Resubmissions
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 16:07
Static task
static1
Behavioral task
behavioral1
Sample
freerobuxgiver.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
freerobuxgiver.html
Resource
win10v2004-20240508-en
General
-
Target
freerobuxgiver.html
-
Size
12KB
-
MD5
e98ef5b108a4045ec187888bf6830e7e
-
SHA1
6a09ef0f9041e6364670e5f33193b552c4022fb5
-
SHA256
8dd207331e1f51bc1518216d1e6e13e9e7e21cbf5713fd6c3073e339d41949ad
-
SHA512
64e6906e126ffb2c0d9d22c82674a40e2fd87634ec4d0a2cd9cb3ec53530e5d8bf0e931194c75e8722a61235f1fc1ee75d212b38c190391ef2a36c95384731c5
-
SSDEEP
192:O93nhybSPU3AcOvJK/ypAV9dDQ/ypAV9dD5kPw2APa79f8fJI49/+oEZ+/jNNXqC:O9kbwcORD+h+NRW4/jNNXq0Ohr+1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58C15011-21C3-11EF-9F3E-D2EFD46A7D0E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0094b30d0b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004970ae215f74bd4889b7e7fe68372dcc000000000200000000001066000000010000200000001ce53a8b06dea69e7650dde5e10a293c91b8b49ad9ec2928d5b67af635fefbc3000000000e8000000002000020000000be334c086a731ae770c20f081549488ead7757a1133c9fa7c1b217fb5eccae8d90000000b0d4fb710cb6b69beb6757685bd1cf788a3122457427351c6d2ce81cb1600a5b02bfaf00cde06134937ee854e07a961b5a5e85f9f6c4e0a6f59bfba8d1eb073cf23f39786e138c64d0398a95c36e8b76bd4d2b208996f3a2fe16185bbb3c5976714a9a14f4b0288e92dab9873bc517cf4ff82650bc570eaf2c4282ba3460546acdaf3ba52bd6776dd756993405b92fec40000000a4e8c2eed2731cbdb365022df20cbbe2bcca662c76d8cb0e33d2149193adb1ea8580774008170a28d58f7e64a6e08977579bf5414dc41883ce9ccdf0abb7958f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004970ae215f74bd4889b7e7fe68372dcc00000000020000000000106600000001000020000000e578378c73453d508e5c61cdb5a20604407e51c4755126950ca35b85409f345c000000000e8000000002000020000000fc6dec367c63be3875b23c77b9e513a4cab6e7b901d5a6fd9daf9c7d6940a6c020000000d64fe578238a102ad38c839b00204775e9175f7b76868274b0aa2a40d3eab478400000000adebe3e9d2ff0f8ce0be8b56d8ae02bdf0cdfbdb2556fdeb7dff453abfca6fa6df3dd51b6c0839f62a8afe6f4b03a52c0a67d67bf6b9f802fab7c89bcc6871a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2856 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 2856 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1688 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1688 iexplore.exe 1688 iexplore.exe 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE 2856 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2856 1688 iexplore.exe 28 PID 1688 wrote to memory of 2856 1688 iexplore.exe 28 PID 1688 wrote to memory of 2856 1688 iexplore.exe 28 PID 1688 wrote to memory of 2856 1688 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\freerobuxgiver.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5279165446cf2499d4acd6fc0aba62b60
SHA1a01830f035ae73a174108fa6d8ed09002e3a1cc9
SHA256b30e49acd53cb62b442614b859850ded70ee16558b3444bfd9494c2c40fea251
SHA5129fc6238e37996e433b7bcea76b0ad0e3396a9d205541225beba36d9d50f7e1cd56ac57d7057629ebc7cbbb446cce0905db76499930ea8081af4e617377583996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f213ba56037d43528c871a9dec5740d
SHA133c56fc9b19c0c954c9cdc4812b267279f5ed63e
SHA25645efa70a8c9638a328a8b2546263fad281a5ee642340c7bdf3883e11e703cde1
SHA5122cf7bfc62c3e65638797dd1e97cea4d1673700bf0747f7bda0db473601946c55f7845fc56768ea7ae0fad45f9f61187ed89bd965a406707e92cf9d7480a85d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccd36ead25437c47fdb9b61249775687
SHA1ee3c96b608454b486e8b538504e31dca5a296433
SHA256e74ec723be9b3341e0311324fcf7f947f96495d75291b708e9250c1fd81e0eb6
SHA512d4204717dbe865937e30e2a3ac1356c4702af7908a52580bab3ff6830d68964c1ec053724d93b62f4b0c4b225a3885dfa8ef4567fc5796f5d0bb05580fad8a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5964b8ecd20e51d53e29a09a3af747bf9
SHA15ed7f414c316321635dc00bc013f4e5e427d0225
SHA2569af2313473c66325f401006e6132abe46840c0dfcf74f1c60f233ab5e1a5c3eb
SHA512783ebf81e4f39b39b9c2c8a91296b1eaa652473d43416a997fba5f8dc9256667e4156e234efe5b8ee6f8540c2325e58169512717eefd49d362c82eed2d1ce900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6b0318f42cf6f3a9a2425b8f20fe5b6
SHA157ac040668b51c5a642e22ec04ce1d7b3ff9af53
SHA256efb48ea20cd76d751f55a465495e845b9d0dba9866262a181a608893851d268c
SHA5123f2cdd31d2dbc6263d7ee16441c1619591ba7b79dda1cad27386cfdad23ac81221d793aa6792b7992c2bfe98e2ca6b26985d6d7b246fc59cebad876ca9531fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c0edef45c5cef304bdc2e59539c9e916
SHA12c9c40d17c642aa0b03b8bad9a7ae4dc4c065864
SHA25639522a51e4e992c81becfe15143c77f85dec76c202e26838cc104dbac525de2b
SHA5125ba48dcb8fe0355b3982e2688a1a1235644b622d895ab48b7226adf337ecab5db850c0869936148bbb2de3529d5c0ac35b30194f9f6e8f1b19e272aebb1ec049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD583cbf42e9362db9b532709931aed52c5
SHA1004ba28de3f41ec970a615c5701d1fa5f1a5e5f8
SHA256dc20e7e0b065299c09991f48fc9eb894310794b7ea1331fa3ae1a778d0f5e6ca
SHA512a60d0a23ee38981f20cac746569fed586ccfa430acbf6888ed4b17924b91f17c0c0ea8e7a1174fef9d90747a40510387c04838b3a98c3e6952a0b6862c6d7360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59cee99e0f982024ca57d54b5ef3488c3
SHA14e87f8488d58676ecfdd309bb4b3f3806075d6dc
SHA256df56e74304a202f003b6d117dd10feac32d2af0712b93b6e2de83fd1b4744607
SHA512dc8270aff54bdfd23b665da7b1ece1066b7e6950ff947d982c31f8ebe9e809c43c41be19561aadf1f0d445a42117c8b5a6c43cb5ef3fb8c8d33392682a611828
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b7441f0e07de8d131f5087a98cef19e6
SHA183f7ae71c1550ef815c4fa24cc82c0be56c40242
SHA256be9cf0486a25af27d164ce2d82abc92bf05e90650027bbb1df7f0bc0fa54ed80
SHA512ff2ecdf2d587dd374756bcf10525321caacf1b2db9aef5b588090057a6097c14e7bbf5fd023e4cf1a96b901d58ea95e07c7f8faa39d90c1bc097708504e364ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b32a8559c3a8fa2ffb0652f8da5110c1
SHA1ce429e04aec90d6decee50c07ef9618300db7a61
SHA25602ed3450d064be5308689698c47f9309d30fb379145fb2bfb9b1e19a92effdc1
SHA512e29d1098d749f9f17014be23882a6bee4d870912da2d9a019fc71efda8b6b7945db752d8d07112841efc7739d506d690af71b02d757f0a187621838a9abdcb8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5574ecdc9097d5367042e4e841f8643fc
SHA1462117a967eb103e2b959471f5b1310255f02b53
SHA256dc84498f12f924051d5364e72eaaa81c384aca85264a6ac9083fc62771449329
SHA51264ca36836a92d41250b3f3cc72d100bbd2644c4b1b1e17367216e873d31410c0b0df42d06f0055edecdd65d34e5e5d2de04cde0be9997dd578bcd105732e28b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed9aa0348cf56cd5963417d033a5b135
SHA165127fc2694395e7a5f1f2b9cee133464377a997
SHA256aa43e9e1d452f229987cd5c58897cc691a1b2edf1638b9d43ef9b5e803e0e658
SHA512720fdb0f82e90bee3e38fa578bc61e04ba2eac3c00134e1528f0f071b928e18f1680b6604fa18a6d0a53d5498195159687a705a8435a9faab5e898dad23fb138
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5ac9e2c2a77b89731e1edd87bac14e90a
SHA1a9c6986f51068fe57f3e15ae6258a544a994c62c
SHA25680922e70e6aa25701492127861a8665854303211d3cc89a5fdc916a6ce4c4e0a
SHA51299297ea839ded58ae5a2cf052af1b73a546bd72013a7ff9d4571a09a3d8e01da4262b93436120bec55665545ca05b64f579e7f4e4070ed3a40f8230c6d34e586
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
16KB
MD57858fa1489c97b6409d3ce6c75901b9f
SHA1718c14dbc04b2ae3a072937b5db214029598362a
SHA2566ec35a4a89dee67eac3dc543fb20083e6a7fcd22d58e0a74c701a6e1342b7338
SHA5121e9bef7a006bc37ea54eb2fbc89f2996aed77f3043c64788b82a8803740a93c91f93cc6c1b71e76d19faeedbc738e939e112f2a20b5fca735b042a159b52b48d