8b3e30c212d0dffd912973eec02f4d96aeb98548ab1f1d575fef8495b06b11b2

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sms/Lib/editor/plugins/about.html
Size

1KB
MD5

8f4cfd5a5cfa484821554381c4226e87
SHA1

6408edd222ac32aa54627327916bcde149ae5c42
SHA256

7bd8d8d4dc7b6b7ac6e6e7964e39d2e2bece0b176902807cba2d8ebf187db0c1
SHA512

f09948690af047c4b50fe891f3bd13adccb56181953006ee195745b464124b9a6bad9c5c18ac1c44a2267de9af8f2e6c42188b3df919d75f13caa0eed65be4d3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0238b706580da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417719452"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009281af6d8214e41093423dcbe8ff16efd42c3b7e935fdfc054bf4201f35697f2000000000e8000000002000020000000cfeff0ce917e1f34ab78e3a702ee977d3fcb01aaa44063fcf9a48facc1c8c66c20000000657a6b9a152ee6e93af14012138023dff974912175a1c9bbd0c64b33c214704040000000fcc0a870d60f11643ce49333ae93b7d37d333c8bbdc4f84a37aeb07f0008e0089572fc4ad7a0ce63a9ec3b69840468c68905e14829caea2631e327009d268cb3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cfa5d5ac94e1c6032a0b1b036a5d1f921f3094e153d68932569d4830c445e61b000000000e80000000020000200000003d8fff4ea799a254ed13d29b9aac4ea270f16c4ae78485d474a44d3e6e0e403b900000003f76e633222ff8c794540e2bcd2ababa2c1d70b042ed749c14c1d5e9459bde03bbf6adc4745791dd8681c4f99ac710a05d9ab1a0effe810423ace12a473eeb00294ce2725342147e9a0c496d32284e5b0a44274b08cb3e44e6b5caf902808c89c79ea68855066bd303f14903e714a2879077ad8065110298a1718ed4169398d7a504905b3a22df72f270eed39a117b16400000000a3dfc76efcea9680802f92c09911d42c3bcb7cb876327553f43657aac0799167b06a456842b1bca8a2bf5aa9fc90a00ae9ceb265d02ddccb830ce33c56533a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9BE88C51-EC58-11EE-9A4D-7A846B3196C4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2968	2432	iexplore.exe	28
PID 2432 wrote to memory of 2968	2432	iexplore.exe	28
PID 2432 wrote to memory of 2968	2432	iexplore.exe	28
PID 2432 wrote to memory of 2968	2432	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sms\Lib\editor\plugins\about.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8d7ba6c1d2e658a1ebb581fe79201460

SHA1
d0c48348b2abeae3486f7ee7109d2b4fdd7d3e62

SHA256
0d75eff1f25292d0305ff58eb47fbe989e1702ec96599c5b7af528f9225e1c53

SHA512
4732ebea5c3df593db1a33c32e62daa1b25598ed1356cdeaa873b2a37e117668769163001c951eac7e438eec37e78ab81ff993dbb10112d1438dac03f6afb9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20de1ff403130797b89e3f099705fd55

SHA1
94657fe8632ad5b5905ded40f4838377494a1a1e

SHA256
8ab2344201adeebc92a80aa68d9502e0bff670fb05f790e08b74860dd12e5460

SHA512
4b388c7f1b1ae1ae26e252068ce45c6e0f371231a1d1d3680ed378f8acd25ad8bb9d813c68132a8d1047a59083e93f3a17cbcd526e71969176e496d143d44db0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5e361194f06bec74504844879bf0c665

SHA1
c53f21d307d0ca90e8085c7453e26c08ac22f3da

SHA256
5a95123302056adb88c8eecd2187ce011e74172a4d24b51a19cb5be4261b84f5

SHA512
7a25d006b1908822aed34dbd295677a1c03101326528c00f5eea17736535e08df029f06a42bcdeee6f191e87f0597f4af28cf9d201f342061625e4b95d3f69b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a15dc38828e2275ec898d6c6b74832d4

SHA1
1ce4aaecd896daf18e95b46b010e30a14734b723

SHA256
2da952d61712ea915ab7259002966cab5048a3421b4216723929cd18556d09e0

SHA512
f6ade31a59ceaaaa3a5ea4bdf578a3c4a1b90eb79205192299ef7f50770f66aedf77a18784c0336341eb8e53adee98c5f54e7adbcb141602de1b50758a6f8c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
96af625a2e22913565834c90bba11928

SHA1
3ce5c59815e8a63bc0e876da3b5047d73cd8b7f0

SHA256
eb90eb03d7466102bb67586fe21d86a1704c0c70f2afda801f8c6a2fbf21bd5f

SHA512
988b3370131794b7dcdc5fa6a9a0996057a598ef062692d141f9ec554b4fc0c1c10438023cdbbdd7c72123dd831817ec29ad7c97a92d0a517ef9294b8cfd7342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
37b5182b0c3fb6af717971b4cadcbdc2

SHA1
daacd688c5714a4fff107f138038cbf215e263d6

SHA256
804d9d918e62f04179af079e79c2bb8adea592c6acdb0140a27d8a6ffef99d18

SHA512
603d5d3a8dc6319badcedf85f8392a996d6fef7a1aed4e8814ddd062694729891b4cf1e95ea9d94b1efb2cd1befded9e12e93c08cb1e2f91a8bc8d9922502c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bc1a41520a7ed38c327102bff2e83587

SHA1
b179e880e8b62487db2a4722d5f9e169bdefbe74

SHA256
a45e7c544bc848f3e0732f59d1f0eddd33de688a9a7b4d1d41540cecf7067194

SHA512
26b4463c8326abfc26b0765ef0a8ebaf0701835dc1b7c9653f3f98bef548e0515e7a44bb6a35a85f31c62e80585e437112b81c2c81bdd6ec2f2cb1cd16fd3a88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1a64e6445e6a2b3dd8f92e04e4970480

SHA1
e5d07b2bcb8f283ef35783064064e552f2311e4c

SHA256
fc82d42ab9fc50c96bc41ab9d7f0d054a60e8c3d938cfca66bdfd1cdf8c867ff

SHA512
9e820d4dab8c44958aab1d5445261d161f25c8a23558b2693e35d2bfbec19b77e4e524ef100e2a468bd0242d6fc374e898ec1e0e60618ebc6bef636d6ebe04ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2894ea300f8f9f8827496412915a77c1

SHA1
c5fdf657195662d3f429e7d237cc921d73269ab8

SHA256
26835b0bbeb32168fd3b53543328ba0b65f1b8bab3152d79be4c1282169deda2

SHA512
8934ddcf1c08ba1e9fd55778d6ddb1aa426e2c68594d1cd13053c1d998ef862ac570483e40a8bac7a21052438bbdbe1a1562f4f306d5a957187bcd26140e0963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
68460e035dab4fb84451b1c170ff0445

SHA1
489462e2e799c768aa0db10501abe44e8b554cb7

SHA256
293eaf77abdd8e5734089416d1f672d83ffe23f27b74526422de89ffaa7b0883

SHA512
a1dec38bae1dd54a0bfb6377db349443da0f38d97b630ab31eb3ec8791059a0d523242ac8d7b65208059495c244a3968b12ae4138aca7de1798a5b38a2237bcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
999bd4d3f5ef4d589895984e7eb1c704

SHA1
cbbca439a1d4a43342cfbed30d256c57d27eb5da

SHA256
b50c6f816d4c0cf032d0cab3b4d349949c100a50533e949e73738bae38b23cc2

SHA512
6e5e9ff1cc739e254ee072794158594823dc154e982d585324cecb50fe759654aab29fa6ae37a2e46c10bd8a6a2417ec681872221c54dfc997767c8ccfa26f4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c490fcc8132f1267476984d79ead2f82

SHA1
67d32a062d101c4a4e29715a81561b88162e0029

SHA256
e1f7863569d50e66d88a40dca835f7301b07ae07670eeb7d43f5915b9a4c8f11

SHA512
5a5ecebfbd1621a6d00ac6d6dbda2ef3536dbd7a8768bc2c766208a2f0e1191b077b0aaff05ee3575d9d2c978f24b203e97061d909b4f6368b2234a5a9b108bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2afd559f39f2dd4d2a63493f3cb3cffe

SHA1
3a1bf8f230775c1bf3a664a4d6dcf2224547e655

SHA256
8dc8b61e27b2f101a6fbf87367525a31433f77c7593d797a2c52540b1b6130f0

SHA512
31605dcc0583ac3244ec64725e195fd6e20c4949dbd9359f7fafee9d4712e828314ab75c483a4ac32bf3a5ee7dce1a278e53bb70b68fca189c525e702894e995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
caf54c089fff582955e8adc4075ea95f

SHA1
36473cee43db496b6f0be6fff7217f2d2357b112

SHA256
dc76953e306c99d4cd1a0a5a7e856822148742c283f9018f9ccc0b3de694e6a7

SHA512
6be41be823d1e41f8b3c6d3072f52bbbc46262ef33e067ddf0f8cbe3cdcd5004586119689515543d551eebaa3de61d5fbc9814eb226fb8313e7f69e6d0e4a0eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc0c2d5ce4758aeab783541a3e038531

SHA1
235df5bd94c276b8590c344113d5243c12bea249

SHA256
5a423cd0f096aed4c04f3cb74c9890444b4ad1fafad8471b06f68becd445645d

SHA512
b4725f10ae6b721001830a243cb1d920ac4110338f1d0daf741701b54aea7500881208dad39e2ff90261760b0625ff1a858c7ed62fbc822f94c774e5b7b1208c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e84026702ca0e3fef481f94cbdfd423c

SHA1
d7265cd0e0b841c68e38fcc73682317b3c6eb851

SHA256
4632f73b17b66298b49cbe12ed0818a0052c49ad2b3989cb13b168f0cc74468f

SHA512
8f3d9c54164e45aa074697fe99091106e132b6f26cd4c3dd5c18f8d6791a37b90749a3f39b5e6becfcb9fe4335e3b72a5db26b390a58af3559741cd684e5e818

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F75.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2112.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit