3d21dfa9f199f495aa956ac9dab889a5e95db2508dcf65ccc131346037288859

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 04:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35256345/chap1/ChatRoom(Csocket)/Example2_ChatRoom.html
Size

1KB
MD5

0f63465786abd04ca8e287260a70c107
SHA1

036b4c67e44168972adaa42c22c9924616cb0b9e
SHA256

e2084f6cc3398fba52089b5452e6b522c915493f40b7c312e2952c0e0721aec8
SHA512

8463c0b8c77902daef15b30ef1348a6e4bfcff4f7371108455c1e99fe7e22e4f94af9fc0324a31db9da4d9ba6843e5e2fa96bb3cf80d16af888be0d867608731

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000070b49cb4a69e3f704500cca119bac5f4a275e0ea6f9821a5ae3a134aa965e54d000000000e80000000020000200000003bb7da02710d259c71cb833bf7f5525065838981a4ba048a5f79bf2cccdb431b90000000936e960e461cabcde16a4c9b248273ce6cec4738a6e60ef5398dfef5af9a8b8751602d591d7658e26bab1ece775165b3ff482425f0a556f19c1efcc250b8b391f53e2e67476cc39b526e1252a7b7eb5ba1ba5dd82d091d03fb09d8d0d4590a8da19f27f669c2729eb7ec7541e34d3225464a7f3162a0967f1e4da1664eb2d4212fc42936a94e1870e2729eccf76686f84000000036090e9e9c4282e039664e438e1e18ca6b8043c341f53d7d10b77afefe24cc745d2d5d716c89d7989b7cfb4c06af6b501cbe33f6b18bdc6d228686ec10f6bc5a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70451B81-C319-11EE-9843-4AE60EE50717} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000fe8ccba82d09a3f6c8f994c976c323ee8a986207a5b47e25ee9ceabd6e1e65c3000000000e80000000020000200000009e5b9694ad43b1525cd4b411fde653e759498d66e4e0bc4841dd5cb2c74f96d22000000072e51bda1c3aced57858864074637d0f48a41d824272cee165460054465dfdd640000000b991de0775fc87b90a957d278f236ee1f1a8b96a8dd1a48a150d84a9af03448704838c16a31281bbbe2a79950db597634996602c5ebfdff15f12ab46f465f611	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413184321"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03f3a452657da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28
PID 2480 wrote to memory of 2720	2480	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35256345\chap1\ChatRoom(Csocket)\Example2_ChatRoom.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae51db1d0b3ffef0b339168867089a41

SHA1
de41bd4c4b7c87ce9ef31e391774758ca28b54f0

SHA256
06e5bae56f5ee35cf11eb6b0c26af2b2366a304b429855b3d4291b7b93fe0a62

SHA512
bc2d0f0275ac5ba1bbbe364f67091fa3164ce5cb31394ff6d7ec990d7892495909e7382839ef97ddf57f3e3cd5aada08648818d9e8c24211923026ce6991cbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d57e0a32dc02158ec6c0187014482ac

SHA1
bf0fce3038a2aed69decc3416f975ba4fa184c55

SHA256
7fe4ecc7bea2a2bd2a1d04f87d49b729f83679decb647f2f8e48d509164964ea

SHA512
ebc616c2b0443c03c567ff6ee499d407f56b409e5753293cd9a35798654fb0b4da04cb42d0bef4b3cb8ed9fa2f7382c43840e0ccd36e0987d8fe324d916aed1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
820d4d2c993395e3135c28551b309cf1

SHA1
63fb7def3f800764ef634a3fc5c5bd88e6a4dbd0

SHA256
8b4fe9ee8f9d753981db5ffb0608c96ab01a6976acbb3be7bc5c0b668da2a8ba

SHA512
cc2d8da07b9d92fac90cfa322de21bb82e5fab6f1ce275c5d44917559b7abb54fdb2a96b37654d9d6dbc0503541b09be5c24ad7609cc98b2c8047d2079578f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bf1ec54e8d1101c128a9759f585b429

SHA1
cbdb938a54caa64240e2dba073ced1c93b2da1ac

SHA256
5a5ed481dbf66dd17997d427d5544cc2285916f59b602fdcf21abef00ca21b2d

SHA512
8dd677a7a4dc61c202ea33cbef42a0aa900c529f3376fbf6b323f91d3ba647f2da1142769fed5c742726c189b735ddeb938c7d6c7a244407a73462d00c92c9dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3811ba156fbc4442dd2aef308f226ab9

SHA1
4cb89c2d97c001b686ef81805f79aab9e0640295

SHA256
b2151042d139259359a9b1e55a04757dc8250a8de7bc421572853f723348a336

SHA512
e5decc9a37abdc87ccfcb7951fc5d136b116d304a2384badef918932358ce0c3effadddd5f4faf7d3112cb4786039354c84969136b2bc69f6c8e78b36b9a92b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6206ea43fb5dfef5e7d3758bc697fec2

SHA1
81439f710b5b7428650b234be0119cc319adb7cc

SHA256
539960dd60212460bbbcf10ed961c0730439a73a4851d12947909caa54807c99

SHA512
ed8b2a9bc35802069d7a2b2994ca966a979d13ff866bbc12d5acd98e578e608351e15cf9bb54f36e76f0297118abbebc4a3b026a8143e45f043c62054455ff24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adbeb0d3983f948c49f7d0a486fdcd0f

SHA1
7100a31785f9b35d10b54b7f28a9e2c4b607059f

SHA256
e6900cab620126999061a9ad1349c4552963d1e43ab9c60343f0e0fa89b47ff5

SHA512
2546d8c6dd68dd0a03b532d4433dfc7fe4cf5c64599dcd02afb10ce314f3d82032705afea9cc5e5228ea440541da3e4e1f831a4f13f486e2c1bf60b12c304b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1060f04455b81911e01d4fc856d01520

SHA1
71df8ae7d3298f9f2a450ce8a871c50da6e5af97

SHA256
5cc0f1f7b46e33c347fc7fb8caab7756777e5b60ff545176b8b36f0dea2bea0e

SHA512
7d5bfbd142fa876f926830c289b87669f23de48d7fe6c149784c708ff7102e4754d27052ac7def13ce1c413cc0438174e7a595d0d0d24b0a4421cc5ccef78d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b36e4fcd7839832243a831dc1051204

SHA1
eea71e66610880ae8b08ebae353ae1794be696e6

SHA256
11ed4ac1ebf1a9d317cbe2e39a92df740a70c54335d618e6babdc0c2e64e03eb

SHA512
19de8509436fb21e47b0f8d01941de2e08cc86b4408b651fcb6cdd01b2fd52ec38f6d74ca1be197b07dfd5740ed3b673163b8530639e63b7ff5a2f4b4ffa7946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a53d5c12a78d9fd6ac7006e7fa19abe7

SHA1
b1cdb5b01f31e6986c15f3e500f60c96c546a81d

SHA256
3044214968dd0fda912fae1f802a12cd0a2400da286c73280ecb91e00c687ab0

SHA512
5fe9ad914a22f1e7c3018157bb34a54383cfb2eb96db6703d79ab58b3442e399c87dc1bb4272905177011dbf4e326bbf99c7ac6c460b7889bc6cfc558cb63666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
341990858799e6eab8f3c925b7d503f8

SHA1
34de83a90d6eba7aece0761b545f2f3028d3ba8f

SHA256
d7affe5f55fad4ac75fbf8bbc4ca449e20a2b32caab46486c335e5d91377bec7

SHA512
f606d38e0bcceea0ad204b9bfd45a738e1a8b99a87f44024d1ac29377c1bb4e316aa89960ae816639e2b737afdac9f61b2a1255f72c5eb0dbd54c8ccbba577ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb1cc809a6eec3506488b9c2cb97774

SHA1
c501b91d2ad437e9cedc09a36ab577d88ed5962d

SHA256
815d38549574155c5c6f5369bb1571277f694e5ccf82f5b6377e73d4ddfe3063

SHA512
5446f3789e6972cb7e681674f412444a7dc20038ecb5addbb745c7ec260ecba1150048701562e91e3cc185684e7d0c6c10c4230ca323e7dfa7e3bec4e24dc5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4656c745488670ed4dbf0652aa04b17

SHA1
ba48be7a6263e0704b1d93463a1408776165ce56

SHA256
06fb9c8d41def68549678a43e7df19dbeab24c6c37ea863e58be7662eac6d32f

SHA512
3959cd800aebf6ca552a9d04d2f9b251998002224184fbd33acf33c758769f50ad6d98129f819f7a5cca06914d73e8f140f034c04029812e5cf726c94571a064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93240e692534e6ee56aed53e83a7b326

SHA1
26978df0e0076b7e72491774cead12c0ede4e1a2

SHA256
3e8c13d0650b07717eab7bc0b9d239ee2b66345bf125b7e3e3c3704b39f83fa3

SHA512
21394b07dc52500afa95b54e98b3fafe15e741e5607a635da0309b84e38969c9f1004c4d02390b7a10643673b40e05e0a56e884f247b2322090ca6f4350615ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38f9a73cea3d2e0d330cab57aa28a782

SHA1
e86772eebbb71f18fe89c54448b8b1ec376651cc

SHA256
64b37a14a578a59c2bee27099e4aee9d439945124b1b5536653ac7e8c59a9cb4

SHA512
200e2784288c2efee53cf8e532851ccdb88254623f0ef1bb682af3f20383385b421df98dd127136ef68b987b53f67fcf7548481deb1f2c534253801f01b0f48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3cd57f43bce0c1667aa2e2f7ee48440

SHA1
18eca65665d494eaf3591bc3b5f3525dc3c562f8

SHA256
5340a717dba00309e1194768108f22bfee6f9ebfa416c10fabbf32757829961a

SHA512
6ae1695faf72403e4904e8e1f5635ab564457d83125e7e1d9d34ddea3bcfd1aa3ea98649e435c1a5f2ed44756c47296c92ef9d25e8b2758b9c8f0b9739e65498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728f0754682bfa6fbc9b36d0d09c956c

SHA1
4f169eff2b7b6069c6ccec5164fa818f81bda568

SHA256
e82b9e09935ea7e413573b54a7ea1bf95acc8c450e3d248b23634a510663d7ed

SHA512
0d559a9bc9f549cd373c6f2af90054e1a0d5ee8c7ee6485dfbea1e98228379e637b0662568e0d96781cf6376c8ef7afa9d72ab09a174550eac801f40d200595e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab620F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65AE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit