41cddd93895d9a4a366745b94368e50525f929c8b6afb7cb997cd9836c1832f0

Analysis

max time kernel
110s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41cddd93895d9a4a366745b94368e50525f929c8b6afb7cb997cd9836c1832f0.dll
Size

13KB
MD5

c9d32dc75c5813d881d5321b29ff3f56
SHA1

f4fd38189d298bf2723b1b51fbd2d976719fd26d
SHA256

41cddd93895d9a4a366745b94368e50525f929c8b6afb7cb997cd9836c1832f0
SHA512

27f56aa7498395f7b214cf8d6e8906c866e9690dc73fbe353cb9c0c100c40124681d1f7f2e7cdf582229890983f1c01fe4df6f62601f8c603b07c3074e7c90ec
SSDEEP

384:X/2gC2RDLW9UXntTOW4GfAxXr6+Y9PffPz:LC2RDiKXt6W4GYxWbPr

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\facebook.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a09c7ce361fb6b429b2303a4d9f2aa7a00000000020000000000106600000001000020000000ab1d8ae5608c94f1486ddc5f172382d8ac76f32b4a251315a11bd1440af01688000000000e80000000020000200000009de232a08e2467f480c0e1542ece293ddfc61561a1ff26de72625cb8fc2516ff2000000018319b0bd8f81e5b24e705f547d5f9d69ac897e8e83314fffebdcd94939d98d840000000edbab75c42c4240bc286ba2067e3facf3abf879c455b337bbe8eb5d9656c65db47cbd48fb88fa20e7b19d0e64aa5c7e7e6bf0b4541df0620a10ea66aa73980c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26165EF1-70E7-11ED-9D78-7225AF48583A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376602335"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b15102f404d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a09c7ce361fb6b429b2303a4d9f2aa7a00000000020000000000106600000001000020000000427166fa62643f6b21aaab96d3066ee3477c93ead845589cfc513aef851831f9000000000e8000000002000020000000c1d3f42e0d7d767e9a150c42be7fab901676a0a2700c5098b1369dc2aa8caa4d90000000652c93da3efbab577f505b7080d569a844896ab1cd6f0d2901edb5c4b4ce7a83c44d6f5a86476b025058375fa2e70b731db514a324bbc071b60e94bbdef9ac8e2b02dec504b5fef1600548888da846207d5077d893aa72d41d91c4c306f1e68d02265d0cea3c3f8bbf62670b08c8849e8f3c52daec5f8b45ffd630e78bcd3482606305edc5a114796fe2c78af7f730c340000000145353d6b527176bbd6dfdf14bf1937ece860d55f40002b93c50a502d27f1683206005361c765c39215799f2fae2a443b0a2ffd75a451e72b695639852827839	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\facebook.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
580	iexplore.exe
580	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1204 wrote to memory of 1344	1204	rundll32.exe	27
PID 1344 wrote to memory of 1036	1344	rundll32.exe	28
PID 1344 wrote to memory of 1036	1344	rundll32.exe	28
PID 1344 wrote to memory of 1036	1344	rundll32.exe	28
PID 1344 wrote to memory of 1036	1344	rundll32.exe	28
PID 1036 wrote to memory of 580	1036	cmd.exe	30
PID 1036 wrote to memory of 580	1036	cmd.exe	30
PID 1036 wrote to memory of 580	1036	cmd.exe	30
PID 1036 wrote to memory of 580	1036	cmd.exe	30
PID 580 wrote to memory of 1780	580	iexplore.exe	32
PID 580 wrote to memory of 1780	580	iexplore.exe	32
PID 580 wrote to memory of 1780	580	iexplore.exe	32
PID 580 wrote to memory of 1780	580	iexplore.exe	32
PID 1344 wrote to memory of 340	1344	rundll32.exe	34
PID 1344 wrote to memory of 340	1344	rundll32.exe	34
PID 1344 wrote to memory of 340	1344	rundll32.exe	34
PID 1344 wrote to memory of 340	1344	rundll32.exe	34
PID 340 wrote to memory of 936	340	cmd.exe	36
PID 340 wrote to memory of 936	340	cmd.exe	36
PID 340 wrote to memory of 936	340	cmd.exe	36
PID 340 wrote to memory of 936	340	cmd.exe	36

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cddd93895d9a4a366745b94368e50525f929c8b6afb7cb997cd9836c1832f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41cddd93895d9a4a366745b94368e50525f929c8b6afb7cb997cd9836c1832f0.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start www.facebook.com/100003724281256
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.facebook.com/100003724281256
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:580
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:340
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      4⤵
      PID:936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b99125dfa116050879dd4ccb52cc42

SHA1
e3c1e96e4d50590c49f9229664cae2b3bc38c584

SHA256
1b1ee55d4af21090ec4548e8a17bdcd7b3cfdeafabc88ede32dcd8253dbe91d4

SHA512
e5d3cc65504838fd3b4d8d0924381436d9c40a3c875f83298454776329c8a130e3f0a39b5b0ea8f1e8e44d5a18118ae4b22c140a370a5b3c2bba50dc7d0eda33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

Filesize
11KB

MD5
fa9359ab92bb4850c4d08ec4d26374cc

SHA1
af9be8e0a818e4f4defa660e7f93a183a07f29df

SHA256
28da2520848bac0d640845616d4d13aa4910dbe9d11395098ce7eb52c4c1550e

SHA512
89a55c5d1b739e5202f04456e9daad994e27ae3b7f984522e788d281556d5229a8eafa1b5c2af387d9a54638bba2deab07a6ffaf3347af96cfe054d00a1fb16f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4TRW33GQ.txt

Filesize
603B

MD5
e533266004fc1665fa449c805c52f2b7

SHA1
8d7ca592e4cdddddeb494271d736a4ac474b6cc1

SHA256
23b842f97593680f82dd6e76ae4f5529a51627cf6ccbffe1bb470a0b25e3e957

SHA512
076299983eb6a05931f05cc51fb50197566727fd9b54481c75653137e6d61e4c74ab3d0a3c847209bf08c9760b0ff2c15caa324013685da71b60503ddd977660

Download Submit
memory/1344-55-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1344-56-0x00000000644C0000-0x00000000644CE000-memory.dmp

Filesize
56KB

Download