Analysis
-
max time kernel
183s -
max time network
232s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 00:11
Static task
static1
Behavioral task
behavioral1
Sample
libconverter_float_plugin.dll.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libconverter_float_plugin.dll.html
Resource
win10v2004-20240226-en
General
-
Target
libconverter_float_plugin.dll.html
-
Size
7KB
-
MD5
67bfaf42e4dc926d31fe978cc626f6d9
-
SHA1
639d9e131c499d6a92d6804f2823f9b65de1a68e
-
SHA256
8ca4350699f74bb8febe29a7e76324488686ffe71697840c5e27e303e6c05bf7
-
SHA512
2d59dc6af13ef22b1a7f41510ef9870c3aea90f00553b1a23260de20eeff34c03de5bf839fbb7717c318c6c87c4be5910f6c1d88b82c853a2883a924c62233d7
-
SSDEEP
192:ZevTPMcMHyx1Zvsv/yv/d8v/JvCjv0mXHP5BxSav/cvST/lo3fZvvMv/EvLCvHvU:ZiPMcMHyx1wwdi9mXHP5BxSoFT/2c49N
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000ed7ed7fb42c7cbc0cef294c50e814d2dc549b2887354ea7b8f15c8c5dd50e160000000000e8000000002000020000000d809e363b42868fd620a7bf4c13d27fa0558d07f731a3f8bb291d9d836ed34f290000000b938dd893edcc31f99bbeccf4f402fb6fbc3bf97f399a574bece1982b73df77bdab4e93b90c7dcf4f27eb70a6f9cb2b2fd1a7f9863b1b81d2058d2b641ceefe3bb5c57f2a74f1df459b0f8dad522e8c84eb019e826ebd977a429ff3359b1a6869b9b1dd7a3687a91b1d32a6477de363481ccce3a73fc14877c9ce57a8323bde0c83fb6c3746c2f888f0139d04e8c68b340000000487eb23f88d675ff7b4f10a0ed04c2b66db8b88b6b7ac4b51dcbb557f2b688432d19f05c3a6087077be65f8f0a72d233624a98259331c32fdd523c2cac55b77c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D000E4D0-FD18-11EE-B142-FA5112F1BCBF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419561232" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000009162e18568c68cac26e89161e53b1a60730f7b4ca13d083cf3165da3cb921bf6000000000e80000000020000200000000b608a9c3bf02ab3e37240b41b9e6d4c4a4eec3ed2e8084abd593bd856c72d6c20000000ecbd2f5a67c9e9a4860142022c34c6eb29ae181d16eb8ffd115c4d6994e5e81b400000001d15911dd9b39c79eb6534a51ff940a417f12507aab81b7f50b6f408d4effad712910d28058bad14e0446d2036a5f87cfbc1f3ea42a65eca451b69abb1691475 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9062d3bf2591da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1516 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1516 iexplore.exe 1516 iexplore.exe 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE 2712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2712 1516 iexplore.exe 29 PID 1516 wrote to memory of 2712 1516 iexplore.exe 29 PID 1516 wrote to memory of 2712 1516 iexplore.exe 29 PID 1516 wrote to memory of 2712 1516 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libconverter_float_plugin.dll.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dafe03a881778a5437f00615d9aad03
SHA17fdfec660fc286073b3d430b8d94efcdb87fb9b3
SHA25640fd11c4910a15ecd7634356755cf6ac22da23972c8c2cb3e2b2483f576e3fc3
SHA5125431bbdc669c15e7687923630888b9bc742c690b8f2e7852fece5160467083a9f8ab086420e65add9669df67f33287d32c06d5e110c1707e31e89e6eabff22cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535f8c69b3060acf5a0f96210c602071a
SHA146fea4c6129eb4c8143527e29c015e19019d7340
SHA256285ee28d3009b6176b2e528ad0ac62b4c73569811eac6c6d14e3f2959f77b82c
SHA5120cf821332bdbec76ea1a05090fc6b165838f3d49e71afa5d7cac513dabe3688104c837fd3afc3f073a43eaf639aee9a652b665c1cf8880845f079d00c605f7ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57589179c52aba77c436ed25e39a31650
SHA183054acc4a11abc32efb93d01d071f949cbf60bb
SHA25636873d4e85e1334192d2677838cb06db4aefab3e3950729591af6233cdef0044
SHA512b749c5230f2db1ae8ce1fc92c68df1cbd1bd56797fc6b66c81ab7f0e02644ec50b669e9256a7ed08c04a16b33c682956e54d53edd379e100afdf9f86be2163b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529e07cd4d224b4a09f31f2f873693677
SHA1c380abefca7b89fba04c2712d4a5564586b8d80c
SHA256fabe274d6e1d10d9942e91a9232b2bd0b96df8c6663313989f84c304be316b55
SHA51299eedb781ed15a9a1bf0aa39aadd0794a87cf5b7f7a92df745deb86ea34b523575196cdb16e647b0e92232c92e09cef30f4c070a416b0c212c63aec693576445
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f3c8de11e93595f1fbf6d7dad745b05
SHA1e54402d131e72fc94322cfa8f5e676a441138d98
SHA256d38076458ba844ba2789808491866b38973fd6cee1e42b31b297dbfbde94bd99
SHA5125bdb5d12cd5a8206fdab4193cd0aadd7fd10a88d9c31586791bf8d2fb2abd88ce3761b3fb0255c77d66a3cfe1b67efa63cea4d9fe9056967056655dfc16b1e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5393c05930b562a7ca04c406148e2fad3
SHA1e250997274783a0230281114eb836505952951bd
SHA2568cf7404e0bb464ccc8a4d23c174eabcf2bf7d2d937e281781bd209a542f3c341
SHA5129fe497d05c6dfdfdf3713da2e418c4867c8280650b1b370667026cb41ad6ee951753723a88635a8c9c2b070b4a7f95de41ec161682eb360bfedca1b3292be6e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58df4943923a3d18feb3b216dca0e9873
SHA14fc78c96fc69673984aa1a40b5ffe0285ddc2f4b
SHA2568a5eb3f746819b85a066cbc5a37424d37ff9e5c8added5a8fe5bbb7064ec4b38
SHA51263137b92cdaf099a572da994607e99758e44329cc623f27b3dca3c85312f4aaf43fc440cccce93754356404d9a2f2d30e24fa6a6579103c19b4de8054f05d6e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa73a5a6aee023c4fb2d3178bed4d7fd
SHA1b08669bd970588521c7ed3ce644917e22e970f10
SHA256c0849cae5ec4b6b13de3ae737a0c777800b572651b297e9655bd4d71253bd330
SHA512ae780858441be605ef0cf95ffbce8f56850a65c0bfb67756898153746c7a984fd27debd664c3e1258af5e24401dbe04fde2b38a685e5c31d26da5a9ec4759dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5865f44ac14d496fec4163f3ea08e8ade
SHA17835794a84991e822c581fa15d6e527cea6a0345
SHA2563cf679b0f81235a698d7cc52b526f662f3193f8a409dc3e866d9fb4b05107448
SHA512c849b31022cd641ab810b9f4faff518743f83c7b050c3ee43362266c726461dc61f76869b3a20b0f673829ab60df01155ea7d943d73154026b8d1e357c9ab03f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe0eb2980579c54e058b7a6c4192c278
SHA102341acd10fbff1b408aae2c74b937d6b95e1450
SHA256d28b0b57f81343d1b7a8cc5f32324706f06c54733e3040de020e7d255f1298ac
SHA512ccb431ec790a0fef9ff57672c717a3b90d815788a0bf63a6ccf434f02b8f55dc51ee9fc383d585e2b8a3ee8232a12235344068b28ae1aa280e3458e3b07ccafd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9323bcd0973a9e6e23bd9f65cbd276c
SHA15e96c1ab73caaa1f48416bdb05ca49d379bcf49a
SHA256151fd98a4f699dc26c85b1dcd12e6daa72c7557fb6952a99e53b7f51ba597359
SHA512c3ab05082af28fc275ae41e85f31930cdc701a3d9f6c426a290d1799a3602c7693f3d519437d002bbe8bc41bb3347a8ab53fb7abaf304d7e439d8411c7a359b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558674c61c93e19ac8d03ad470db4edcb
SHA1573bd12ddf4c877b5208178f9db7b57587d4984a
SHA25644998699c5107af535760faa647c46e9c388b2645158f02cbc6c5610acc4b5e1
SHA512b7ea4a356526f2ced4cff165941e30b53fb024cdcceb22f0f835fa0c4ad51531baaeaf5fb42a857ab6eb2b877df6f2038ac52bfb05f442318fd9af71620a1829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e55c2782be8719fc73465fdd6736874c
SHA18c02240a7542f54e1247077a8cc1300824f8541e
SHA2563a937a9380e429d68e740d257e85ae64a428383c1c5a7255f644422a60e5eb5f
SHA5121eabc8acef7c32259d8b76783db7aafeb5c445b287c9d59d6992a59c8cfaf6082fe52ab2ddd6b2bca8804b67da014d262253b0051f28506f1f4695911b7c1c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e668d2ac6cbacef9fd4204fd3265b1b
SHA10e9e62ccaa9aa49dae4cc7725d002ad03ce9872c
SHA2566a968db0e4cd5c43a356e1c5f70a014204f2653d6164ddf012123c6920aff393
SHA51266927709b95622369ce5ce180879d953f8ff9a0c0127c194d15ff3687fed31e55603457cb880beb5ed8f88437b624549e6e572a95b0bb8dfb9a74a8e2b6e4d6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e8aeec4048ddb1a6773027011b5ea13
SHA1673fd3f1430418e5194f61f5aefd917776fd5121
SHA25625a7e30196218849f0a5ede04d39de2ab9da81138a0078221f70ad38fc81c817
SHA512929ef659e9592486db35b74d3b4e0ba8b3c9194d429ae5d66c2dd7f0a4978b280e3ca805bb5b72dcc55d34e5224100eb47553407a20756e4cf37f0ed73731593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59731a568fe6c5bcc36637e4bf53ebc32
SHA193ec62b0cedbcd1a0f03af5fe633b7f6590d2421
SHA256c3f459caee8b7aeb7d60b5228effddeb0e1c530da72e4c82893aff68286e825f
SHA512dc9cd4308e5f71d310f8d55d8e4793f7d39ebc5a89820b357ba20aff4bb7871307316f7e07666f0dc2757d23cb36fb0583be56ea211f9671b7f28ccb987bbf4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53eeaead557b6757abe2f598b2d4f82fc
SHA11782fa39f1c2962c261acc939d634c6807db07ae
SHA256420c000517f523d91b8b8520d3929813afb6208ecce1fe9abc35e061413df343
SHA51205f792f557d535dd2b5ef20d38b9eb11cce7b588fd5056bfd01d9eee3c0d3cdcd3adc84607997018751a23efbb5cc810da8851f1e8852b796bd073d73dabdc67
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a