39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/05_furia00-21.html
Size

508B
MD5

448a4bfe9b443542ee3e67021f5a75c1
SHA1

7a41c73dcc8e509d8a5468a70ed460f69e5945e2
SHA256

1675a1827b95f0b82622754a3335b694d2b03034f9b3829c73e9086ff5e0ae53
SHA512

87266d98fdd76578727c3d61bea426f433d5389d3e08c948c193f92d3c828f1f45e0c60408ef94cb4e7f69b4c6a64c1a07e6f30f55440eca6e3c824c1d63d86e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02012c7c097da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000059dee11dab34844dafd63e317dd431f000000000020000000000106600000001000020000000cbb98a8c2bcf7ea58498746fa6d83f3dda91f41fe05ac2b9923e8f0c9fcb72b0000000000e8000000002000020000000326c202b1065a0faebcfca110755cdde68739592911facc8d5f5f5a6cf976b87200000008ace47210f1566b6d11a3fc71d3db2de655631027a4489fc69c839821c0ab8404000000071309c0f3d311da87090b57e97b7d13d929872c2c62e035a888c4898c8402d4759054594135d3e19d827995f73681b6124f30f0bc1c185f8bc3437900dbfe835	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287562"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000059dee11dab34844dafd63e317dd431f000000000020000000000106600000001000020000000150990cae79013ec823ce4d75061b99581abab4c5a29c920d0553db638f1f16b000000000e8000000002000020000000296e26ec8d2ac708c2880461fd8c18b4588d2a3c17bdddae0b32f5909a986f06900000008d4e3ccfad8d2856e80a7fb1cd660ed2b51a1abf62ba5c2fabaf6df78768fe9760a154ba8756fc7a90a9c20026ad0ebac5e9114bfbe197cb673f2831b30e8166eca60311c4c8d10a8c7120cf7b2a49afd8adcf06a90f35a6475e58c7392b0afe0f7300319862f3cf471c8e2e6e2bc7fd96467a8a88505d797c86b37f6c9ee888ce9021c2e1527eae93da966900001a6540000000780a80e12db1c56ef5627b96bbcc2382430397677d4859a6323592330fdf77da8bf40810b68640785a71ac438823ec8c2623a03b3913b817860991a6914d83b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F28CB641-03B3-11EF-8951-5E4183A8FC47} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2336	1748	iexplore.exe	28
PID 1748 wrote to memory of 2336	1748	iexplore.exe	28
PID 1748 wrote to memory of 2336	1748	iexplore.exe	28
PID 1748 wrote to memory of 2336	1748	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-21.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
73defbfa9970559a99c7929f79ad680f

SHA1
4c832dada95a100d9854bd89e7bd78a4828bd4af

SHA256
d88276b3b0422d3bc3be93f18f29762f321efccb8165079db8ad6586060eefed

SHA512
76f6108adfb9edcc16c25901c66656d70c8cc9cdaca7e83345e00cff74ee04d1bb54024b46105f995941555edb14a51acf7f2fbb5976c60229d1c6059d39ea1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7b34dc6e10d74d26a9b11510d3df9aa

SHA1
e3efe76a2cc73a6a3b7567921ba4c38d3b1ff9f9

SHA256
95eec6fadc63305ae17cbcbde4e1bc05149b09dd0a9944617686422eca5d18e1

SHA512
8d0f9fb042fb8812b70cc2a9b9cf73a6eb93444c85905212603d19782095caa554f63c509bdd6a46e4f83c5d2543e49234f4eb1e5c0c43d3a8bba1bc830c0100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4522d2b31b46949008757d6180a24e2

SHA1
7ba77a400bb82988bd7ecc4fb059a969b4355417

SHA256
303c39073c3bf43ec6698b6b0e3837349aa4c1d2104115aa88cd475ed8c9e52d

SHA512
8c5a556674ba783df6297b4a40ff57c2152714bd7206b55e6db3f3469bc98b61bed8559524b94cef41aa9ca26db28c32839d7c46055ca4bd1917b1f67c804143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da7b9fbe444b8ba2ca976598de722df0

SHA1
8203d398069137988c1be1e7cff4ef9e4c889547

SHA256
d24fdd0b01fe28ec79ff3cb19b005baefea6eb10b9f17a20ede24e65f860be0b

SHA512
f635c13c86d763376083b27f109952a0c13d2e5810b18cc0f001b349efb775a35e62d8a5d5a0ce48b5c1bd94bbd2dc4894c111de3994e2ff1a8251c4666e1f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2f9010755651dd56158e56ce5f1c860

SHA1
7c5c216352775042cba4da0c7c7d590bc8c6c5b9

SHA256
35d4cb7e345d4931f34f4e20f04c663749ebaef6d8c62566ffedce9c26b4d24e

SHA512
d890e75d73fe64e62eeca8247faf658f87b421241700495de74b15b0c616797e6efcddab93e1b761e76dc5603d109c0514a23fcde22a8fb1e4e2d114b53c3904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae66f81eba36fd724f0dd7fed89c7062

SHA1
388a3fad6537a1e8b36a47a3c77432c89f056459

SHA256
b56c430cdcb833b12cfe84d4d088853d82e2a115e9ea63039224edf46d7e30dd

SHA512
f40f72db0f70253e8e80f9f8ecefeb42a62f4b49960ec1be6cc6ecba63681610f621816e0234f01fe7d9d58e9dbea47bdb9137936456a709c3d4e4ca2d8f9717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2cf755d69e7ad97c550e9eff75b7a70

SHA1
d063edf397ef766a64a2e07ea7a081302836427d

SHA256
f1e17245ad7c5bcf4ef1a4422e697ec2d9534e2dfc74688a1aabb6938051da7b

SHA512
bed4b1b761b1596961716a91593496c9435be09f71d697073f788e689e43f8e3f3e211a77bb910aa1cb2eb074fb13852e7f0c1ff465dfcf74cae024b99d8dcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f4a5b4201b589d9f280c019f0d57ea5

SHA1
5927b9b8ed50665679bd136e94b2b699dd795ba6

SHA256
8ffd38d46e247141facca56c08842abaae1ad33c643ac10b7efde845362a944e

SHA512
165f1e37d0fc6a87f7689c784b1d5ba4d5c9a680535122ce5a0f4c49af8787126599571686884b049c89286f4129f3703a0c4741c02488de733a6a5ea02674bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8680fcd33f7c5e5bc141d4120fca7a0

SHA1
203b61f272744d11651cb19699cafb3ee5300948

SHA256
8a37a40dfacd1bb735f0f5c330a9838d89cd0f76bbb151157a595233992dd269

SHA512
c40964e2e422eab2288ba9badeb93fe7b8135ed34aaf74483c9395446ccad3255db658933fe4e092d75765162e22bd81578774796191c7c679c7bcce912fe44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f67dd9028d661849fcfc5710b36e8cfb

SHA1
61416a0e80513aee841d91d2069fd674ce857665

SHA256
4a3f78666abc5082b029ebe955625551de9e5d8ce2818b542b40de1c50ddd183

SHA512
fb3ad3a1a92f79376af35119121129dcfd7419b5fd017fd643c15410a8daf1ae7c135635c6201496858c6a10c3aaf3862bd580b0a3e3dab7a9beae78415c07bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d5e22eb8d0f813935d417a9253bda19

SHA1
53b2474742007794c2d232b3554c90f02f5601a2

SHA256
5fd67f403226f193cc103baed4566b3176d391a95e5ddb48eed1c0d9c1e8693d

SHA512
fb14cafc1d9fe106afbeee65fbf0d32cafc50edf3a3a10f481286950f0dd3976093d5e1f52d592d343a4eb44a0c9b5f192cad044985fa75f2117d775a8f16a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d503fc367627dfd4323bbf11f92d1b84

SHA1
a19da121daead4bbc67db0a6adb5a200cb0ea76b

SHA256
f548fd661dd3ca5af4cd349c0f2a7396ed97c96660aef76ba0a4847ce05c715c

SHA512
59926a62e7a0e6fa24064b6b10bf743537f7e6554cd4700fece5c0b93a77937e2699dd5a301c49547da649a9ee48c1a0dcc961d27cbfd7ca8ebcc6bbd7984cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2938.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit