58fb4f21566aba6dd6ce0eacb0c1f4a78b80dfb3b7a6f922ac84063e80d76083

Analysis

max time kernel
135s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 20:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FusionChartsFree/Code/ASP/Default.htm
Size

2KB
MD5

1c04d9dcbb8dd1d5b4f6a9a794e9385a
SHA1

2bc13532c1d830b4364d28a4e393f5cdb3c6b52e
SHA256

099d590395102038fe3b4ad78b92f630fe064e00daa921f4b84679d0892c8dae
SHA512

7f4ff5b0e4889fe9f15ea6eaf42db192d771eaa97c37c365184ac5707a66e2c952e9e9121807f66c9d54326d9eb4e5927e62a9792fc22636663637306b7267c2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60cdfd06f173da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32638301-DFE4-11EE-B20D-42D1C15895C4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000008852650514984893be50e3f7c57810057c2c79a195bea4d175fc48d7d24c7a14000000000e80000000020000200000001bdcbcc15a49eec8abfebdcda39714aa507df216c74d0a70a0ccbd85c6704c019000000065b1b6c4ef8ad46b51963f4cbc8bd6cb38d6f0332bfaec9c36079e962497cda193e62e00ed929a37a7fd061e25957f0fee92c6c9c2dc0603f4893cb8cddb3e9eddee7f78609fa9635baa6357c61c64d95d02b62de75f585dfea2bd15a2b09d014258af06cca9d5590ec5a8bb8ad7f3ad588bc85dcbac57a0afc011c8f018fb2326efd9804d43dbe69beaf814d1118e8c40000000dfff4820909aa3df8a347bff67fb281b22c0a2583f833a7d51eb21d961ecfeb93c1fd3795c417ceca32afcac03dd23563e9a0832d56668277cd64b71585ac808	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000c703c34066892c4a148c76fcb4515097df4bb93831ef201e7751fb97f135c005000000000e80000000020000200000004abecdafe26f4ac867ab1786ffa7577322cdcf4171ad052d40b99cb311629b9a200000005dd6d919102dd5ddea577d0d367f9b42698d2150f78ba39cdc0c03fd3ca4ae2440000000b23d0bed86f1a064c263d875fcaa25b5ed5c45c403235a3d48e57fd2ce533445da8bc94c9e7bd073236254d1e62a154852347bce783bcc81f2e77a34836696d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416350037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28
PID 2220 wrote to memory of 2488	2220	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FusionChartsFree\Code\ASP\Default.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35cb2a062f96d5c04684098b38f43a53

SHA1
82ceca52045b5384645530ad5a06cb595aeff9e5

SHA256
b0118a06ed7a4244f99316cb118b27ddc132a3b46e3ad874a11ed643242c349d

SHA512
408dc2dced6ac331c9f3eac186c47ec4c36dd56f1d837172277e46d94ebd253a818fa528e6d0ab9a4edf8fff53dfadff0324e6a115a78b88f0cd24e2a5660031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f275352fddbf73021ebf5a9ee37befa

SHA1
e650f60c704b8a62e97a4e23dd24b2255be408c2

SHA256
65247704325b6519e3f8a7f865b48d32b83aff3f2907c5c155912aac21f2bc7a

SHA512
1a843d2532ec647bafb549e10900d1a5e65b5a9a3c06b2f2ca747f1b196cb4905c59bcc4a912169fc7a39392dd2c3f09be8ce7437808333b749d4f31b3be7c6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e935ea2bd98630cde1347f736f8a450

SHA1
e4327aec09648bd587b324a740e0552cc0b89b5a

SHA256
c4ec587e042b209ced54a5333864e76f48525569573a43c62bfcb9ea264c64fc

SHA512
40fb041aba86481a4e5a66893743373899356b18a5ee31fd721969493b188532c0c712ca4d659a06b767db31a917c5bdd658cacbc7ee39e18a811c9df2befb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
082f67c1bf7158c80386de740ea93416

SHA1
05fd3fc5b88a55f5adb8f5b7c3d2a18b24540b54

SHA256
0d8e80bc0b22b3d031beebcf4a8b3f3e215318ac11911e050c9fcb3e865d4667

SHA512
d0fc8b9c1abf9e72b692167695cae63ee9f4734ece7064c18625d85502b6a9acbcce95308b7f4ceaf35eb397638dbb96f9815d59793150a4657dd2fe54c9be54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f326214ee6fbd5df1fc2479165cb82ad

SHA1
3f6a43ecced99d21f5ce936d3b12092980680805

SHA256
5a2d0beab2325486080df3e4c5085d33344a8bfaf775b5e8f3d286234a779f55

SHA512
a263ea7e8edd839225a6165866d26179d28b580b39003a07878f951aff16800b5c3051a42acc192f793e387cda51b4ba45306ce92fd234b5971e5608e7cfdf50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07c97673541ba68d5ef96f0af2d4050a

SHA1
25ed39872eab51b086828495cfd24095ecc3bd6a

SHA256
6ed866127c0762351d2876d90e09cb7cf4fa1c31442dfc1d8e14b3ab39ef2ed1

SHA512
4fc6eae93224a26172f3d9d7f4b044dadbf4e039c8d53824f07ca49c9d26433439fabd7c227cbcf0643428dabfaee4458488d6159f927cb3544953eb172bd3ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d13e45cd9df26998ee326b8c35102bb6

SHA1
bc9e3964e6f9d7822310b56f0c81d9fd10fcd181

SHA256
d6fa7953070d96093aeca90e3db72d0d8ae79651df3ffe193d28cdda1098a501

SHA512
1fc60fc87cae8b9c04e3cc3e3a75b65532f43deddf27339219e09c2a5df687a3215d31fd3fede1c6f72ad1c3889ddf3864a53a2fd128decc6081b34680e8a947

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
737ed2af38ea23cdda4d7d1d914e234e

SHA1
6ade56d9201f2037536c2744b676c65dd5e19632

SHA256
2c521ea3d306e39fca78c4a2d7aeced6eec105009b4dde143fa871aa119a35b2

SHA512
73c193e261262c36dec3a74bc7dab6ac393c38e488e5eeca94505727203fa749e09f8eefe7fc6cb99f3f8c59cfce7771410a79b30c1aa4b3685cb9da5a6b8dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce04132fe82993c158eb9eae557ea349

SHA1
7fea7cc86130f15b388ac6a5163c2532dcfbed93

SHA256
da73ec373288b2c38de1a36eb76d05619c2e3c8127e93fa249ee2f32efa21739

SHA512
ac13051160d5b69a92c03026b59faa3d6c9975a9834e762b6a663dc743cf8b7d6b9392c4e38b04c9a88384eab6701611fcdb3c6a430acd0c97a5ffbe212cbf0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aad4dccde025e0c1c8aa581e2b51d9ab

SHA1
2061905899bf5bb141dd889b71ae7714df5ce90e

SHA256
73ea741060e3cb652b9dd92b5413cb0e931ad91e40c861b03f02de0d9772679a

SHA512
123187fb65eb2dc357f402dc3ab1b7e1f953be796457825bc60a2d9762ce396dfd043814dc3bf47c7f8ecf43f599fb747326dc7f104f48e02f8fcc79ac3ffb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54c7d9387d436cca2d8644345355adb8

SHA1
9409c352b924d57687c126deff615fc9f2bf9a66

SHA256
421d36e9d1f9c20d9fac56162b70a5c07598190ca2dce3306a44ffe2a81988ad

SHA512
4b22d67e2fa3e21a1f7963a429b28e51156880feab05dbd1ed8b287d13911fa4590a995b8c299f4a55e698b43652001cec69325eb938bed71fa1c772852f7bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3be975c01e5f2bdccb45a60370d87f7

SHA1
49596d23185852d62895161d0843dcc9b63e05d6

SHA256
0cccb069fcc95f2eed556596ab3a3bb97228d9f16750b0a18a5cf0c76a980679

SHA512
408de2070b9a95d2e7b9ac6f7814af1e022fb4a28ea24b5f9ab717902051addc8ee12925db5eb6eefc085dcbde02d28bb6aa639987d4483b9924a976126fdf82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4cf7773de016a7a7b34d1560c6b03b

SHA1
6fafa808a8a2195dbea8bca461ea892a7306f9a2

SHA256
81a582133406d7e089a04d6525c3ea7fa21f678a6c09c6b73d0c421f2470b3e0

SHA512
dcaddfacb16712012e78bc75d3eed2b4e84aed9a55465b2ec480f5da4ebd57ddb8cd73045dc9c21fb2f88e8a9c2c063643eb5c25080e59bc0587e43c3e893885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76db9a0e2ae3c5f5d20dd5eb89e4c671

SHA1
f81b6684fbaf18abe7750227aea7a987119608bd

SHA256
11d9eef884338e5f03315235cf2a0ced84e87d1a97190888b942ded6383e9715

SHA512
2f7ecfc1904cc87ff1d91975ed61360464a5947de3586e8965fd697c393f404ba4a6155d754fe2a9172f1e64c80ee3c596005153e12400ea2510aafd99253084

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C96.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit