aa7bc6cc2b65574bd810888a30e496ea967a2234e336de1891063f83d2be3d4a

Analysis

max time kernel
139s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STCMS_musicV3.4/editor/plugins/media.html
Size

1KB
MD5

aecedfb98e24df94664b077d43ed70c3
SHA1

579877beaec34c69d2490ffac9e14d9bd34cb0ee
SHA256

12be76c980713a51d5375baf25e5f8876294dda1e8722035fe7d071e676f1e37
SHA512

a30c8c0cc896a876d528ecb5f4302e3cb9f80f9cdfac3bfb80e589a946a32c1fa9ef470b234d2adf5b6911fa114663c6c949caf0f219a35e8712da0d71a78207

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f4693d463dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000001110eead8b5fcf299351b20dac8bfcff0dcfaf5e6346aac90d0d31544f1e3e5000000000e80000000020000200000002c167352f17a0e014fabbd787788eaeb7ea785e21199f37b0bcace995e61e53990000000c3aa6bce44af0171ea937584f427a4846d78634bf34b84f7dcf9ddf3342dc40372e4ba948cbae1464271c963b64fba87d70eda887169c8fa4e2000ba36ee305a2843afd24629cec96113a3240e702c81beffc0b0841b8dcefccfe3540308d1aa8f3142f3adfe6d1f1b1f835117b6d29aab2d60d0ab8814e7b61600eee4acd6054199509a970792e06f15cf52e3d9c7ee40000000158a93411f45325786dfdc39da44a0c608f4614c9a9a3dd4050a4c77e5009127e63ac13e6ece82f24f662c823eefb0dc16038a9b1052075093f481698eb00651	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410339325"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000045854be0259f63b0c10b5dfba5cc171474f60441103bf3c7c020ef114db73759000000000e8000000002000020000000a7e32b4edfa1db4787c28c3a2061803bed15aa28c7de797b57a711dc077e22012000000016cf03e6f507525681651c4f2f000fa5878d480333be3bee69b278c23f236a1a40000000fa8809ba8c211e4f53ef74baa76c1cd8939e24a7ca0ebe308effaaa5855075d2fff26e5d5081e4c7e83ac1c5d227c0cf502776ccb382fa4fec5d3d6c0c6837ad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68810CF1-A939-11EE-AD90-6A1079A24C90} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2672	2292	iexplore.exe	28
PID 2292 wrote to memory of 2672	2292	iexplore.exe	28
PID 2292 wrote to memory of 2672	2292	iexplore.exe	28
PID 2292 wrote to memory of 2672	2292	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\STCMS_musicV3.4\editor\plugins\media.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d835e180b854cfd268b56160a79075

SHA1
f4057a715f384e54a5bbe3a0b11f904bdc54f397

SHA256
66eb40f907dddf9fdf8c33a260c3661d41027abd3b327eaf2e2eccb774fdd5a1

SHA512
e4a30be8a0ecece59e43138c0b79ec27b4e7705e35ea87427cec6b29c6c1aea9118d97fa8e45e20b7694437f33fd0454d3f529478ee9b5471c3d4848a3c89f76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0903154aed271d81d6ad493003f0d0ca

SHA1
29fb907304428d1a6e3889822cea8c1097edec2d

SHA256
430b0979977df3e310503687e09642f47027db37e5e33e9ddc288589423d1b9e

SHA512
c27367bec588558030d984e4d14e56ddae01bfb27c3529eb6ad421aa24d2463b367d87112cf691fd794f3ff08767cc5b95f5582ea01d5baa6158f7105a97a220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b5611af79d5482a715f0f6c4aa2d38c

SHA1
23dbb299e1ad67237341148208cc2540089052d7

SHA256
8d8f20536369171961d7ac6a2650ef84c7d81deb383695b9c9cb3d0b7347fd50

SHA512
99afc3ccbfc2c9141dfc762d52ac52a03668cbb039ff60f56a4dc95367ce0f9d19ff981910269910294dc6fcf7e5e9137dbd7e77bfa01c2761993ee827d13917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95fb62089bb18e59ac0e6813a00d00a1

SHA1
103e681b29e420a9557c6d149a5f70ca062f4bac

SHA256
990d3064b6ad66fd388482207bec5a1bc8769a1a3ca4e4994dbd05eae35c40b0

SHA512
94ce0cfa4f96ed977295e8c54cac9b9f53719a76c46bd1befe1232ad8c5c9bb978afe9db4a9c755684142238ddd012a360285b3be48fe3b70d2098ce274ed651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7e0b42ba8883ff15e193875ebf3409a

SHA1
190408fd06a98550a7149dfffade58fcaf14ee70

SHA256
c60c215627ced9b5324a9245f5af8604b5b231f2a502733460874617f70ac540

SHA512
a6bad57864e8524c523630905e76436114b8726cafece16249571d441f206ffecf4d4ff61637a951bdbd7270d7c990821df4bedf80d5e2c7472a68a27c99685d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbcf5c48485532703e34c2fb888309f7

SHA1
f5f3e9f8ab9baadb8d5ca6c7b243518d2d5896e9

SHA256
f57f30a44861769a11f788677c7b57fe82f96b08cce61da44d794af88dc65f01

SHA512
05bac62490011e1b0422831ccdbb51c9cc2fbfa9fde3b8a919bcdc7d90758e9550bc2c1b3e4bf9249cc171b5927b9cd5716d72d69d670398424d6d4cc95b8ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81153df9ed238dc46fcd70ab8555166f

SHA1
894bc96eb7286bfd013c44ae662631da5ceffcd6

SHA256
71e3177f98db554b048079ea337fa0936c034f3af4cadf6ec8d5bd0972d6e662

SHA512
47a840e54e88d8040d117f83b91dd6aea95b41bffbf54c1d42011cc3a93437c3aa828252f0e4b2a80f42e353587ba6b1f56df9cf00dc18af98b6251b70149c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
172e7af9c091a6d872f484b14279b834

SHA1
a26f61e8de0eb8f1b7bddeedf71e497e24129a0e

SHA256
f4ff54022963aa90d59626936e2667284e8e0ad077592c6501ff4bd9e2632ce2

SHA512
40768e1a1c0b135b1fe046f424a5fbde64adc21ffa96d1a4f6ceb4a0dbd5cd4f0c7eb24e521716e1f13db959b2fec5dda5b953830bd726963a13a359fb324a91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d25ac7bf3e6a6c4aefbdaee06bd147b8

SHA1
44c08ff5c9b0443c61687ab7571fbdd00019ef02

SHA256
577a4130316426949f58b2c4e8727e72fda6e38674ba6a3c1486be2d4a1696fd

SHA512
1359683efe8085156b82cb5b25d42f607831192ffb0921962cd0b7b1fe1c84554eb88265553dd2139ec98670a9aa2c67f744b2be81a9772694e1dde0c5a2804c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac81232ff3e7961774cdcfc4c3d4fb60

SHA1
50f4173195bae24c9046cdd745f4a60b20af186c

SHA256
6083800781bbc5b2c544e92e3a4447d2f874c892601d57b97d54da6180f92754

SHA512
ec351e32557f0bf6cbc141479b957cc0a4546d05b2e7491c53ebfb2b5e74fea20fecced4bb57927b7f81e5ad23b87b6044ae3b456c2024c412a46da2a569c35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9E7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB6C7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit