02c931e1400ae29115adba8dbd21311a5b36e7eb1be9ab54050c942343128382

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libbandlimited_resampler_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

296KB
MD5

447e6e34bc855f3187e0b6cb4c823cec
SHA1

1a19c02b7d06fc09a017d1be5f29db82405d1809
SHA256

02c931e1400ae29115adba8dbd21311a5b36e7eb1be9ab54050c942343128382
SHA512

f66a0d214e3a9e48ef9f552e93177ddfbcee70835d1565e67dbd31a5b2c1877a314f3b1a7dd1cee2d6f317712efdcecc554728dfe0d4419daef251ee538403a4
SSDEEP

3072:gh/1lXWO8izsxRI+AeAYsWU8IiEZLjhEYUz6:WXl8AsPAeFsWU8IiEZvhxUz6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000b64519ab0ebb475595372db4867027b9a7f20ae271d8fda2c4b88ba534de5df3000000000e800000000200002000000047d31a62bcc4d2aea64a7dd4b0488737af83c278b4eb63482a8c639ab18ce71290000000782f9e2552d6d87d5cec22bdac14640a14cf7458ff5fe05ec15287c3935c342d6145053db1a7fd05c522dbce9b312a9ab3d414c2e3aad69a9000e8c1fdca8d89fd45461870216d64c83c84a31fe85992dc13628e8a2e2222227d5b74b298aa44dc0a6e003e0727363ca194f5d431621d6158fac8e6e42d3fc2d0d9d484ca657f199bd2abd570562ba4bfd59f670b8f35400000003ef457d23a7447959c802a8e3b78c176059058eb0edf1f58a8096ef7fd541200ff19c07e380e2e8a33908fc523c660aca7b44ee47c4267ce7488b2372585fd29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{111F8991-FD18-11EE-892C-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419560899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b027f7e92491da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000b92ee89e66be3cff2125d54c1a78632dc21b09b198ddbe244e4cc53dd16f2a24000000000e80000000020000200000002c42832f92b25c3fdb4439c2faf29899ea8f73df4b1e02cedcf19253c5d7fb2a200000009c46aeaf0fd0f4e2ca11ab768676f1f182610f16f8bd5c842bf1845b09909de240000000f0590932ad8c41302888fe9439e7292f98cd0d1ee2c8d3715e1a38c90c505b6a2db35b8bb3a220ebfa4886c032047ee8c53d1212b802a0f9788ed08d40f713bd	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE
2644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2644	2976	iexplore.exe	28
PID 2976 wrote to memory of 2644	2976	iexplore.exe	28
PID 2976 wrote to memory of 2644	2976	iexplore.exe	28
PID 2976 wrote to memory of 2644	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libbandlimited_resampler_plugin.dll_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08b5ed39f0b5192d3284c5bf26330eaf

SHA1
7b2afd8e3e776d68149fed80d659e61d980bc0a1

SHA256
0b18e919dcc94508574c7e473166e84c2aec932f6a67cc0449a55d64a04983e4

SHA512
092761738cd0a8411b801e648178f97291150fb3f7c441414be340fb2295b80d5991a03670d494f679679a74241b777d809511c7b8cf4abbdb2ec71fad9c54c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca638ffd88385e78205c6ac5d0d3095

SHA1
49cdd554d77099d47e283a82be16376126004870

SHA256
db45025a9dade54f5def9696a258d71fe3a043fdb047dc31d8bf99dd99c98df7

SHA512
36f842eb8bfa00e85fdd0d439dec79095513bf30ee6b0b861e3b1d4718e3fd593bbd24caf40cbb065fb85f770efa68a233068015eb2391e14ca826f05ee21006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18ba5ca19a4066fb5b9f9066043f3234

SHA1
51208ecc8e38ec1b8665d4a38c02d225825c0c69

SHA256
e38ad35e5844e623eb1a66fabfc57084c92ff598e9cf9626fc9a44a452e245bb

SHA512
b48664da0a34b509fd1294af94f010fa1a75423206a20c86698f05847294d467f61cd68bb1184c55ebea1263037b0742e9edaa2d70165039fe47a8ad7f47fb1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b368f4dbe5479ed2eb30cba36a83cf56

SHA1
6419f2f3f273d7f9cd23e1510513d5800c9c1bb9

SHA256
13c8b053f10631e8d9c2574ff73d7ce5098b27b87b7b970a4c3f35a7cf1e4120

SHA512
dd2441de89de55adb3ab3e811f07dd242fd409ae4a9475f62dc7f14e8b9d40238a751f304111b53316ae389f06027b9d26b74593bc275bffe09d12b367b74a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a25d082b0db58493410e13b1fa23f6ed

SHA1
ed56e4cfce6a1be49922aea3a13fe8fe01c40d82

SHA256
493c914b02447b3f1574a49dbdfe32dc1eaf199a4173a192e239615ec94b06a9

SHA512
6e4a4fb372e345cd90c6502bb9f0eaa6a80e29d693a3cb4887f3b9f963f3d3367ffbdeb58f19202eb9e27fec596af6efaa4f9a2f014bacfafe13c3cc3aedd860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca94c639d920286520098f0ca0c38115

SHA1
29dfea6667cab5b295930005216d1a88d87e402e

SHA256
09f9f93da6cff142060977558e20b789cd346d8692c5ff7c94e3fdd3c1899225

SHA512
66fd212a9acceedf67023e55db71f1cf11b84cef6924407fa60d8727698c7ff2ca95d89ca022913b7a748a72eeda0b82fe7035442e4216de1f0f83eb64c3bed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
197af5209923530fdc8e8a63aae191ec

SHA1
128f5a15be9a1501b0f703cc8b0f3db26b92760b

SHA256
bc68d87eb4a2f64e97ecaed6a4cd63e833da8b4a0b34f21354135b7ea13bce5a

SHA512
76e5da42d441accf4b49b384c4db7d4a6285d6609837ba3aee68a2a98598295882831a42bba5b3074874d67813f21ee0bfa831dc7c24da809675d246d56ba17f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b7432707412c17ba9ee2e9d2d8f9bf

SHA1
281fd3fcc6e0636b2c94164b65ba1a6a80f3fd0b

SHA256
77c62e3d8d6a1a95e3654b2ff4a531143167ba9a905a3795ddc67bcfe940f274

SHA512
bd54923c7286e09cd75901cc7c0e2106fceea3aa172bd3af5d2aa98f6a8c1a17a8f70879a2f70505d3fb96a828c3dd196adfc27ef92a63f5876031f6cb69574e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1960961e96f6a8c6d3b20bed9935bc7d

SHA1
e91be8134976b8edc0317deb3df56b5c02784a78

SHA256
e5dbd0a177fa2fb8ba9876ec7dd2a0d5191de28abac73f482d1f1c328793f62b

SHA512
46b181562ca7037f5f3476700da079739c25e840262922a14e7f7afdecac41d489dc3be7ea44d2ba02f9a4b96f54074cbd1b4fc3a8dcaa4285781c88f648031e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd68d0a0637e44738f08c18d1b7f8a5

SHA1
3bae91c0a7d37af20a94a8b612c4342664fe5f34

SHA256
82ff79de4fe3240f6cb0c0b580abf142b16fe8002ef145a7345684c8c6c94a3f

SHA512
b186e25e25a2241ffb90ede522ed76c4c91b3c64ce506046681a18a907abd29386de096230180d100fa10befce202323647818b0bcbfcf03655437ccd86d7864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75bd92df87360b6583e8a0c281b25b55

SHA1
4e57979a2828fdca53ec7941f6eb38b50d12bc27

SHA256
1a0f425b2fd4921dd94d170de751e3c2252ca3cfcafa6d60e7cb17580e1f0a16

SHA512
a20bc1db59a183c82aedea380fbffbff0dad96c48af915df946447a9cf16cc2e8e697990718df76a32aa79a03b5b947c59695d1e665222ba6894d6c30c6d4a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8d405af631a786874dfd9a833fae712

SHA1
67f43882e98ad7dee1c3f80c09029bda5f14df1c

SHA256
4ddafb9dc947821faec49e1f6adc9e889c60b7ac459556a71bae9f1bffdc9fdc

SHA512
29e774963055bf6a3954275630a8f799fdf0857f1de3d6d892bbfaf792e0496ef390ce0d741e6d966d0ba90a369c2455f40d9e391ee6b76db1abc569de18cc7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e0cf08017b5eb2bcf32a7df8cc760f7

SHA1
196128ebdc31f28f2b9f129294ec9220f47b8a1c

SHA256
b5125cd3c6d4fdcf9f72186064a18f06ec25673a655246df833b298085166ec6

SHA512
321332db41f65d20a3ab82fb946147c4324e187624d58c1fd13814a26bc46f89aaf72dcf9eaf2b0dbbe135cdfb031ac0a9b2d84dabccfc5fdfe29211656365a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f31f5412b0312509650d331a055fd530

SHA1
ddc8e1b77f73706a0952c58bedc365f96cdd87eb

SHA256
9aa1365ed1faedb906be46ef045ac02077a766e3a75a6cee8746e4fe6c3708c4

SHA512
b2dc3a8c0536d2487fd0aa85ce9977b83cba9ac8f927c3d0afa46020d1805163f2975e54edbe7649d709e7ee27717635cac45fdf200d6a996553ed2f9502bb86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d9ea02309f9c0c91e7ed642644e7ff0

SHA1
91563588fb566b8415cdb985ab4a88b131cb1a64

SHA256
261c0f6ac98d0cff17521c7ffcf0a363a4bdfee60fa458e006de0edde89767c8

SHA512
8e6b3aed5fadd81f2977e5d03621fa1d952c3e2e72f0e7081fe944408647c7cb7860833e172b68c774ffe1ab159a2b7b78f24338672ecd0a2dccda817512cbef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA73.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBC2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit