hxxp://7805 TO220 package voltage regulator

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://7805 TO220 package voltage regulator

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e060b6b3994dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000005cf7a49ee00569cdcbcd7704a59754083fb918f8eea684f1e260055e8b0a2bd8000000000e80000000020000200000007d986362549ce2ec1bee78768098c96ef72f0f749c937f8c625737877152408f90000000248b400f6e7787898d40192bbede2b0ff49263ab82bfb2604eeef99f55f56929839e7b659be394e86c3fda329239ac59c09480ce17b28acad3265373e912fbc160b32b2efce47d11d9fe94f3a01f841b2aaa69e54b04877775205c98dbd651411a34a531a32509eb561d82853d2836f33310a47cbe0ff046595dc56b8cd027257ea955bbc476a2da6cd187480e0033cd4000000008cc78bd82c0e37bcd97256debe0c10f69e15d3d3ce38c3b8f8787c8f6f70fe8c570af56187614dd4bcc80b0aa3187e569fbf9748958a8f6b65fbce808aca04b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412134385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF024521-B98C-11EE-9439-EAAD54D9E991} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008a8a1b123df54942193093f769372a9c0868b02b7151a2fb4b8a5819d7a5fef2000000000e80000000020000200000007671083acc91015d2c240d9928e0e7d40f1f6ffb5a3879c1abeda63fccdab9142000000016a55075846fdc6b870b4dccecfe2f8130a8afd6be01490e67e5beffbd25cc4d400000008cd611dede958347c4c1dd8c2a3193145941a8e05b01be5285ffa921f29a99953e518b642b0cb68580793be5a4671f050b71dd607004c5aa92accf7c4b54f2d1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE
284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 284	2500	iexplore.exe	28
PID 2500 wrote to memory of 284	2500	iexplore.exe	28
PID 2500 wrote to memory of 284	2500	iexplore.exe	28
PID 2500 wrote to memory of 284	2500	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "http://7805 TO220 package voltage regulator"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22939538889702b93169d4f8ccbd6257

SHA1
6d870acc52fd3495d8a11bb7ed6a3bf3cf4de82d

SHA256
6c439fb75a814217616fcb52d63c8a104e5118b734e80ca71baf50a433df2086

SHA512
cc228176594a32513f9234c2e794559bdac8bf6f833b808096990c8281ac3a0e50d4158120acf78204cd87503baff4a904c38f158842e3e69438fbb079fbd9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
206e9fb7795239f165d780ae7e7c6df6

SHA1
8719b13e892a08f99a6cc3d0b1de0933d32d5c1d

SHA256
bd56f3f932755940f8d6fcee99e29fffe0380e7520df5a9626e409abb3a93d7d

SHA512
70f990c6778280b64f58b608737fe39e50a1f1e2988e7eba79672644b635fe523cfe3845d0b0e588821188e7a00f6522894d3bd37b232c7b6b2698ab7baae103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cab558b80b872cb4d3097d09b69b91a

SHA1
d037b031c9054c2210242174a2b01f37a26a219f

SHA256
6f32444169ae7ce10e11ec98f899aaab8c27483eef5663f73f80c40881418a4c

SHA512
6b27d702abf7f49a8407f84e96daf354fa65d1d3cc4c554ebe6d5378f3a06eaf38ec6956f4c2109bd7f13a179f51d88d45b5ccef94bf13bd4ae55723a4012cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff500357275d6583842790f75be2bdc5

SHA1
dd666882fd912403fdcba98fea1eaa759aa2daa4

SHA256
2690d42561ffe17b76e3035c6d51feaea07c5f965d7445b8bf262a05a073b152

SHA512
673bc9e9a6e16706e92d3053b93ba0c47f9afdbf11e86c4f3eaca04a244ac59888611f75c1e57850ee1b0be44601a089bff23e60907b590da286f9f907eded7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe853aa56e4f2406df863d1a3b35347

SHA1
691a30f93080857828458c7f9c8602be1d10dd09

SHA256
89f749aee76ede8e63e6fe4063dafb471123de8ac03d56444b7a29c7aef9de29

SHA512
df9ce5410336324ef29d8cbfcec102a8c7c49f09cb0840782c84dbdda06a8f3a93f9342a27b088db329e7e4170d9a8c126e043a177db5b3ef07137dad01e9ba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc1cc2bdf80fa8af71f0168fb9f8ae6f

SHA1
27f96f48bdbf9d1ed53601c6b29994a51e6b3fc1

SHA256
6b9f5fb18ed8109566024333cdcfa8cdc89d48b03bdf85edc28243b9c0a66ab7

SHA512
571610375fa31f47fb4f1d5d0f7d6fcf6e9b60a5bd3e3abc512b3ec2247783654f68012cc423e65147b66f3e797bcdc36316bc37608e36ddc474be7b70b9a5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da02c376fd063311855e5152bb3a6ce3

SHA1
f32e44e8993cad7d11d2736dfe93b78e721bd0c6

SHA256
a314cf13e89d6ab22e12c9517b1572128bdc2b9a6cdfb0afbe9f28cfdf4f17e7

SHA512
7de76b98a04b3117676e8f407b67f9e6c1ae5328d6b97d4c9d4ff1ed513b92136b3647fc427fe5f86ef1b08c08f65f2d6c2d4b2d33537f661dd613b48230eeac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc220f21fd13d658d9dc7bb4841f1971

SHA1
7dd96f459875c0830f44836a91754382cd971287

SHA256
25c8d846eff72d71c66045e8a150d59158a8ffa269713b5a8f50745f3e13f165

SHA512
8b0cda4c0562c6c4dc0a19221551f5e35191e860b5703bac77594b7dc552869662263b42962218ab046edbdf8b9a3ccbddfefb55e6cf8a4f757bc4c77f42b03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eae5eb9159a4f2b33d608d0094164997

SHA1
c78d22a60617153951206851371544323ada2050

SHA256
f3343302369b8af5cf7f236a0319880c38263771e4cc2e35f508c433ef1fbda7

SHA512
24a9e4363fda62e40a5fa8716eda1f42032bf2fad73ceda3475e8529db185c2e8fd605adf454abc61c9116d3a6ded26792f0a6713256ebb1a6f563daece2a2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5786ecff2741d71ba6cdc4b19b5ff258

SHA1
a1aea67c820b4e7a5eb79d7a18a31f2369c23c37

SHA256
96694a7ef040e4a5c2a0913a91a173aaff412276ba40d913645ad11b6adc88a9

SHA512
26362f36be9e0c4ec74422b94fb6e9af32e807c25b2b681e70cf255547e89a177f89e3aa8eb1f3161f6a75d21c7a0b2b9358660df0959571ed6e35f4904702d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
119303d74f74459f70dbe6273206909b

SHA1
eb4b1ebe561f26ffed47f1e2ba59dce5dc2c5a2b

SHA256
0a406f2e1681690f5cc7446fb60243b14824a21ca49a48160f803d074eb2ff44

SHA512
1b8456a18daca54540f525f70683fd55751491c0a5c226fcc78e4bcf697e7cbb42808f35520d2c23e250a23a00e9678cb71e479e5367900d9be90276df75d140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
451b993cf2a93cd7cf62ac3125c107ae

SHA1
257a81f99663af6aa872c782a9173cca327648e9

SHA256
620a03199e37c1fc6559e25d6ae4d62a15eca4b0b9420135622a2eb5508910cb

SHA512
20a1eb18f2cefbc41051ee5a0ac399f78a1bc93633dd84d7c96196a22115906721b3e8c935ce3f300b901a448a5214206c197b544c8407155c0ab17b2b41cea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e581cc5b83f057aad0fc8b2ad6adc2b

SHA1
691c27060f24ce87dcb95a6254267259c15947b4

SHA256
7c60b1844afc9bdb70a6065e843d3426d54ea1c302c0eefc508746dbf0200ecf

SHA512
bb9f57f18f9525739ffcef119c8a693d7cc90bb60ec7153d96273bda1fc7c873bda7c80c0c7e75de022ecad67b75b6ede9754de166261dcc4fb66273c24281e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf01ce6ce8d0b69b998b7cf76ce3cff

SHA1
3cfabdd13c72d1b9270169ac8db8376ed8f5c7b0

SHA256
50f5905b200e9ef46f9c5a1b9871fee2e4ed60ef760d6e73727b1289d63ab011

SHA512
e61cdb9aa27b1f1233baf262057d01457ebe6c04604e922c93d17c2873ada2c7b627aab7c6c5d7139a78fd58e5a465894337dbab94a79f6242f4929ee1c3420c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38695ae018e04bd406d16f6ae303ed4b

SHA1
bd7ef992100a6580a9d28a26f593217028aad2a3

SHA256
3af005d48451496411364920a09e6fd17d58ea4000c4f8b70f7d26479396e3a8

SHA512
3e124184dc07580d4a0e86fe7234efe4053d629262fecb0a1eede8bcb08c542d2522e98b36c460f8f5be535bbe906a7a41f2eba6e70fa460e3c99ac2f3d15c30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3098af69760348bfc6ef0671f1371589

SHA1
75b13740ae598fb3e2170b1564a6171fd3871c6a

SHA256
75fa680058e008272a770eb3bfc53662b1b774de63aa5f7b3646c613988f16f0

SHA512
7109573764530baada5d7179891ecbaa276acdb4799a9a5dbe7bdc8f6093b3236401545388670667221d5641f998f4dfac5306b8d105d778c6e4519da4c0e478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f591763da85494c38c9245c5d5d4d34c

SHA1
661633882844cd784e30ef19c1e3474b05b06c94

SHA256
221f8513f399d7cd67fbf0fc919e3a146d641069072159618ff0c05ac2771adf

SHA512
a0f6b50d398499b9e45841ba63ccad69433711a05e022974c96454bdc8697fa642bc29f5fb65445543c2869645b64491473447960863861a4f1d3475bb1e7a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18dfd5fcb6ce3d19ebc36975da753103

SHA1
b5c57bf3d758d5a629457b51204e15e532ed9378

SHA256
3d158761b12414892d41dddbaa309aced60354aee08dc73dddf138bc91372b04

SHA512
a1ab7c293542af9861a82f669915a7a1b1df02cbc6bece670aa07ef6260923b202a4391fdb67a1756b4d12e762c29fa1416274fb11e0eeca4d6c5c02965b303f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df158b3944779bc28fa3078b114d524e

SHA1
1878a08ba7cdc8318c265bd5846cd5230184c1db

SHA256
181f352f7eb30024fbaf7efbb68d6df2ba57bffad2342d01e07060057b99658d

SHA512
1939fb7adfc5ec22ba6c4621117c91cb1d0e415a7db9d0fe093cd80bd52972c1a69fed4d3afe992a9fd291106c31a8a7bab8a63d107f12812bc60b78ae8557f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab277F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar282F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit