e197583514fa600f24a3b88cf6b24102c5c09dc39bad6ac9626bd55f23ff9def

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lua/http/dialogs/stream_window.html
Size

4KB
MD5

042337f0f4a68ce50bff9bb174f1f148
SHA1

dedb805ec6b0ddab566ad49ac44d75cd2fce676b
SHA256

b103c0d7778d1694fdcab3aa28de6ee80aa9a10288355d2f47ee9ecf8a2462e6
SHA512

f906f16eebf05378668ef3b472631af90178f469f3453727c95552091a0ef95d3c72c41bea6887bbbcd07b5781fe8d4244fc78e941b7a95abe0eb2287e12f14c
SSDEEP

96:I3cQXljXrc1tXrc7XrVkXrSwzZb0hLEOXrHTBXrKjXrr1TwXrXi9XKK0Z:WcY1XraXrSXrqXrJghL1XrHtXr8XrrNs

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416437428"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000bee2ed312da190204996001b26e99bbb79ac79feb2bfd7e26d828afe9f49f9d9000000000e8000000002000020000000b6bf0d034f7c09c534921031bf3dbbc0c5de34b9dba6c753cf2ee8c798a4cf67200000007b04de9c2a422859c266d8a20fa0a121fc6925e80652e52910594b0a720192cc4000000097e68e8f6df2802f8404e8888c6064cba82acd8d1e57a65b525aecaf1ec1c5de3ef57aea8e0d8685b1b1add443c0432f71ce9ce209214f36b307b927a4f64060	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000004c459cdb160fc91792f9aa5e94f38d5429c5b54f601c9976cb95f3c8bf7cd11000000000e8000000002000020000000ee320766c737349c1fb1e97e84f9e2dde532c6f47896ec6ae0a74cacb10e1d36900000005893fe574729c31a12445d4ed4ea69d9f9f0b2fab466110f0911e123b2094caf4abd026266db82710783fe0916011b590d5d388a2a3cc0f376addc4b90aacd74b9af37afcdf60b8dea3aeed1f7e793bc3a77a7812104cd9b0752884b43994addd9c526f20281734a741213910db035b826aaa7f520dbf86f88dc4470b176cafe428d509a2fee018c302597f48cd811854000000061f9258126ea74ac40320fb2500c30d1b25038435b2c1ea95091bf28d7cd2e7c37f8262acf0a7b2d12e3b6627e28a14d188babcecfbf7fb870403af40b9d911a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB0FDC11-E0AF-11EE-93E2-EEF45767FDFF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a5b47fbc74da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2008	iexplore.exe
2008	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2440	2008	iexplore.exe	28
PID 2008 wrote to memory of 2440	2008	iexplore.exe	28
PID 2008 wrote to memory of 2440	2008	iexplore.exe	28
PID 2008 wrote to memory of 2440	2008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\stream_window.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e510f1d332fc7a032e116a327831a337

SHA1
d84852aae92ae0f779135cc91d250190c1e87ce2

SHA256
48331de96fc4003ff2d0d5284a379fac275a5c7b87de3cf68abacc0b369f06a4

SHA512
3d052e4d627d669f754dcffdce14edd03f4f390528473b7ba6ce96e0fbe4bb2408ba58081eae7f29d851172b9e4097a0eed3f8673aecf866246ca7a22b07cd07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
275a0767c9fd083f16282c7806b4b7f4

SHA1
ac711a1785c09e021c91983183ed4a4a42b3889a

SHA256
e62ca9d1397ecde9be7e119867cb3108d6789952732c693833fcb1b0ae3ee1b5

SHA512
7268e2bdcf60e327d251b657cd94b43ec74d85cd14dfdd44f7d54bcb0dfc5d12dd17bde5b280960a30f9e646371940f97d07ae0f35c94f017a5f1cb1807bc24b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfc53150b490efd768217f23195fe641

SHA1
0bec7d767e3b5bce3e43a87b18598401ca612cca

SHA256
4a0e00cd7fe4980654fcb02351bee1e7922c63260f3021be72e5d92e79b9ad44

SHA512
50c8eb786434b452cf6537ee3d9ea27a67315d49122d549f5def5486c8e631bcdc35dc66fd722b954166f8eec6a31bb365d9df2da14fa30df02b8a1b1fd71a3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c9b184131d35c13d040fca9f99fe53

SHA1
e69557a64e73ed1fdafe70485d45f6dec871465a

SHA256
1568a28b3ca97ae77967e87b8f978d57db8ee6ad519425e5ebdae59edfaf5c57

SHA512
e9552af56b7568973fef329ec85d2b4ef6c0681872b5595093362b1d106f7c8540d91b3a3232622641738f90615eacf196621134472ee5aa57b9227565cbdf26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bae3639c2b26cebbea1f1594b7815b38

SHA1
316b59797a38b5e24ac765402d931c8a0a3fa28e

SHA256
61e837cd9b1d3db10d78a5074a3f1cccea8108bf344dd190ab432366b22610ce

SHA512
a582f7391c31086e952915e980c0ac67b912ee4f73dfe69cc1e455660cf4069bce386f8d409db08dcf9f55dd8aed8e0f39d9fff64dc7b7a2eb7019ceeb385a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b1bf2350b53549cef7dcbb58670cb1c

SHA1
a89ccfa603c696114fa55ca17d465f9a66957cb5

SHA256
3aad54f79261785d6b6390be39ce59461f03cfb807147d1681abf8a4721052a2

SHA512
6d343b6183bcb97da78175aec804e53cef3f711342360a9a66e09c4626eadb76ea4c4ff435d1fdb7b691fae24d18d99b18f480f32030642926cbb852d9356563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f955bd114d3f363c7cd6a677a20a31d9

SHA1
513a5a99807340b47120b4881c35d702a8567e33

SHA256
06cbe23877751ce867a86f7df5dc8865965ade615c80471693e57e49d7b69677

SHA512
3a36170f8cd16e90f1d866d688f25fee52ad3f874ba980010bf52daabda653a04946ebe797b984b1bf28c91ffebc502acaef4f31ead3029729838b7923fb3a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b262fd3085ac27b24e7f40d0ae0520f

SHA1
ddc0e687768e47cbed32620bc82e3c6199eb0622

SHA256
1396de39f63aa1d71ba8c44b312f18230b00e0d4d0abf056bf87af7e3db76d83

SHA512
85e1fc3c9ea077c49889e62d008904221d2f22aa6b0834c4b4c93297b1e9c4ab15e98c1fed8b2d393c935d852cdb4697b6b7b496501cfeeb08cc1537a9742f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce94ecce4628ae358d9995d50b672de7

SHA1
89514d5207e479771148c4817227096596541060

SHA256
bb34d106302d9bb6410d3433c26b2449140f40cc96c80aeb3d7909c075c0c4de

SHA512
5399f4c59e5670e778b926dfd67609f9438b073d2b96a797b1a6e37e11750406199dea4b26f6978d0f450e20019914b29375f0f88a15d0a81e5a58f6b9dd2faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05b7b8ebd16c57b899cc16fc70d57608

SHA1
8d6505a2926182b151f8fdd176152555e81fdaf4

SHA256
9c73746e2f7195537a031a1d0bb1b0803d1ef9dbf819767eacbc71d60dc4d7d6

SHA512
134f1968c05a53e4026e7902162f336f29435f9f4b3a409f6d9d2548d5b11b93f748ea8596bdff74a289757defd2abe24cbe8556b1db59186f300d747d76f0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e308646673cc3bd6b5e1001f6671bd37

SHA1
d33c9f51299b1bc7f32096f9960f2f3f9d71617c

SHA256
f03441faa1f07b83c65e9f32282ce3ea52086d8f82c6d4998cfeadf9e79de336

SHA512
b9f029c0f7f8817dc49cf07646a5c9a7a524539a0f608b7a3305e8a1ff72e05e6b521c07366dbf4b6d5a8be017b0a14b234e6aa39ae3d6d66cb49c50f853fc53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db130ac2bc79ca005c64e535489506b5

SHA1
a1fe25b188b558268b328ef8e8d24b426afcbbd8

SHA256
9a22f24d53c14405a3b0cfb5679efc34b64202e60b274ec532bb94ce1e048d94

SHA512
adcd5c1178dd9d321fc89b5ca80efd60e909588bb83ca804981425b47f5719c6ad152d211d09be0b5c0068fc43ae970025e93c1177ad952e99e687a71dc4c9c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b6c9ec36888b5e9241607611a7bdb4b

SHA1
638103149aacf99fd3c692a2ff2f82dd2b3ef4ff

SHA256
7e06aae1a23c7e17f503a13473c56301d4c1f51045156a50cc591215757a6b24

SHA512
c0dc1efb8ce835b5810260ccab412a3fa2fe0d2370797e96e366f0f15a3d461233bf9ea5ce9301e5d2cd2bd8373055261dde9ba5b088916e51f4247fbe35c04e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
050b633067382eedd1160dd4a3706eb1

SHA1
2af12193ce1fc8e0670758b8591a777dd78559d6

SHA256
80187b5f8a2dcec6417c7cd279b4e6724ab710aab657280a022bb6f78901a3a4

SHA512
57d28f46bc0eef9d8417bbcfbd92d373f6f89948bc8748657e3d27e6ddcabfedbc89f5207c008c8ef00dfcd217a759dd056d995a3f59511efa6a305004ad1cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6217.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit