed8d8b839812109bb0c112e466e223ed1529a6370359ef8ccd5409ec08b7efa6d756c19d643ade4ad0c4ab17bab5b5b06a34e9166c603b159e967cc0a383537a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42acd884ae9fa9af09ebc5cdb43e607b

SHA1
c40b07899bbc140bc6b4b4a4127a2348e6cf81ab

SHA256
c3f2e0186ad75356e4f45a3936c1b0472f3e34a2ff9c3c6622efb65f586eab4f

SHA512
b4b56e25ffba173bc9aeb4df6ca743f77214bb9627c8aa5f9c440013b3077218b1a61eb2f46fc1dffb09c5fe9c6756d33afbf7945bafa59f401b2f48ae66661c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecdb52e106cc882f0690d5526c85fe28

SHA1
f91fa40486d97f3717a8903fab1e7aebbd2a97eb

SHA256
8b2fc1cf505fe2b578ae02c0a8189499ba28c6f0b32355786aa7a90f134ca3cc

SHA512
d2e0744e75c570c330666753a59a901fb75e9332333e9b6cd945ce2e25163075cf0aa515ec4d7d245083fcab6d5769aaad9afb8faff84984183dfc64fd403dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
876efd78d0f87d9d71c4a595cc112973

SHA1
c45ea18d6f090c0af306e16f6249c4c08a49dd13

SHA256
c87b62a54ce2996f20a9b3853dd64bc248ce17101ce63387fc71ee6844b607c8

SHA512
4c7975d9750b0d9ed2a52a723795cc0607dc6bcde7d9d5cabb26930afd48cb86705246c44032d984c4c8c3c66d72bda43c0e44984d93b3531d9ecaad6a375ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
784fc4b03101940dd453626975d2e534

SHA1
af4e094e0fc324b6c8c5c895d2f054054c862274

SHA256
858205fe59749a3da1ddcdd24dd26ce45b0d0b89c2299d79a42a40ae9c9e795a

SHA512
542475854e9208692d9a46b1de9efa64de93c84cdb75dc2d0430f4f5f4e56e2e8ed94bf91d98f403c82bf78ca39a0565c99977170b49d25bc29486835022cd10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2b1f27fba858ccb86cb380acae66a8d4

SHA1
6419ef7d707b2b142f8c10642cde9881fb0c36a1

SHA256
b5772854eb5352313fc696b82d0b8e717c9545e2a1e90a3eec2cb46368a507ad

SHA512
f599412684f447485fe0718bb75fba702fe2c3a712ad8bf3326409cd1614f4ad0e45187a209aa850b7c74c487c365496e357bd98d438417843b4a38143be13c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8dd7cac8274dd0b7ed3a3ca508f56df6

SHA1
cac6a7101799134658706a6f41fff4f2be76beb2

SHA256
b151ba6904df54f0889895f39543dcad5933f663e34c57f328f42c5f1f123e25

SHA512
8739f9cc7ecd01ca0c04e09f0ff79b42d95bb1db9f31271c922faa8d03c38809f209ff9188bf34d5fc6969b4e4d9b49e3059e4122a1809a31a6805a7d1d6c6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0664014191515961cbf46d6b79ede43

SHA1
188ae2884a74d151eed8c4ad1236adeded66af96

SHA256
1545a3b9f8872332115cd50ebb07fc0009e9a8b919c9c903425392aaa08b9871

SHA512
ef06dd3902cb962fc3b74cc5285d9245e35e2b0da8718a8b5f9f0432b36f9d085ef92c9312171701c887b11814b44a1b73590c1ebedbc5d062a54054751db5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4146.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar462E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit