39ea4ec37f2ac6c408042541a6a8b952728899a8371279aec06a9cdd3d008ba9

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/05_furia00-22.html
Size

2KB
MD5

fb2ad310bda27a15a492b9d49571ebbf
SHA1

e3f9b0cbf28b2eb6319a4bf14b3b391837316906
SHA256

32503ad4489ae2115c4210149e926153546415358c825c64e63cbd5624cbd7df
SHA512

f0c7d6a7b8f4e7bed057853f324fc301c383ba7faab892a97c261e955829c1ab423739e7b7b7662293340fc89dea49617bc04f63c2cce89e4378b141cb375fc7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000001af0d9d7b89c02bff5e27cec878cd60d7973d39b35eaa4290be98685607d1a44000000000e80000000020000200000000fdf3bb9c16843257b2b562ab499457334b98eff54447d85be4707034162af4820000000da3d77aa2e28f5938efca07319ed7285ddc9333ed4bcd24f7a2c47db6712160140000000d7ca131db6e992496ffdf911628b8febbe09b0e41e6054f5480e824294558b58bdb382824746f06c417a16eefb31d006f10000cb3201c74d6ba4e96936e55071	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cc51c8c097da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3D831A1-03B3-11EF-825B-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287569"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003f1e2063ce3e00f371409f1ee481a43e91709c346e9d71e8bf9e8d194c9c88aa000000000e8000000002000020000000324da06688808aeb6ba56621128804e520bff82354da513b1e8b606cb28bd02490000000c9398586dfd7804c455a4a3ac94c199925903580681fd62b62155d63750d065fdc7decce85ee4a3478a3f7b77eed5a8068699c1e213265dc948d32b002e357257bd39e1277240c73915f93ace6ba8765952351f1d279aebc68dff3057aa8646802539febf61042a185e0d80fba1a256312fc74fa9f8639dfb74355db19179a9179d4294698e02c5ca2c97cb57076167e4000000015aba96021d070efa295cf11af5138e912359a4481913a3488ff7fb9c1b775fad66c18e84d962c09ee36ae4ec305b98ed0c8882d27e36216eb459fd776849544	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	iexplore.exe
1196	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2092	1196	iexplore.exe	28
PID 1196 wrote to memory of 2092	1196	iexplore.exe	28
PID 1196 wrote to memory of 2092	1196	iexplore.exe	28
PID 1196 wrote to memory of 2092	1196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-22.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3b39266ad3b1b477561b31cb0794589

SHA1
d64c31ab6457e69e10d768e3975309db17f71e05

SHA256
db5bb7a4e370727728ad3faf340bc647c6758897f0336cd10593c19b2cf9a310

SHA512
2391c9ede350042c8f66f60699287ae0d71560a6e1ba88b32f6c283433ae43107bb35ace76dd5409592932a6d8f2e402ec734c3b9285c2c9cf7b3fe8c4be4646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79ad01c9f505cb66b23332d740f5798c

SHA1
9dc04ef4a765f94838bf2e52e9c8d8e63e3a07f3

SHA256
75ddbbf6450abbfe7d22cd6122557226389773666a44f685eac9854f96b2ae52

SHA512
4c472a7e89b5678b0d017e7aa708817bcb5248ac0838a1d69db63facf20c669a101043dc832ab6df49bb83039e40df78f6fef24e02b2c09a264ff927a3041d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd57a91d7b31bd43fa9759580caf61c5

SHA1
294bb1b151ddd7e6a4277d1bf26ebed7005bc8e1

SHA256
46ea3f8f079b7b23c53cde058f17fe0e17575cd0148d4075f3a73839de362a96

SHA512
ac28f22c6007d0e9a50bf8570ea823dd1b34c9f33bad7df81954bbeb6962d479ae27ee85d343eeb61b7486796a2c3f063917df3915b5364930d854f2ad6b3883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be8877b046a6c8cc62deb51daa1ce1fe

SHA1
f3ef92b4ceb9786b94356f0e4006c684bd442f61

SHA256
93e5a613ee306d87a5a82cd52ef30696ecc6f79eafb521671669a8e855d47eac

SHA512
615a3499f70cdd2b9004a599ad4daf92b9be62f3698104508d469754db9730edbefd0ef23f7b14aebbaed257129c96cc630e74055636962d1e8470da95c00caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cc1f3d57518656c11d7c9fcf151692d

SHA1
f8c12a7b521f2e1a6552d0621182a9b073623a1d

SHA256
1b8a6e9a8f5e4ac07158eb9814b3e460e7b02ec0ad5f24178218c9cdd0f5325a

SHA512
b52634cee9e00cd87d8003b841ceaa7404ad2eb6f9a039eed924cb0d3f6410c33d8c248eef10dba98a32418b6409204d3f24940586a17be7739d5a875788777d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25f6c97ab7f5ca9e74e9f52693f2f9cc

SHA1
ea851e140dca51d1378f7a4916c5aa9d9f50382f

SHA256
205956baf743ea709a4161692b180cf4825cbfa3549b78def2262eb69cfcd24a

SHA512
814376876984396c547bcb1c8d83814b9e19f15f01a3e1255a85681ed3357431d8e7ca32da61db1e18605ce81ab468dad11b196e1b30482f47432fb7ef79c408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
816304258b9c6069bdd31b24b854f76c

SHA1
64cb42f5cb37fd176a33e66feccabe251d59d67e

SHA256
c252b720621b844f28f67b46de32b9686d678e340cb9ef97ba088a9e3bdd78ec

SHA512
82a7249c62fda3a9d2fba88d056e8ee4b6939fa601c76993cd283695d4a40c43c52ee1f4d860e8f68cb9fa5e80891794c3983ea4d4ff46d9737baaaadacd1d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b05e6f2346d17429cb6e9c6d1f460ee

SHA1
92e32f9017a16bd8d043e03260171279277676fe

SHA256
ef5d50a1ee24081a7a0cb8ac4ac23ce2eb7b1c4e94c39fd2248efa788c6d0706

SHA512
06b727988fc7ddeb67804fab7e85a0bd8ab0b3bd5d79e0de26d286b7ba89a2542c9e72e71638a5f2bc4affe62e0ff967b57df9a6499dfc20e8a1130d4b815240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df922a8611a38af45303a81992a8202f

SHA1
8a4f0d8d8cf1afa7f78f152d3742b305abb89231

SHA256
32f9d33271aaf091e902be7d3efd535d60df9356b08e02cafcb580f7ab3cdc71

SHA512
7778d193451c57f53054b4cf11b166f7527fa4a9ee96b1eed84037ee33841574b39f71d6f180baabcfdb3462cf818c98a56a2df30e5ad3018f148055c60b0450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6e32d1e911abffe1cbeed08f3abd19a

SHA1
cf2625497abf56d5e6c8e56af678a7a1f1d18566

SHA256
cb36fdd8ef2df6bcc0d121ba17a54e0b8de8dbfa99a1b28a8a6dd2330e6b0202

SHA512
6666460b05089a62b47ba20858131498b410cd0e7d97f2eaf415a1be19172963386b28cc55c4efe4e950fd58aced80a686a922881eb82763c07c0e88b7e25e9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b87336f512717c7f0fa127a24af72e3f

SHA1
b8c40ff79fac9e3f75cf79d3bce52e3951b44563

SHA256
8ab541f09743e0126d617f576a0bb406a37b01eacb98362dee8f2effe3b668bd

SHA512
5ae1d4c8571380006c2a1da579fd093ea16a11ada9c47f454a8e4111b7d69af7a1b211ec2c4598991f5180423680e8a5b2d7654d50b7b35bb4a1a14b7eaa1cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
447d5797b184cf2ad92877a573afc813

SHA1
1fce142233b66a980540a1ff4d2ca02bba37237f

SHA256
a2a35babf5d5a6f45cd25a3d2cb833f20773944541b69a8ca04f24a151e1bced

SHA512
56f2f597e79c242cf5c9b1cd1297597e583a92f6126dc21f64c2c738949c5cd02e1419f6a2ca0d78832bad61f37ae143687cd231a2493b43ebcd58b1c8a08a8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5045.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5126.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit