905ff9db8198390e7148025b7ca8d7dc66b60028acfe44dd0372168e0d53edd7

Analysis

max time kernel
95s
max time network
96s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhishMailer-master/Core/Languages/italian.py
Size

43KB
MD5

2fa9eadf6fd565417c7859f9955bd853
SHA1

96a94af3b3c33d836df2690fe5c2935e2dd4151c
SHA256

b5608ccae5df82538a91e42bc698367f5037b80c540d543d11421ee617aeb8d4
SHA512

c2d71615915846fd325dd15cca7cd1977545be55bf4aea0f374e5d07ef64ca2f2923cdba3ecc1be16b7e019d08d29586e47dbd2ff8adbc3f1a97121946da7d47
SSDEEP

384:Z6LaCVmLI2DGCnYu/yv7yp5y+6LTPCJsnc5IZ+gF6+M+Sevj+2M+Sz+j+l4+pdjR:Z6hmXYbv2pE+2cwxFEFln2oKYre8MY3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02F69A01-116A-11EF-8FBA-CEEE273A2359} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe
2388	AcroRd32.exe
2796	iexplore.exe
2796	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2748	1876	cmd.exe	29
PID 1876 wrote to memory of 2748	1876	cmd.exe	29
PID 1876 wrote to memory of 2748	1876	cmd.exe	29
PID 2748 wrote to memory of 2388	2748	rundll32.exe	30
PID 2748 wrote to memory of 2388	2748	rundll32.exe	30
PID 2748 wrote to memory of 2388	2748	rundll32.exe	30
PID 2748 wrote to memory of 2388	2748	rundll32.exe	30
PID 2388 wrote to memory of 2796	2388	AcroRd32.exe	33
PID 2388 wrote to memory of 2796	2388	AcroRd32.exe	33
PID 2388 wrote to memory of 2796	2388	AcroRd32.exe	33
PID 2388 wrote to memory of 2796	2388	AcroRd32.exe	33
PID 2796 wrote to memory of 2832	2796	iexplore.exe	35
PID 2796 wrote to memory of 2832	2796	iexplore.exe	35
PID 2796 wrote to memory of 2832	2796	iexplore.exe	35
PID 2796 wrote to memory of 2832	2796	iexplore.exe	35

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\italian.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\italian.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\italian.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.adobe.com/go/reader9_create_pdf
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81e79c3f45d71bec9c758175b8d984d4

SHA1
6026177989f427c1cd4ea080f08ef2d77813b47a

SHA256
f0eea9174d68bb05212c8e3362905552d9945217b088a38e05db53858b3335a6

SHA512
39bdfe783f351ed9178d97750eaec1a4435d525b5fce20bd81a964e622256405e936454e01363885ef0d44582fc21f465a4f143a3a63f5ddf2fefe942fdd0916

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21a9c05a45cfceba3d82516501097d40

SHA1
6df90c81b885bdf170fe174e3f5128202a93b750

SHA256
ee7107afde40899ac7b1b6e3d5acb5b8e0158a39befb72445b4d917aa7dfdaf8

SHA512
a515c02bfcc6c61f4ca3373fa22efa6db9e5904fda929dc34157a46d90c3a9b18c4eea0cf958fee35cde0637a3c3b36347a3b6332f87fa773a378bd102f7a738

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc1bd5e764824b458f3dfa3acb6206e9

SHA1
1835ea9b6a642c6a242f07e5b8dbfea4d27498f1

SHA256
c7563a4c53dcfb5c9195d8dc3063fd9e48e2afcb76c53a92ea1de088648f9913

SHA512
ed48fd1afdbb88a4d833c01a38e7ad4e696b4d7596124c504ddfe53e86c3a0b819b3af06e372b5ca164ccb1016ad8f59c200295ade57aa975704466d34b0330f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23d4352cd9b90b7ac6070eb609db2451

SHA1
c1cf26cf681f46eec0ca97b4cf2644fcbb4bd163

SHA256
39869a2f1baba1c4ef023dbf172775454b49456ff0685acf07e82a16c41fec36

SHA512
bc78271d715d3972a42306897b35635ba5e0f2ce85ed7a8a8002edc8959585ca35d6365ff86cb5d3f2cd92bb0e11aa918791b3b109751885bce5d7016db8f322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42f72b5bc4aea57475b249afe70bb31d

SHA1
db6c1f3d746552f2f7715a0e7f6eb479c2f3da78

SHA256
3083ad0af5df64f84094b9ef0138a7817f582b0b425942b0fe6dd1733e7336f1

SHA512
535840d0c4674d7f2f00df3dccfea9970379ab3ce602d1bfc62b34cfcbdd35342755e5f4a956eeacbfffc1ab1548b87a4b70eee2eef789a9cc095ad656edf58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ccc3590355f1e15dbbbcfc7ebeb9713

SHA1
2d21847c73618e5de090c8037dcb8bd599cd7865

SHA256
f02037556da5c33a371dc8eaa501cc4adea98cdd2a3fa593e2849841aa90139a

SHA512
df883fea8c8faa9019417f7ef7dcff01261a160b1e647ae2db8b2b3b21d14295f10655ac830d1cc34e6a9f2653c1d084d49199689a76fa860d25d3c6d70b3e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63eeb94f136b58cf334503278da8bb5b

SHA1
1d86795772d1121a0f7049cee0ef7ece280f8231

SHA256
07e2b09016285fb53353dc1902097ca611bcb48565303525c2d41dd51505a891

SHA512
109f1df10fae11d2023dcf61302ad5bfe07b2c8074537f14775a013f604efcd08abe9aa5960a049d22b5d71f8dbc4f0e1304235e8435767c75f2c5a5752f3299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7d1bee53c6375d04a7dbe6affa95690e

SHA1
c2b001ec972dfa838590f2f9a4bc3dbce06f770e

SHA256
f9abe295b6081661339bef8d2d69df3ed99789ab31f6338c0f6c203878d088f7

SHA512
3ef0b687c2f0805af3bc0c4ebe61974cc90da05fcd7a1b9d71f406320b6f4f439bf9d5e2f506355f950cdce522eb2ba92d79a3226fe035f8f06a86013255dc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d60fb475ed3ee1aa6de5bf1aeebf9d44

SHA1
400f73a9bd0b33d983bb7e9f09649af090f1ffb0

SHA256
5a3542bfb3b0a8669c8a06887578fa07c45c7bd1a3c01fa212df92e4891e0fd5

SHA512
0c70f93a79be49baf783735a7e48ad03fd813e4738bacb9e0b451dfd963bc849c1d47491f1f2725911198d9d1305407ae381ad3bd724cfcc79fa6689eef6b0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afa4057da2a8536160f61a91a42cfb41

SHA1
575b8c76940a59133a94f619652f6b175f733e94

SHA256
668abfeb0a5c693d9463d81c39ec67d060f6ea57f099443cdaf2dbdf67b79cdc

SHA512
3717bfe2c662f5c18cec7f0d76cb050747755e2e8e7557cd7a27da9bbec04645dbae611357bfdcfd79f822873e51b7fdf4b9a5848d378ed104f4600aae3708cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7DE9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7ED7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7E0B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7EFB.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
171b6c8d1cd5f4fe956c7e7c5e4bf22a

SHA1
fad1c28ea7e3d34d5025017a100a3f74f50a88dc

SHA256
9ba0fc7ab667900b055e00c3c32eb575b96a0abc02cc1da3eaf59ed1fc97b531

SHA512
93a6bf04dbc306f40fa884af7b15b0081e3a6e1298f5bf29c5687c71df28336120f6abb926b645ccdec75ad9b1c5e50752f4c80c37ecef09465ade61b5249dd9

Download Submit