b205a04e565c13c365e184b162b054c0ca4f59995fd3551f787b5446b6723269

Analysis

max time kernel
145s
max time network
222s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FLib/ĵ/FLibĵ.htm
Size

3KB
MD5

f0fa94cdaeba9acfd59c7d5f17e85694
SHA1

37911b0b2c6dd3991aced68dee9e53f904cdcdfa
SHA256

d240166a1114967a8013938c8ee28e72890e546e8c78a77a6db3879c22f4b759
SHA512

5da89dedf1ea7a36f24dd794195df08239e9fca4d326c80cd6f6ee748a259a9d99b2abaa7ccbc0c3b921881b07264d05ed07d1d615ef3c06335dee884385e1f1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000f9de80147333b8c10c3c71672f9134c9d4d864a9c29e7787977f1948fcd87829000000000e8000000002000020000000c2f08f1f645ac1d6165928dfad65ba35769e1c92618a4c573a7b375bf639b85e2000000050203a09acd36cd713d4b8ab44c6afd40184d58a2c16fc23a336f2e934243f50400000003fed8599bc7f0ae9a17bfa32308dc3b99d4163caf46d94aac5616713a441b9805afe2e05f642e71f3c3c1b6c6b790993586833c64e54bf8a1a87d26de3dfac51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B02963F1-F735-11EE-ADC2-DE62917EBCA6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418913930"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05fba96428bda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000005bd607f5b556c0cb8431d9e44c2e623204295fa6601119cbdf1bdf88ebb48d07000000000e8000000002000020000000d12a8c8e5ef91b878798c80a28236b812e420963dc2877b5c23d4d258d3e4ada900000003232b1c7b411bd75cad9eb507e59b4068ba8b9ca5805e77713eaaab567b5446b7ff2a7637a651232c9a4fab11acacbbf22b4dff43d7cc8ccd02a10f3327626c78da45a39082a1a1a2ffd29b1ac484f4a29e6790032f75d033bc9e81d81d59f49433ce345997e650fa4742cf2f8e99043aee0ea167972865c829dabe9b491b0374108873645f762fb303e473311f3501040000000bd1aca3d577b1d71255ae069fb8199b523dcc0501edd4babe11b44b85642e349ac86d23ced28acd529797a4423a49ee6de302d6de3c629f921b3be12544e8a00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2652	2784	iexplore.exe	30
PID 2784 wrote to memory of 2652	2784	iexplore.exe	30
PID 2784 wrote to memory of 2652	2784	iexplore.exe	30
PID 2784 wrote to memory of 2652	2784	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FLib\ĵ\FLibĵ.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c2f612d3d53ddb637e9a6031920c66e

SHA1
8405647f74b04dc40f23ce29d005b61cdc261ba8

SHA256
05cb32e7fd4dc78845eca62cf45f6d56341e957664759cbbc2dbb786cabcd0e9

SHA512
70c0b9fd42a04353475c0d1d4febe809629a75e9117688407a76b05f6918032d14581b8a15893c37fb567900fc2f748373d90eda6cb34994dec3c27be61993b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22a54dda1fd828fbcf1eb88e7b3c70ff

SHA1
21fbc05830e66b1a4d0b4220760f6bcd7b2ee079

SHA256
52fe0e029f857bf389fee889bc34477e4c61f6829267f832e696bcbd6161fef4

SHA512
b558aa7701abedbbe0ad9163714ec2e8c339ab92a2d62d1322fc1769b2c3f03482a02740ea656188bf38052dabcf5f4d2af93d4ba0f2d2aa03e4ccb96d09336e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce852e6a2928fd0f232b6fcd5f0a01a9

SHA1
aac1ebba41edd0f0ecd4d9e8b0609cf9d86fad9e

SHA256
8705f4ec89d33248c0f5170b15a02ebdcd55bc8d5fa6ceccf6d42f60d9d0875e

SHA512
7e66edb7e1291a6ebb305b8cabef417a683be83cd05b6d1f8e1786d5e2d72a21fd9fbaa15b9fabdafd4b9cf1df6b9c9875bd60a2b6b27ca2984c53cb54464be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a7d102f32d868b61f8d76c9156ae7e

SHA1
e8fd1902f909911933428bd4b7e3c5856bd3fcaf

SHA256
5f2e1963048a94e575deeb23b8e31dd4482fedf65daf31854fe6ead2eed7218d

SHA512
a5e447e34fc4e58f7e29b86d13193fea0d6e8773d2ff87d5cb3f7c306d4fd8146d6a6f8759c0fa5c974e47e0bcc6827383bb5cc1764ef1cd406abdd90c13cf49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
146b0063bdd10df6f1ecedff5d72198c

SHA1
07e7b9dab146621c4c2127d8ae248ad91db9ff97

SHA256
d2cb7bd5179bff91ab3bdd82f1cff51fdb1f5349db25c6e13cd7b8097c41a3f1

SHA512
ad0c34d0154420219d62afc2916cc98486716a18c317005ce0f00364b4f9f4b7ac1970608d3ef85a46f847e8c72177637c26940f92bca2b293af80f193805339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc44e0a97be2845c255109e76f0c65e4

SHA1
3740e92da847b6dc94312556b17028465c16cb81

SHA256
67ca9beb125e28c93425c8ef8f6e3bdd3fe1f653f050a88b9a71b0af4d6d4202

SHA512
d470eafa79a5a4c44459411783f047f7094fe0180ba7e38864839c52020e5390af75d3f7fbeb30dcf1bee9b4bc2bbf76d4686cc18a2dd30ef4d22e0f351f59c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be595110709fbd22544122f41c78cbee

SHA1
6f855fdfddd1ecc4be6ab2c6a5ad57e2d22de423

SHA256
e716b39f7423f940318b90dfa708ed8f8ff48bc4ad60b46366eb5ec4f19fbb9d

SHA512
ed625a7a3555106e27f2561543e95831d7a88c031565e09bd5d89b241b0d79498707c38e7a41d2b4c75b19068e9620ccb8c472a9ff5442f4445174d1d8e905b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
938dc06230334746d1b0fd38e8914cc1

SHA1
ef3909a0339efb0245b6042a6e29833c1db638f4

SHA256
bcf170d57d225d6904f6d5ae3d0ce0cdfe69897298414ab9b2a2a74d9ee73238

SHA512
7dd1355d148cd268749de009775652817eb738caaff53b1b02e1034b6bbf147278f05067e8fa84ebbbfa92d09792ffc46f014df48e7fd22794d6cf7cdb8ec66e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
885683a7d42fd93fc9af1613f494b520

SHA1
fd58e9b8ff6c0b0d8b235acd808cfda8e0c98f74

SHA256
4e89b79efd694b163e51bd938b3201c925361c42332d1fd15c50fa43773fe6f2

SHA512
c29ace93332121e73da6b9c0d0b924408838f0e0f13f4cb3667a91a5653c136acfb3a46fa8bda3d87a4de989093be64f1c784cf6575f5a62b345a9a838c91e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51bead7617313db999e4bf7d7ff94640

SHA1
bd74b3d206cde3b06d9722dbf52bc4d9dd0f0495

SHA256
83065eed8b2a96acbfd543c80ecc2c29ae10b2140abc790a9e1fc2f4dc3130f8

SHA512
74155d1cd6f0a41fd94c3640546f68d9e3f621f218e4c2998941ae5e00e3490d705fcee1129059a5cd379c82445d2fa725c18a71d66c49b9f99159234badf866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adc2b95c5cfb96fb842c24792f46430b

SHA1
0da589e26655b11ce1c00fd01ab96abd3a9050dd

SHA256
ad96a3a316c769431400ccd96c50da6aa965ef564a20a7568ff94a0e7626a283

SHA512
f4ef3289ad6cc4549bc8fcb8350db900b9eb54b8f1e2314d9f0b2e308271e334fd551116cb24cb11b86e8feb917d0d21de86727adf94d26f592e9a6f1779d05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
702655b258724d674ae37e44745cef19

SHA1
a8a3585266f91f0fce5d70d593e3ed85a5af276d

SHA256
b359a74e233f92214409639f6cb495e1779c6f773585468d5e5aa80e8fdc936a

SHA512
24a2c76215e156444dc1a532e69ec4e8ef041011a189fb101cd40baf1c1fb4fe5d4bb536df6ad628095f66c519d67a5782c0a160afe71c6bf3a6c6dc8d35d1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6486f9be484334eb7f022f5371b1cdff

SHA1
a5450108c463a96c5df51fdcef2a93fb49075edf

SHA256
3a298a320b6c32ff67fa2f19324450206851ac183ecd4e5550894eb59e16077f

SHA512
8213cd67740e6267fe80b33b670dea11819cd880887420ec3657a31dc4116b45341d279e6a272208d2a75f4f1e7f0e8fcb7989eb2a15f5bf7ed7de60226b7f57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
601b5d9e30ff4e7be145f580a401ea58

SHA1
16fbec51a6d1bcddc8d35bf8bef229eb49003fd2

SHA256
be96d560759521df7b1c40a09ef502d1e6659c244c24a6b91a865215436ec316

SHA512
e98c21b92b4c0ae79c74ff4e04c088daeef92ad7c5bd4b3ae6264c31ae4947285f623d48b040fedbfd50dacffc822beca4eca22d8fe14c3a3ce3446ff33a6dfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51B4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit