1f657f21b616c170332b569e114990d6a22036fc527bef3309c519c8eca64e47

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_96e6cb63d4fc7c627a64520042939c2a.dll
Size

256KB
MD5

96e6cb63d4fc7c627a64520042939c2a
SHA1

6b89cd07fbb07cb32472abae8a4ae42db99d18c1
SHA256

1f657f21b616c170332b569e114990d6a22036fc527bef3309c519c8eca64e47
SHA512

2cdca50bf1dc37530172b6455f13ca47c3559294f5731bed3361537dab77ca196e3655253e805b42db7f87a24e3e2e79d6c40dbb55ce81242828b1051dff7392
SSDEEP

6144:qoG2bGk9jZR3ovtbJTDYaZTj+bgKhUMdQ9:qAxz3IFJTDYcByUM

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs

Modify Registry

T1112

Processes:

notepad.exerundll32.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	rundll32.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

rundll32.exenotepad.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	notepad.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exeiexplore.exenotepad.exeIEXPLORE.EXErundll32.exenotepad.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8EB5E91-C374-11EE-919D-C273E1627A77} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000dd828bab8889f56fb97d52ace5c2976bf58f829337a7e36ae00d90946146e6f6000000000e8000000002000020000000755bd7a2621f380cde6e2ed2540e1cc1c17c1be006a2fdf7beb8076adb15d5b0900000008c5db4bfc59c19c41860991e5ee3596ec383455f2a0314a5d50e6222a717aab4ce773f5d7c02c2e73fa04d5b1bc7895570e70406ba453c4118399eef8728c38e5deece4bb2302c286778348e304ac3079d2917a571d01ece83ff4232758e74e95e0e36dc444c469a97663de27d750cbf48ce3306b9758e0c1de82362ed314994a8e247d8c96dc591d172d4970fde16e04000000045e4d651df006fda534c477b0dcc84be5192455181cec52050b15c9a3a0fa12535287d80cc6a7e55157328f38133a897f5a2219b5b5dff45381098a2444896b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00dfbbf8157da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413223606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001a4b8d149700ef6ace4151d415df184c8728c4a11fe5c2ad331dd6c2051a4631000000000e800000000200002000000077eab103536aeaa731574c9c364e0500ad26014da07874db71aa7750cb8e107720000000df97883689fd99323257170a476c9661c8969609ba8b90e48a6c45687d5e1f7740000000c85cefe2d5f47a7c9dbbb1065f106037948cbcaac6d7faa62981e2ecaf9bd9603d43c671a36768a253e0bb7b9dc317a0678f76cc5bb7f5f7fe2a3ec684692f96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	notepad.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exenotepad.exenotepad.exe

pid	process
1936	rundll32.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
2960	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
1936	rundll32.exe
1936	rundll32.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe
3048	notepad.exe

Suspicious use of FindShellTrayWindow 13 IoCs

Processes:

iexplore.exectfmon.exe

pid	process
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2656	iexplore.exe
2276	ctfmon.exe
2276	ctfmon.exe
2276	ctfmon.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2656 iexplore.exe
2656 iexplore.exe
2688 IEXPLORE.EXE
2688 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

rundll32.exerundll32.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1404 wrote to memory of 1936	1404	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 2064	1936	rundll32.exe	explorer.exe
PID 1936 wrote to memory of 2064	1936	rundll32.exe	explorer.exe
PID 1936 wrote to memory of 2064	1936	rundll32.exe	explorer.exe
PID 1936 wrote to memory of 2064	1936	rundll32.exe	explorer.exe
PID 1936 wrote to memory of 3048	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 3048	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 3048	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 3048	1936	rundll32.exe	notepad.exe
PID 2176 wrote to memory of 2276	2176	explorer.exe	ctfmon.exe
PID 2176 wrote to memory of 2276	2176	explorer.exe	ctfmon.exe
PID 2176 wrote to memory of 2276	2176	explorer.exe	ctfmon.exe
PID 1936 wrote to memory of 3048	1936	rundll32.exe	notepad.exe
PID 2656 wrote to memory of 2688	2656	iexplore.exe	IEXPLORE.EXE
PID 2656 wrote to memory of 2688	2656	iexplore.exe	IEXPLORE.EXE
PID 2656 wrote to memory of 2688	2656	iexplore.exe	IEXPLORE.EXE
PID 2656 wrote to memory of 2688	2656	iexplore.exe	IEXPLORE.EXE
PID 1936 wrote to memory of 2960	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 2960	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 2960	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 2960	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 2960	1936	rundll32.exe	notepad.exe
PID 1936 wrote to memory of 2656	1936	rundll32.exe	iexplore.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_96e6cb63d4fc7c627a64520042939c2a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_96e6cb63d4fc7c627a64520042939c2a.dll,#1
2⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2064

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:3048

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\ctfmon.exe
ctfmon.exe
2⤵
- Suspicious use of FindShellTrayWindow
PID:2276

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
b1b09505e8c66ebc7a067e1072e58291

SHA1
975eb973c7c34dff8cc6b20b0e0d3701af87d1d7

SHA256
6a780cf1958df172ea24ef2f1ec2db7cdb254af7a229feead3d4f925936d61e2

SHA512
ebe1aeb85273aab35fee11caf7c1fb35392294f7244695dbb107d8ce20f01e59d6199ede09a32ed0432e9ee4f448f2837d9bddb8472b11085d0c3a65ce9f800f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0f825c0b1a939d14aa285643c8a57ade

SHA1
0be05fca456833ac9490d12d85c7edcc8d8b9398

SHA256
76fe429669be0d7a358d6aa2ec8e71c41cb75e40cb9273255bfaa2a2368fce4c

SHA512
a0856de3bc46ee2cd3d75daa11978f7791fc8ce89e037d811d7bd8a9d481c19726d22636d8dd74a20b22303f9e1bf3402c9f1eb54efadcecfca4f6850f89a410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e55262dc5dc27b8facea2d4ff2a35600

SHA1
4a667aab888eae51da3ef6d37e1fcc8c10e55781

SHA256
0ecb4705d094c2aae741e9cac625e39ca770ffe9d01f29ce187376b6f81d61e6

SHA512
4626db5a471f0f9dffe90e2b218e2ae2da9b060dd54eda6b22df6d2d7367c03e07be8b2db16fb641edf83b396814db6d989605b7e6027b40bb6e4843008d9bfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
24035480e248072841c7820ec54b813a

SHA1
d489cc114a318550af86f91cb7a9c907fcd779ae

SHA256
c5d2264d8768a63bfd9c107ea0cfe4e4c751813cf2cf85a3328da969255c583e

SHA512
6de09b94028fe40e46a11a8094d2953285a2c4fece14137f7779a8e5f37cac10758067764640f8894b771b9d20952f19979dd82603b7c2339e02840eae3a2168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e454609ac4da5e8b74f19426b9f874f5

SHA1
afa0eadb888113a54f8e2c5680efc095ea5a4f71

SHA256
cf2277ce5ef439e6516b0fb9ccc241af091a185a2b6e3b9b4feb7944d9fca918

SHA512
6a0f77cfadf36311227d0eecd8701f8e22595e78764c0790d35af482b844debe1e80b90aee34bd77975acb08992153dc25b3bf5989af9a4581712ca87aedaf19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6ec400d5225101d82494245502ef05c1

SHA1
0e2c435920402d9a13a498f70f6fe3e1cb706d1f

SHA256
ea6e6e4ecb05dcb66cfabe559158e92612b0d7bd6771ed914230fa019d1cef45

SHA512
b545a6288586bcdb7b47e3172581bff3d126b81a21d2c77caa5749f1da7b4c0c8f4afb21952aff823a98cec44aca8e5646edec2727b6813743a6e51c17646531

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2448f3a466f566961f5d20e41e4d1004

SHA1
dab621eda3b2d970a9d19bb7c00e9156af07d574

SHA256
2706fab2ebe30706ffc9429df505fb82d38ac171b055ff29349d39463db8fbfc

SHA512
be9301b8f9cfc4ccc13e6d7739c446f50d8acc3b3fb1bd5bbcae816b75d8424cc0297a5e63293ac118aa6899233a2d2568b875c4fcfa4dfd628323cd21e60240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a276c0746561b0ddb055508855f6931d

SHA1
d1ea6240c535b54f1a452105fc1949ed4ba10055

SHA256
8d70b2de3f006e881752c5b148cd7c8588d19e35822ce940ed3b386877d661b4

SHA512
2418e66d03ae753228371f7b422116cff453e5ee698c4bf48c7d177422364939f26f28798f1a81695a713a86760d63bfb9e0a9b27554730b01a97198f750d9d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac482cea2450bc5fa42a2737df7c0c0b

SHA1
e0e4c69f10a0499fd1d10dc3c9ef5635e01fdbcc

SHA256
6e190ec800b55336f3ffea0343c4b74dacf59d83e3b78b5c751305c4c1d8d944

SHA512
3a0266923871cbfb2ba3579c34f1a6d3f54b56433ad6ef3e3c300834fd42d2da9ea35dd3228365002d126d970fc7f5f5c083d6684770fed4a0d96bf4004d3a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c067867811befc12630faa162b115beb

SHA1
f0ad69f266ca29f21d68ae1f5482043672e908ef

SHA256
e11bad48fd13d734aa511801f95a3a8a1fa454c48e601caad64e6a861b2654b4

SHA512
4d82a9f3528c3b11fb86df16333ac09a34939630462322fbf8a472bba794a79cc98539035e17feb82995c64eac199ebb3c05e49b398721c95af247744c5b68b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e1bbfc20af049d22a5d1c4aa502c9e2c

SHA1
e401e5fa912d337c322d0c2fe567d78603cb587f

SHA256
478871828f1a0169b00cf89815d7cf1bdae4359a58d01c58cd3152e992395d77

SHA512
52fcff5ebf9c4b59d6b9e5efd76a0b3ec7a636038a03f71f24d83469ef9415b053e1903e4c5dee49415d8237889eacaeca8bffda66061e6eb194d1ffcc1ed700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0642e42cd1232d103ed1e83d0b1dfc50

SHA1
d9780244c39578b1645b253d15556b19679659aa

SHA256
25967165270156ab9e585ec1ae39150c7b362fde49bfd7da7fac503ef4c511d3

SHA512
d59ed05854c442e331a098933fbb1f7cc3e5c4a8675c40ddaf92615b4c8de04c7b04856f7f96fca69eb92c85029520522205b7a2488449a8c5f62b5c1db4e099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
03cb4773a309cebe83fab44872c3bdd0

SHA1
82544cf0818b17c340e87ed7bbf8befe704ff9e5

SHA256
b94599fa81f60deae76625f2e06db207f7c1f51f80fd967325138797219aa545

SHA512
c2f09e462b9f90a3b9c1f89fe5fb5b37580c242e7b558ad2081bcd1c7621934d20de88872353787a098cde52efe6777fe1a7a6c8508b381c1f1da4df8d1e8417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ef58953cac353e75b20e59a97ae882c4

SHA1
16a680f10d55b9af0755f5a2c9f0dc6eaf535366

SHA256
5e30a81e6e279ea6c54c57dbe251d7e8ba516249d4bbdec307869fee12a71ad9

SHA512
8f4ecf6c333ebfbb1e19d9fd4fe241c10a9c33052911181ba45a4cd2e641e78c412156f438c193ada931ed914d594bf620777ab0c8993608afaec632537af766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ff4f863be97cdd26a4444123495b834f

SHA1
730fca540b9a06ba845d8b4fe6a666e7cb36147b

SHA256
bf1c2a1f7347a53d69acff33e6b4f1171e9072be67aeedcace5c9051a67d53cd

SHA512
2aea9d7c1cbe8dcdb7d3a34915fc339c8ae6de7b9fb0ec51af32fb58c6a4589fe1944492379b2d51a5ba78eddb742c50fddef149f12a0ecbb8c5c8920c43412d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cecb1384be8df43208acf70ab42a808d

SHA1
1b44a95cd395e0600739234eb39013491380c831

SHA256
cd9212b833ecd5cc0de85647f6ce5b3ba2d150e8567181e6cac49c33c9e8dbf1

SHA512
4722fdd369839e0a8c3b951a9f98f5e23a2c24c57087c5502457b35c35175b421511df2715a2b95b3f956ed01d05f4d2320ffb078c7f77c6340b804092486b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
345d475724a3ed64c5a6aa6d7ea1671a

SHA1
3025adb81389bb197240123161adec2582ba092a

SHA256
c6f6a6be3a49844f0c752e72055c0e9d925f04bfc24b825d3ad4d4e37fdadbee

SHA512
9b94b2a244685de405e9eb9957eb029c9c797c54948e997b5d740ebea5d3b163a0f90380ad7ccda2df290d8b60223a7cb93306e70258fdc62e8564af314b302e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
32889b7daab283de8fedd4d84ab63e70

SHA1
9e51ec30036294ead2e1554d84e94da945e4c3b5

SHA256
2874d084db9bce5276a2a3c5f78987499a8941bd4569b01b4f6940fcd26caf7f

SHA512
587b20fc9a2ec61debbec796910e2c0077b4d7d97310e5196e08dd926b16ca76aebcd9122925b1347f24f112d0af0993f11493302d2d99e60ddef740a82a1c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fb5e7bf950bddc5ddd2126b0dcfb9569

SHA1
c26d093264d108b02bfce531df092eee630fd864

SHA256
4c948ac27e1bc5b95f2a6f104889eb4481750c48de3ab53da6a46371e224774a

SHA512
e6fb094328ef368cd2e254cd406700bc40deca0350798e6e0ba030786f544d39bca4db089228537ec73aded5d91d14a37a444a8910d1f485b586642f2c6d0307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
83e6ac1ccea4f180c6202e7bf9626b51

SHA1
4d65994f50b8aeb35b75a22a85813fe4dccf59b6

SHA256
896532e5cf9f366845c53fa7a5c0e74a43c855361ce481bc6a4816bc9337c54f

SHA512
9e84912f1e6556f229be2fdacabcf6475d3afdbc41dad84b4f11c8eddfc19987f2ef225898acb4e094df5497bca4a79dd7a170e0f40534eadeba3d53a9de89d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4819.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A60.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1936-4-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/1936-6-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/1936-2-0x0000000000770000-0x00000000007B3000-memory.dmp

Filesize
268KB

Download
memory/1936-30-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/1936-1-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/1936-0-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1936-8-0x00000000007C0000-0x00000000007F0000-memory.dmp

Filesize
192KB

Download
memory/2176-10-0x0000000003E00000-0x0000000003E01000-memory.dmp

Filesize
4KB

Download
memory/2176-607-0x0000000003E00000-0x0000000003E01000-memory.dmp

Filesize
4KB

Download
memory/2176-11-0x0000000003E10000-0x0000000003E20000-memory.dmp

Filesize
64KB

Download
memory/2960-25-0x0000000002B10000-0x0000000002B40000-memory.dmp

Filesize
192KB

Download
memory/2960-609-0x0000000002B10000-0x0000000002B40000-memory.dmp

Filesize
192KB

Download
memory/2960-23-0x0000000000220000-0x0000000000250000-memory.dmp

Filesize
192KB

Download
memory/2960-24-0x0000000000600000-0x0000000000643000-memory.dmp

Filesize
268KB

Download
memory/3048-14-0x00000000003E0000-0x0000000000423000-memory.dmp

Filesize
268KB

Download
memory/3048-13-0x00000000003B0000-0x00000000003E0000-memory.dmp

Filesize
192KB

Download
memory/3048-12-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/3048-608-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3048-15-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3048-16-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3048-17-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3048-18-0x0000000000210000-0x0000000000212000-memory.dmp

Filesize
8KB

Download
memory/3048-19-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download
memory/3048-20-0x00000000004A0000-0x00000000004D0000-memory.dmp

Filesize
192KB

Download