71a8af0c356365ac8db8ddf4fc029dd6d2c3db7d929182d11b2be6b49a42898c

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoSo.News.Express.Pro.2.0.4.PHP.NULL/Upload/cache/php/index.html
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E451B01-B0AB-11EE-8CE9-D2016227024C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005d1b5d353e2a065b4705469e445dd3d7661ea9ae0b022563daa51d7bed704b28000000000e80000000020000200000007a009f978bcf3cd6401a70037ce2f1137f6c22a7c6f6023b3b3d03cdca3f121c200000005d0848bef36c03a9ad89dfd1502738fac53967e1101e4e92292b6e291ed3dde140000000b2285e65e0a84a70098c7b5e074f1af9c21004975bba0d0ebd52d8ddcb5ee6c2cf8cdb80b1a1230840ab092d60001d3daa35df8f928207f5d80958d5aee1edfe	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411157899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f5c322b844da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006b99d4a7fa8415eb5a975a9023b9ac2af412cc9dbc7efb8b01a783dec1845d85000000000e80000000020000200000002d4fda592bf008741f77b6e0e07cfe7a9c9f3b4de461c6dc2d8147a9f601226e900000008c32432ffc5907e3115bfab8ac557ba772c4ff00ed8108168e3205efb5946398377ae90a73d6a0b365c19d3e333c7688709a21b23f41672d4037aed1650743c3a68828ec458496dcd1879d9e8799279f096af091796daa60ec4f51eb03225780bc2cde88310a54c7fbfbbe492b4a39922663152c01a1abf9f99056058b5b50ddb7e9d92fbc269009def724c6bd852e184000000008a8dc130ee52016761223fd77b8b7d686be6c5a69909ffa12793b5eca19c378782954996c5ce58085912b28dea53fdc2d9e7c1bb613a998ae370d4d51e28833	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1716 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1716 iexplore.exe
1716 iexplore.exe
2208 IEXPLORE.EXE
2208 IEXPLORE.EXE
2208 IEXPLORE.EXE
2208 IEXPLORE.EXE

pid	process
1716	iexplore.exe

pid	process
1716	iexplore.exe
1716	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1716 wrote to memory of 2208	1716	iexplore.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 2208	1716	iexplore.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 2208	1716	iexplore.exe	IEXPLORE.EXE
PID 1716 wrote to memory of 2208	1716	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SoSo.News.Express.Pro.2.0.4.PHP.NULL\Upload\cache\php\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
145fed30790cf313bd09f303cdf55e9c

SHA1
9daaf2860a7b5c52d029cba5ae65523c1810a1c6

SHA256
b2b9d23720d9b4268dc0a27319aa3dbbef337cef1eab881a8984923ebea60fed

SHA512
3fd1f06b0c21b31d26b71d1ff628da225943b870c8960fc260c8b392a23d660dc89aa8a10769ef979204fbcd9e029cfe6c3f8b247fb6d9e9075ab8a8161896e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4219e36bc6819e43667499edff6af769

SHA1
61d84ac69fe6b11e425ec936d9fd8aaeea3985ab

SHA256
71af980e296a74505fa9cf7f729a51ebb93abc324d327c2a20466c50962adf72

SHA512
ae66ddbccbf298c57cc84790b91e815b41f4328b7bb44668e6fc328eb005b7e1d2472ca68623f8e15062e815394317e198d8f52f97d6cf40d1443eae26d438bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b50514b999f83b3333a5cd8a892f52cd

SHA1
073b3f92b6a8eec122cea6782757ea2158bf4c80

SHA256
c5ab4616e7cae1f967c3caa24b129c1d99c728f95cf609f1a037952cd2ababa4

SHA512
b4151e850b3b74ed9ded7b46d0aea1b5c45b955cb135805618f8077b19b085221a947a102e0d4639b0b0ef5906cbf8a465fbf5cead0f687d069ca452e1a5ca0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
497e03a8b8070278de228fc1211ee0df

SHA1
415e0aafe33d68ddf3eda75123ea76a744fd2c93

SHA256
f91b5da212daf47a2a974abe36262e7a4434f130586e46c26e2a13c4bfb69323

SHA512
c3dad752cce85389d68ee4a6604ecb422fa109bd78dcce7768a3aecc56b60300b306ab76f52af7fbcc03885462db4ef145a98daa44d4c4fe4e44016af03c27e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92a080c5af259f4b3b2497585d3bdfa3

SHA1
5a44d4672d5d161821da482893b6466cfbe7c950

SHA256
c8183a826a0b00203ff5373edd413d9fcc85d3560535ecc380e6fac39c0e0f55

SHA512
34fafbd24562d594a824619fb672301b4e544f9afc666fa13b873a7e3cae933f63a68c65943835c5359c784a099fd508a7387fc03aa8d9ccf86257add447efd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b6317767829118a34dd17800a3d945d

SHA1
8d4dd8dc76fadaf97eb4b9370001d05392a917bd

SHA256
32c9f03da580cc1eb0a69921f6fc7cfee1409700a977174ffa1062eff57195e2

SHA512
e279341242fe9764339a5f08a3a844989cfaf7460bef7844bc7f9e43c65259c49e51660b10555a3522d14b34f98b8602964953dd07d2f4e6e85622e66cbc1dcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c676a7e5ef045dfec619fdbc184e275a

SHA1
d775a2a282eb9083ea039a26e08c67c6f8f1d9d9

SHA256
7c8ec9468c98ea175f35385373d5a3db2d06aa1de6cd949bdac1e03ee959eb57

SHA512
ca520466bf8743c091b2e67978e151c3ebab9ff32073c024776672b6bab9b954d0a1b074936f381672f68c9b4f0667a01cb51a7f1f1909612241e23c02151ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35d96a13e8a6d8e783c9d84bfa539b7d

SHA1
40da48f3ce4ee0cfcf5534186a68149ac6120f7b

SHA256
bbe4e0b0a18d546f96f9ff9b86d0966dcad869e53736cd84b3aababfd6538fa1

SHA512
b7826b7eb189ffa4a095272e3aba032982ae7bc69aa428c0aa61d1197ef22ccf82c5898394d12835938aabf8e42dbd048b3480a85a0e88aa1f9c3ed57ac3a48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
622d56d808ef8ee749fea6c1ca3bb2d5

SHA1
25041e8bd3a90c203d99590cbaa84c84cd698a82

SHA256
af00d1c74d12a71fc22f90a8387511575e8b0d5b9d12413ec8bfb2aa09ab40e1

SHA512
ab24650888ee6d32dd50f08196af7fde8b3f07160a96424ae2c8626380c5d78fd6976e581ba629445a021c7bcbe40cf4aea7737e57054b05364bc37f3d799d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324ac93d0ec2b2ee6fe7e92bd7847945

SHA1
d681ecf4579b0c79eaa6b9375b67000957e63a7b

SHA256
f49357ee93ee3cef4effd463ca4299330876671cf6b83a9233c877ae3a917f3b

SHA512
15c15cd7d71ca5f5089b120c3815ba0711a92cd9a04729e155a16540bb396aad3c91c7e9fdb81772f758dd4a9a21a6fb4704e84860e5b7219bcc7e3e8e95b769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71680effb23a8418b42858c917067e1e

SHA1
26c009d344fc747e440cd9da343627ea6678d5e7

SHA256
4008b3a55cfdd4139f0373a194d5afebf08242c15bda8711800b3d078a844968

SHA512
65e8107551b09fce4320c681c7a3c46874cb91bdca6909ccc1cade025be93370cc928ea2c4f724f789c0ed6ed452da178054f92b31695c75251b9d420317a5f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab346C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar351A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit