8b3e30c212d0dffd912973eec02f4d96aeb98548ab1f1d575fef8495b06b11b2

Analysis

max time kernel
152s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sms/ContactSelect/.svn/text-base/Index.php.html
Size

940B
MD5

81b67244a36413d6ace99ca443f59530
SHA1

179b25a4ef52cf1a7be31eb9f4bfb41e479c54f1
SHA256

9407d9a12cd452ba7096afde42c3e227d77fbcd38a9329ee4a2df26026bfac23
SHA512

22acfb0ff5c87fec15d0bca34633f04d13a9ced2993ba72ff4c6ca7ddeba30927555a30be824744937740fc6ee5ee9ee35e266910ef13a873bb0dddd92a10ce6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d02d756580da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000001d1787442fd12107aa4f068b9acad783948da3adb283be7c42077b4793989cc6000000000e80000000020000200000005656db5ef92b7b441e1f3196236da1b73bf3017b828a56589446519767283603900000000ae360fb74ce24b9c8279d6e95988716e6ce674a72d2b935cbcede6a5f8240db9b2623659d45b1818ab9a39054669227632ecceebc420b144398485b1330777e70cc76f45a90e0d9a36eb211e348d8786b582124f987a58fb6c749bcfa3a01e2530dde9b9020c1e51577e78d22280c762af2cfbef9dc36e1b8ffc3b90ea09e6b4fe8f055714c87d37e96ff89c81a8b0940000000dd6576bc3e65cfa50f0f046b04c519ed3b864f81640ce7eb2ddf134764cad520d001c12465c7b01152127a38f35b76795f94d6fccfba3d760c02c44fca4883b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417719468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FA91E91-EC58-11EE-9201-6EAD7206CC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005df00f4f457f6c7007cb5f771a307d46b479404bffd77df0cec7ddc0341f46ab000000000e800000000200002000000055ecf2501b5daf5f94f75078e41c07ee0a0c06d9568fb2ac47af42a42f68dd4e2000000017987f830c153c61b9feb34e89c9345a99fc7a18caa0bdb5d0f15b8ae3cf2e884000000034aefeac46803dcda58e9feb6f0e46062d202c1c4141a17dc4cc8638efc5675931127216f047ad474fdc3223254bde14a224f41333e3b9eaa56cb592de822b82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1540	iexplore.exe
1540	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2940	1540	iexplore.exe	28
PID 1540 wrote to memory of 2940	1540	iexplore.exe	28
PID 1540 wrote to memory of 2940	1540	iexplore.exe	28
PID 1540 wrote to memory of 2940	1540	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sms\ContactSelect\.svn\text-base\Index.php.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20fe34a3a4ad2891835429e4df341ff9

SHA1
8ffbc934160e8523d070055919a5843b9d213f12

SHA256
878f91be0e7e3098020f50c3aae00b3a9840cde423f2f45715f46a4acdd36eba

SHA512
23a838e0f5091e35cb85a8c60cadef14bca286924002b74d963fbc4bc5bedf7f202f654067cb992542f4a848c29c65e98d12e0525574a2c3a6643baa4504c755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b605d50312cae1559983eb5bc44b6aad

SHA1
17304017ee13d47861bdcaf8372d64aef41d4195

SHA256
5b3322f7f68f8adce488d9f3502896ecb476d5e958bbf2e3567003c88e12da70

SHA512
e7cb17caee3f85d699dfae418eabb227e575469bee90c39c47d07cdeadea3521a3b48f702d191c332fdfa15d2b820f65f1e82b39be3d6501a6ab6d6f11e55c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c8997d65e4e63adc7eb190609e8197f

SHA1
52e107bfe1ee857c23e1fcb9294648fed25563c3

SHA256
8f0c5f78f4303a022a26bade2b6284bb94d01539aa376bd9a6a7240eeca4d687

SHA512
1905f8eb2e6dec662b46af084d6c7e5555537660dc1b4d4a2e382c711c71d046ce64b560fe5c5857bec7cde66c15b059484e6767eb609aa0ae84344f9dfa81d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
011b8b37aa631915b9ef1a3d7a1cacb5

SHA1
49aec0bb140ad39ec1a09a9391ec5bd7593ec973

SHA256
84d17d670baa4902652af846a21b31b17ab0aaf54a64a0e2ae0f46677d8b7922

SHA512
97af764beb0de029eb2465afdcc62df9bad427e5a8148a8640996f2cfc5afc316a6335a6abe67292cdfe0b6162b03c8ecafe07320aa5bd003be500151eb6ba8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
047a8ea43f939ebaa2b398fa4670590e

SHA1
51dfdc7f3d8fa74ee789170e73b6ec35a3183ec4

SHA256
5bcd9a43d020e89be8784f9f0c62d5f325e338372ff885503de74317876d50e0

SHA512
0e3bcb053a9d03926f2f0dace2fcfdc84e708c7bce771d0b2d7af13b66cd9d750a526d4c920bb20a9f8bea86069718b96c443e42e976a4d498ce9229ab6d69b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b015af9649339c443a4adc44a2094d5a

SHA1
7cc14bfd41360b302f554b9a96a252a134791e2e

SHA256
57654d5b065f7c489716a99e080473a988ce86dd1c80a0dedbc068b8e3156c08

SHA512
828d8ff7e819b6b6f40142134b72f42956fb079d44734dd0f77151c83c17fd5e9120b307d972107a0d90e7322ac9fd98eee63d428727dc2e7d389b182d46c077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b7180e265f640ff441784038b8e35d9

SHA1
ee671c65ef5b72b6e5be56c72fb495961c33fc67

SHA256
ea92dbabd3ef9851956f1360df611cd26de6accf573cc60794e312e861a6eeda

SHA512
caf0a017e7f56df648a09729ea02bf789596060bc917dfc4809a24d3bae8468262bc42b6381b6869812f678a2f04495d26a1e8b235f1818c4d27dd65a6e63c4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ac5a9292a1bda90bc9e8668e73f4c23

SHA1
5e51ab5c93e4543cd8cbcc6bc9ed22a623088435

SHA256
fa7a6098abdfe7d0d1b13e1a57181977e6331a447c3a79ab5dbb6dd10dd07eff

SHA512
8cd9955ce111d7c32310fa390c2650ec53f40c9eb1f0a39338826a3555b9f6d5c3dfe260287e5c8ceb1741a1faf4b5b1eea77d26a32aa43e74dd528483591d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e31432c690c62bbdac13a418166f1d40

SHA1
112bfefd72da9cfb9e8b529c5d14126f9df80367

SHA256
8e918b8c08ce4c06d9f3a62b784aa886883c6345f5b13526f6414fc163eb1604

SHA512
1423bde0d6a93e39d25cd1bbf49daa4e352d5e3f7b23cf776414f13950bbf330233ac9d22f77f3e0c5478e94ecb4eba4a066df61966bbd72864e8a1159a2f0b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9BD5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D43.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit