39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/01_A_PORT_XERAIS.html
Size

892B
MD5

088af74719f300730b0f330c4f8420cc
SHA1

142ed2374f9161d28db21fa07df46cb5a1413ca7
SHA256

68c6535a1f362c483cfbf7d1e04e19eebdc7d5012335e89e52ce383b47810758
SHA512

c931b3e16fbe49a92776eff0e29f39900e51e60c7839402f373d66cc17e349ed6b2ec823a698dd5df19beaa9fa41f704eccfe262684d35fb0036e690b0592a95

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08b54c8c097da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000005490b936ac1253027bb8ba6296d1ce6224784e816cfdd2e361347ebd1f5e587e000000000e80000000020000200000003f75a9bb0306da621c3bab9f6a7a6ae2682f2bd9334d395c934aa58291a2651220000000a93afb6d39a44b3d684301b1548ecf86f82fc3c183baddbe38fa18d2a3c9415e4000000061c98c868594ea8331af55a4b6fbe639477fd0aa8fac5a2b18f4de6364395f89484df94b69cdff74fefee0340ae3327eb448ff9d12e1307920386bf53e8e9c27	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000c8e8d5945bd8bc2d38c746fce752960c6843bcc1f9229d41dcb3dd14c00f7914000000000e800000000200002000000084dff155b01ae8b88d92eb68c0d96dd4ba701435e9366063cdb964d50016ca9390000000445787cc143c25eaf16c43a33490a142bc261c1d6c89f16cd2fbc5287a27d5a86b507ed9f5a17d247bb38a33df0dc71effaa7dabe21cf1840bd72d88d53a92c6be4b026c5e9ea85190b54bd2f5f8dfa47fca82cba75cef0e0873ff6a3e2192692b90bffd1c6ebf581da3a76c22c76c8541224e5eb0c5f68c2692de95fe7ae6fcb133f3221450908e39e177029a8008b740000000f0ff437829c801c6bdc5f753b45d5f475db2e6b40fc066d60db67ccf9ba502aa69142ee591b70a6cea30378a25d76b0a4ec8974e6c0ab884ce33f89ef8a28470	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3DCD521-03B3-11EF-A5A1-E299A69EE862} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2748	2120	iexplore.exe	28
PID 2120 wrote to memory of 2748	2120	iexplore.exe	28
PID 2120 wrote to memory of 2748	2120	iexplore.exe	28
PID 2120 wrote to memory of 2748	2120	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\01_A_PORT_XERAIS.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8485f23eb2e665a62f172373fa8f6a01

SHA1
7947b5b06ef9753f80fbfaede5715d6289713cea

SHA256
60f1699265d684d21ae5f1037cb69dd4b1c78c28a9bcbe7bd8bd891b9a3f9496

SHA512
4c5173d7ee086e4b03c2dcf2a815922f20887d6a793449b7591e3dd87a1213e1d948c4ad742615cb23d7c5a8aab9076e29f19a5d2335b24eee9b2039e137187d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03921fcdb5159d4ab182ab636a6994a8

SHA1
8619e47c12e360c5a94338cd3ed8336a8c461515

SHA256
ba8e1025582c7a5b24545281733f44528ca74a677e6b8c1aa28a645fe0ee76d4

SHA512
db23c9310a5bdf8b0e31488df9401e6e245d0a94024b6cf963048a7bc108f78449005944dc27848b282a0b1549160653b3985f3259ae2705dcec938e167c9bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
573195e821b225e2b6e475a858d8976e

SHA1
4dcdd2e26a3d989ac532a7bf85ac9e481014cf70

SHA256
09f3427b362ffcb6708716bafd6e079281b6a52b42ff5bdf4dfc30426398ce11

SHA512
8b07418afd6904d965e3a59faa21e4bacb378192b35928d38a730012857fed054a29a8625ce18759cb7288b8d6a0e8239aef86861fbfea403308ddf5c1c42f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4cb1c07f70d865e88f194b27c09c331

SHA1
b2b7f0a0daa340f3a28c90cc9717bce01daffeef

SHA256
5af8b18dc888b5b5fe0fb4ff62c030e944a64844b5e4b64b50c74b4ade99a5cf

SHA512
61b6d3e4126829b5e7c1f0be52e2a29411e5ec389bbc71070744bc1682ab5efaa36e47d5f7221f09a99eb52eb0ed9a249c342afe049626cec853be9968876055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
055f353e8e619989cfb439c5011cf098

SHA1
a09627e2d8546bc7cb1969c6e6bc9cfda7939bf0

SHA256
c543aa4514c6fdff52374a8c9476eb3ae989640d72b81671205de89d5fa627a0

SHA512
3bc3f406c4bc22284d5425b366cc4d4d7c71ef3f349fdd2509e1fc19a359fe6e4bf8d252037fc830ff2b2acb54485a26df4420103846c61db9eed7e0fd03e6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3dfd6efeb4578ead4cc9bb1b0ca86ae8

SHA1
3e754f4117b38995fc08233432fb1223a269a713

SHA256
ac9c99b69f468a685c9f5e156c73345163315325c9aa4f4ad4569e82bb5bfaad

SHA512
565a342360a56abafafc2bb7762b0c7d2923346856d44297f5aacb10c48296091f6a0c57a01f6caff24d992131cf3fdc55ad6a8a10c36c68ee0fdefd7052f8fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
403ea96a385117b75ec950a10802a667

SHA1
75c55e9de41fa7400181b30547d7c8169a22b6fc

SHA256
9a59ad5ed8c5f78276b0bfbc25812c380852b035e4bd943946d847e92dfe594d

SHA512
e014f40547a28a552c53bd13c351e3e9c2b9e2ba4e3449c9f576f912973dc5f6116b71381296c65d7af1bf11e81ea20dca243562939b405f624addc62247f7c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d21d10bdaa2fb27b23ee6f7297681ac

SHA1
11be6d72e6411bc75f77d24107d2059eea55b7ed

SHA256
1adf4b1c5c66de7f839ef59d5988ba152f62ac09fa035092802821614cd85cee

SHA512
102e4b50b21fe34304d80f0d1dd711dd893480098ea0667a6911540c56a09ddf52ff1fe0da64aadc8836b2e6ddddfd22f9d2a70ed02b66b29f3011d65bb56f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1f8c123675e6190aa89340f04506d19

SHA1
223a44793cffbed073988140a83ff8369b5016c5

SHA256
1e9d92d65c0efff260c400504470e694d64faf27aa168515b21e1660788f8f48

SHA512
72eb7ab2ae93bda102cc7ee5d9030ed1a8a647c4a6e98de15c8167e8d78fb2d0f4558ba609feccb259f450db642fe776758924d69bc03dc65d756eccc0464724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19c851c9549a684e150db311e0a95f5b

SHA1
ca449e1bf6b620663856b3b18982d7372585423b

SHA256
5f2853f44d52ae116312f832ce69d7d3b105a72501590619995f558797762c13

SHA512
fb15f6e0f85e2694eefe9c0cf06735c458065f00f4017955f50e400e54031c2377df462435b7310e506d5c64c831bede7335db88526e59568a88a14f5017e696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6627fefb91d78c01a3f67318fe7a7db

SHA1
c1bbb0ea6b81854da6bfd200217c97de62f9f901

SHA256
f017f997c51896e827a6aec78af0b143d711e15bc6f7b562a073c67bbabfbf12

SHA512
0dfc4987db7bf6318e508db3c86a258cdbff44bc0c0ffb92a6ca5788617265ffedc12bdfe8daa3b1aca6e5fb2ddf9b10c4c0826d65ca9d71d827a8c5e1171292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DC7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab329A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar32AE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit