d2932b503cb6b9bfb4b1b02ed6ad466198ceec430f50dbab9701b026297f4186

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 00:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libtransform_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Size

7KB
MD5

7a3fa288169acfa057d35931ab15adb5
SHA1

6c2bcc1ef71d837fc3c51d209a088adb33c4d4d3
SHA256

d2932b503cb6b9bfb4b1b02ed6ad466198ceec430f50dbab9701b026297f4186
SHA512

f2520378e1d63198d72c3282e25e53a580831c12d9aaabab1cf11f7b1a8a480f7aadac751329ec547cd818457e4d3b4b6372651bbc070852889d2601ac4db4d5
SSDEEP

192:Z5vTPMcMHyx1+vrv/tv/d7v/uvCsv0mXHP5BxUvv/lvST/lo3f+vvLv/DvwvgvW/:Z5PMcMHyx1yFdLZmXHP5BxUf4T/2qqlN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704169242b91da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F680F51-FD1E-11EE-AC06-EEF45767FDFF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000080b9e25962b9c8ac4b8a4dfccc447b8fa285d191364e6be00802cbaa67cc9dc7000000000e8000000002000020000000557c8d99c27df602a6fd3cfb7cbb6ec83391f325f65bbff02b3d2cc3b603821b90000000511f31e8be06a9cad601971c3f02d2233169d7dfd0afadd674901a3af56ebc1170b5fb0c5e111c0f24fb1fe3ac03a96fa06d2613041c4211a4b8090d68a83ef87d4fc309ed887c4361e2f96c837ebc324841b4e90990a5eb0f30be806d746e9cc4fc7bdfaa9b490b29c39690437e650c7eb0f1baca66339cf6ef320f4ff8ddfba9f59484785d296e97574d5500823bfb400000009ccf1575127fb76ffede637a77179761f4c769e8411f5e81621dc8e1f7aba049d53da2cdd4e705b67c880b6eadd6acee1f34fb595278c552adaad70fbcab730a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000093405f4960afb62e9ec374ab44f960e51bec9a8b6e222baa1714f3c90c95b97c000000000e8000000002000020000000af0213d9825541ea5cdf9259bb65f4eb67c16a9513cb3b36861e3b3a88c3ff082000000025a015cc4050620dccae6c37e474781eb6aff6ca3de093fb4d5db60612d0f3b240000000de51c00874d7395f25ed0b027daf3e76e34073af6c79d9ea5dc717b4b020a0f878a35211c3f394a80bed6a183b312e77552d99f2a0f4581feb5e7110bbfa07be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419563581"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2636	2256	iexplore.exe	28
PID 2256 wrote to memory of 2636	2256	iexplore.exe	28
PID 2256 wrote to memory of 2636	2256	iexplore.exe	28
PID 2256 wrote to memory of 2636	2256	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libtransform_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5553ef7af70b03801682450ac650a7

SHA1
5747e7439f4619be31f0b109e1e7c634fbe436b6

SHA256
9ef39527bff93139b3a73dd6f39caa2a7ba365737a5fc9510b8eac4e8715ac19

SHA512
7b5bb559d79ee60df248d078741c4b8fc6a5853de9d37dca9b675fd65e8c17f959da0b32925877561c114960cb0e4ce83501330de71573bb5f1824680705fa1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754915183ad088cd4b58d3993be4af57

SHA1
d5f8170757bf70f18a6587d591a9e3d9f0f4c770

SHA256
5b58d87ca05bf369497b71d5da9fa725dbfb4883849c4266f0e74b4da01a4c72

SHA512
b3c838158f976c0691676c50dbc5f06a64b3631f33034ec054cda87a5e468af40f4f804451ac299ae812ff6bea637955490d9d87f20bddeff33ccfdc738c2c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
313cbfc8e10261d4c8123fa1c88a016c

SHA1
a52fd351ec384c1fa8fecac5afaeb97f5301a089

SHA256
bc745222cf0972aa43f1abcb6b17b881ec593992dec3669af572507f8a63a53a

SHA512
b3fb7e3b2068e4d0a50ace1a9c02b34ee829d3c7766a5f8a7fe83f25e022ca09bdca81473c7f27c802a3d5d6aec63a453fc81252d053c5b02fdd0c52172d30df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39303f14919d559d7e03da1f76e97177

SHA1
39b515ae1eabdec70133bedea161cad0182c6dc8

SHA256
3bb7b4a9d876323152dca700ec51688f6a6e49465e2f76dadc1bd59a50b65887

SHA512
cc4167def36a1a07714232a00152e8e3f1d89ba2cf5c132b728ea0924fe79c1a17f0cb8be55be5b7a111b5d5b53664d177e187f007d2f9d2b37201b4818e583d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff488269dac500fea0c7a6921a5bbdb4

SHA1
2f988abf7b9a7a92a802476a29383d4341e8c2cd

SHA256
5914ade4fb1403b8c144ec36371992c77de2dba8c7226deca06a12156e3dd436

SHA512
40c04aec583d3eb36af7df9dec323d2b085f1d1391b38b205ecb85efa59d2e010843fe136fdccd7ce26a36e89a31989d0038398c4598e8a4000e47db58f4eb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a16705fb6dd79ae5b05c348ca0afe9fd

SHA1
da4fc049e27b69307311aa9e07ec6b369465dff8

SHA256
ab9f96af2bde8351524cfa35d5e49190ccd013b8fe2fb8921e809f4ae6f0f475

SHA512
74fcebcaffb99ebae15e297b29bc150556fa6c36f74baf47bbf2f25374132e8f87aa3769349bf7bfcf74c115757a64ac27ff23588a7a33a2039b3c1a6eb2eaf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4450531b9363e31a97d92a5e5486788d

SHA1
8138dcbae2a6a0b70106c55fd78d1c8b8192ad2b

SHA256
b8dd2685cd796ee1ca4b242ceda398b9df8ee6d105669a8a881d706f013750c8

SHA512
33070d9f9b823b8e653cfd0b07ec9c119d9ac5fcc8f90de5f099028d0663c1705525dd6cf0c5d3e5b871e632bc887e924034d71cb51ac862ca6529080b920c47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f7c53ba9f6e89b76e393056e7a1a382

SHA1
513b6868cd8b39a8753da2b65289844d6db14389

SHA256
7d290037a12a46a7d0ee8af3d60efa3b93ee64bc5613dd464448160b8e386b45

SHA512
e0eda7d0853c950859d2d83adfbcbbef93810c17e6c9b4490a60808d8fe09d1855fc7c71950b8b1b5aa330ce777bfdcf33825d4cbe1b87b09e3810ccbfc4280b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bd9474920fa18fc25ea1db2f282d4cf

SHA1
50bac34dcbdd8738ea222cb46fa5408d19265ff8

SHA256
d0f887132c9429f4ac46278479409e5a1fa515da4488c24ed50b1bff4a475961

SHA512
0e6a93c2b59a77ec5dd0749ce705f8e084847dbee76391d4f7154792074610a01e790a9a249e4b97c99f64aa18f2cf686d647fced7f34b59fb82780357833abb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fea1abc5ad3c1dceed55f76829a94752

SHA1
e94174bf3cd7a68253bb3ab86a16d4e22b13e9d1

SHA256
30abb29d40e2233a25d06be0fc8a209b1f2ea2cb14605682a803ed905fab6aae

SHA512
e881716d5c97de18c5c110b426b7d201bc6f65d3327f7a10ba7cc3474a5b8e4bdfc52fbaff1e52a7fb148e8a1e5f31cc6bbb132bfc77ef2fcf4dc35f675fa8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62badf48b23d7ee4d58bf1c429f3dffb

SHA1
f5ec6da9824351ce8e57484b86bab30a4e17850e

SHA256
4e2b98b8c6aeca96216188692c7317fbdeda62ea35242ff2c6c72f71dd15e071

SHA512
2bc692cfcb187fb4184ee5ce63356ee388d59925f702d4b362382e1948a8e60463cfcb5c902919aed805ecddb2fe768f2b5d81568daf757908ebaf7ddf17f7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16f5acae9bf6c7761a9d32ff9260f43a

SHA1
eb151d7369a9b7f3d0aec45e6f27726f008c14dc

SHA256
a4f522e4384230ed90d14a83e4d677469fbb58e8d929faa3b97e5f4861101aa9

SHA512
7f70ff07359896a095d1aefa9f4e208f8c162f2ed35a5378fb4a0e104d22c282b11fffa49823e72b778447d4a47f1e76bffd33959b1d22dd4244a6bc33cc234d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
077ee7d1208929ba5b7b080caa34f8d4

SHA1
2d96eacbf863c93372a1681ab9e8d4443d1e6533

SHA256
bc1b2923fa7309e03636aa24accc3d04f58cd253e6c3111834b6a1aaa8104de5

SHA512
9d0c58722fb1e1feee77434d9d75225cde8e194afcd63ea789460124e161148be92ee0fa7b6b0742bcf92680fe59c2bcecaff7dc7690a87b63f9e78696e265cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10fd4b0572c4572b29bc517b828473f1

SHA1
8eddbcd554db7fddd07e66bfae95ebec24972f8c

SHA256
b66c3780f8992725da0d3bc9efc6fd90a8bd1eda3a68410616e9e33de18698ee

SHA512
c3618b4f4690301bdbc51e700c8438c04c5ead424aa07f53d8686286fee7295460e78002c71414765a8a8c93122c1fa80b50573281261a989fd1eafcf3437fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53b5decba37784022c1f21a6d7ad6746

SHA1
73ad1f089049f3240ad7849f465c2839edbf89d7

SHA256
2bfeb1dacf7c92ec39348f19b9c6e305f772ed8cb71f072fa98a849598163549

SHA512
fc0d1287eb13caf7d39bbb85aaf296d70b268f79e8bd22af536d4e97e0cfd93b1abede4fbd1b6b11f560d21a6714712e3ad3f1d287b843a6ffb986d17ec16140

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB973.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC443.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit