e197583514fa600f24a3b88cf6b24102c5c09dc39bad6ac9626bd55f23ff9def

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lua/http/dialogs/stream_config_window.html
Size

1KB
MD5

2ff24c036592efe309359ec7ee613d86
SHA1

44cdd2f1d54c36772d6daad1657802c7ea7d6a58
SHA256

1ef2a9fc7005712cd18effe0c6d644f6e1badce728c4bbbcdd675cd67d4fb9f7
SHA512

bad05f89a5d52b3f7b92f4340f13398a8cca0512b06bff2cdac8e3db6bc1ad824c9d3440d0a9397d78c8321d6807591e5bfa6f883ec04854f8f41fd8cdd72d83

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000d747938a61f24f61d6115e70ba892b7aa55fed12d9d5a26bf3512d9984263215000000000e80000000020000200000009585695f2461b424d3aa60bb04e071ab15dc36a7aca0f4344febc24c507a1b7320000000bca1c22f979eb062d791a7ad5c013deece25416d4ec06cd1e275da1cb0fdb7e440000000c77ef8b42acc7df0cad8d8f50bd82a9d01b37d42f0105810d204e5397949e65a42a5d9da6b5001d7b1350462430250633ada4c43522b2ba0f1aa40e494e23d9b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008bf8326d430794a2084f8792e15282f9e2ec7d32818d23003c8e3a9ff5a8b5f8000000000e8000000002000020000000326a61ac9a8dc43f5c720b094e558782a31b8b115994649d3df608486fa8b3ff900000004297ccf8a56ae1f613b7be462d0b4a2551cf5a3496052efe161b1f3b2a9feb30653b9e83996ad881166365c931bedbb56604af9fa4fb7f7202dc2847f12931998ff548ece1b15b1e76bd7300668db3c2121549503d65bd4787cfe837b51981db25b97acce65ef7d66dbddafd4966b82f0c82160bb9af8d0998fa0347e3b94dd0bd7b4c4115c8f6bec5aeebe2104d4a1140000000a9798118f95a77373d47bddf30ef7ddfba4572e07958254b208ef9e3abdd3c3fafec1a42cc325403b839a8e764baf0199a557079d5db29ab85d1f8978c9bfec5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416437443"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1ECE0F1-E0AF-11EE-B35F-5267BFD3BAD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0185d87bc74da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2940	2272	iexplore.exe	30
PID 2272 wrote to memory of 2940	2272	iexplore.exe	30
PID 2272 wrote to memory of 2940	2272	iexplore.exe	30
PID 2272 wrote to memory of 2940	2272	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\stream_config_window.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efdaaff4debb3d57528be20429b7debf

SHA1
23cfd0efc49638b7efec32f5d44c012bdf2d1cc1

SHA256
6f2513126bdd66b5b0a2a0ca47157a2a9c3dd3526fe273254055655e10cd9c8f

SHA512
56b5e2e5aeff4db91427d9596f234ddd156f431dd1d9a87696f49be6144734aae21c7c09e6bcf7333a73156406255567b5c311916c5d34fe10e311b96cf7f0c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c63e9e4b971db4909484dfdb31ee812

SHA1
e4e45d28448eb553a666c7a64c5da616ef9662bb

SHA256
4fbd6415c5418cecfaaa5888dec84e9bd5c0816080f90b47be1ab7c767d86582

SHA512
0609a37e208dddb49934c0292d30f1ee7e2e44f75cc95218df2bdadc1dce1c3dbeebea1974729ed186198b416028653d9b05b4fc9716c0827aa2a17144858190

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c6664bf657e11a955e621f644349a39

SHA1
0160c5cf5a20c506b11141a8973fa8f9a208468f

SHA256
295277e7f55a1be573c42fc0eb6dcb8cb52e4af527a64ee542bdbbd8da67a1c7

SHA512
9e35cb4ad6dc748c4920150b38f9c150efb058272f6312607bdf8bb3315a8d7e430dc4ba795c9abe6892c05bc69b07e251a63ca8e4a5bf37b96ef87500327f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f90383f19b0f78e57e102a29f817601

SHA1
6bd4e6f0b6e2eca68ef46eabd2ca7cf63ea26416

SHA256
a0560b3591836bb6a4dd047924601cc9af8c793bf981ca71fbc28b41e05b3409

SHA512
fd217d0b153420d7c83af721d70f6ffee71466d3b916db141aa5f0bbea537a0cc78974247ac3242cdbfcfa716c69e795c223845587b055802089fe0975627b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65e36ea865e4944be69eff35ec003df3

SHA1
74992fdb64bbdae7a9342b1a64c2f503889f73a3

SHA256
b9ea81ebc747883504aceb53317231165cde68df8ad3092e033f9204ed1661ae

SHA512
f163750499d83f2cf65d991dd9e2ebb09d08cb106b51bc83e4eb90f9190c787f3609e13645c4efa4826454d0edc84e32c1e6e95b7c0f10eaa3509e3f57b278be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da32a1572279cab91a4dc92f1c516cbc

SHA1
74a83e33f91f7b0f63efef08f525a4ef012d3c80

SHA256
07a955c26844430f0267113735c28af27913a1e8f73702dbe41626d4f132e6b2

SHA512
cd2e746547e28dd6fb5c13d2088257a87157914a222c34fc3df298ddac7e1621956ad1be1d39d0ac632022704528cb620e38de2ba8b33ca907607f4b1c97def3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5a59fe49ee98657cdc1645660bb4d29

SHA1
6d4cf8c84f4b172d8583ed593dbe22721f3aeec3

SHA256
f45562823a51eac48522549f209ee2f909cd68e3fb1786d9946917be781a210b

SHA512
6a31580e2f7f357b2c5c64a3a74482d4905eebca7987ff5de659866582034539e2e04b91f2762f99f72f2c3defcf0771a819f0d5b5bbd126dabaa747961ea1fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf22373c72555480e9b60dacdfac01f0

SHA1
f04b03d52f13996482664a59b517dc479bbd3669

SHA256
2dd50a7cb752d3f68ebbd0a58c4276eadcc7f9d5495401ff1d367065cc6e492b

SHA512
e311469efc358d7d5d3b76176ceaf2617797537233c7952b7701cdc5e66d1c84b85d44fe58e51f12888f8d55296d7c26df03fd4ad724b74ba8e06252bc7ebd38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b457a23af9c5d268bc930a153e5a5e7

SHA1
0e2d591abb873bd4d5e7dc8d9038ed186c9b0050

SHA256
93046daebc8c3d3b8e7dcd8bed2c4aba205784d053fdbe83c1539adf9f65f146

SHA512
2d40a24ec70b5bcc3307d3b45f1c262c8f6cc34098d27fd26b007609d90bc3b8776125073ab927b0baee9b1b6f864e030c6a97c86bbca6fadc8ff1793ee33dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23913514fc18aabe74294d01a0be44c

SHA1
4412f1ce765aa7b47c899112f06dac13af5c3f70

SHA256
23b3ed7fd7eb9722d70966614477fda8fb7c4d907aa15f8f84ac95808b2494d8

SHA512
f8e390e3cb392b93cd0e1da889c75906c12e1a7b1f7d221921d0ad062ab5ef07d8bb04cb9410c5033f208753c632fbd0d6041011f4a452abe594beace0dd79c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab362F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C7E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit