42b3cda9f0e7e1814427484354ac4293edcb9b19618ffe8d0587c26dfb5a92ea

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Join-v2/FCKeditor/editor/dialog/fck_find.html
Size

4KB
MD5

596afecfcd62c0fa79b8b52e8f347cc8
SHA1

939d6585c04af8edd7536e6a336e19a20fc0f6d1
SHA256

d0e8b94869da5c555bec2455f78f4cfaacc855eda9ae47b062ffa2a072987f62
SHA512

e69673dff10297a909b5ec1e9799dbedf7bb19a0c734ff883480ca017cebeaf6cfbe01201611b2abc206aa900e8ba29f0d4585a7d659ce53c4b9d8b3c0ff581a
SSDEEP

96:jjIlIhoImIHa37lA2pDcyy2bmxtnFKjKcONcOiAcA:HIlIhiIHu7lA2pBzGdFKGc8cOtcA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000130fcce7aaac9329125828f46701825bf654f897aa59e4e453fede692acf64f9000000000e8000000002000020000000d10a29b07e8539eba8cfbc1c1ca2231ec428b0162c221bd3ba102897ab5b76d120000000bc0fb517bebaee3f5778029abe7f952b433684d9a94fc7e8159d912f83756b7b4000000076aa005c050333497765720042e767d8cfb3e530aae67520e07ab782e0b7ea4a4aa2328803e90100efce86d47eb3cee9dbc8783709ceeab600286752f332d802	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE747AE1-A85D-11EE-97FC-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006d03ba3ec1c343f60ad7ba4abfff1ce633a3f5826a8ad82c6a4707aff4cf7f4c000000000e800000000200002000000045fa9891806936523894fa0e18ef251922f83df7608c995e9c5eda4497b157fa90000000102f50be32c08b46ddfe9360b52d77bacc323ed1cb3de7abed87cde42b79b1fddf31c48373bc67830fedd92fa4739cf06ae667201790fa4a8ff8dd1088a938d1655866f3ebd688d00e45151d29622e768b4276dede98a3f597bc32ccbd81d85e0bfe60d971fec2b13d59e085652bfdaa8e923a277e3baa0064f332d456e7911f24160e539162ffd930c42f7443637cb440000000bdd6e50af4bd3fa2cf01f1353e5b8d1b84318a2c578de1e195a3121d7bf79d9c63f8868406dbe2c798d3b557365815635bd24698826fea875d0269dd598018a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207708c46a3cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245062"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28
PID 2336 wrote to memory of 2688	2336	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Join-v2\FCKeditor\editor\dialog\fck_find.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
570c379c22405eed4ec3c6a41222fa9c

SHA1
b0f17d5c8f8bcd5d9fc7a39aa782004d078ac471

SHA256
e216fdbe138e193fc79a352372df1ac5455b106fd57ea4fe24dcd73a7ff2d3ec

SHA512
d2fb55b9c0c6e90192ae41bf64ca76f28b840c20be93571f18f758168647cfc40bf7c868cc0cc65a6e80eaeb7e844cb59698d3014976cded2c21bc4f14013a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef6495a3f7dee3b3f8b4605b3c697c1a

SHA1
3e9cfe811eeeff3d80a068cf0dcdc25aeb2f3cf8

SHA256
ee2019a6663bda0cbd5bb501154fe092b2af545fb330077f45f3e0a2e4e2961f

SHA512
467ebd29ed0184d541f65d469580cf9c2c8861558706cb4cce719a34cd0cdefa017ab336ac81af7d31f3c2c84b5625559420a90728679914f3492f1af481fb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82d8784423023b8cc3d97b7efac91d4d

SHA1
e75471f81f27a4a201addb8f52526ec879ab115e

SHA256
b48394ba377dbd1df4bf25fdde0c48262875d34f956b3edd01e8700b8db02e07

SHA512
d116111235775662b3a09992711ac5211c062f897f4145598bf3c156a4822bb7ea02fff51ec67988940cb7619a99a4ca31d93792bbf0ec6657f259bd50bf575a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
848370c9d5c2003eaf0cb5f64d819cc1

SHA1
c9798fc7d1418e5b0c9241ee5263ac31a5905beb

SHA256
d9462d3d4529b5884f3bcc3ac388ff76142c9dd45f9c22be020023708c8a9bb2

SHA512
cfa521795141910e51d9efcf4a122aa876cb0708598978db766aef9f4fa96e7cbbdc8275cae938f7e85993caecb9f6e2d2d2cb1854c290e56921f37e3abb6a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b5221bc47d0a6aef686ffbf9987dfce

SHA1
6ec146f428ce2cca9b04747b403feca7904b72d6

SHA256
70edf0e074c65f754823f219bcecde088ed777828548ed36460270bd6cb7709a

SHA512
20a769ac3c033895bf74c52260cedaf2eb0cb226242514b3848c660800ca9d58d626d48bf93bb1d85f231af7a6162b083090591c31a69eafde8bc3f0642f20dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D54.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar911F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit