ec5c7d0db83c659e296b873c293377995a89218ff46ef9dea14c1b91b8ad2c21

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libequalizer_plugin.dll.html
Size

7KB
MD5

642cd7f14b502dfc49576ae784e0760d
SHA1

4832a06347561b422f7879d9d99f3265d6f4cc17
SHA256

ec5c7d0db83c659e296b873c293377995a89218ff46ef9dea14c1b91b8ad2c21
SHA512

260fa650afcfefdfdefb30132cecf430d34294f44e4ff8b087423161212002fa65ba8fb268d1a752a5386dc9ae566b69199cfe13dd2bcd864826f52c6b1cec61
SSDEEP

192:ZfvTPMcMHyx1Evpv/rv/d5v/0vCSv0mXHP5BxSzv/ZvST/lo3fEvvJv/BvL7vuvE:ZjPMcMHyx1ebdxdmXHP5BxST8T/2yyuN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419561276"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1ADA6E1-FD18-11EE-A1EB-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000e82c836bb210b9bbca1767d8eda4d117469a7eb64790f82dfa507abb900e33df000000000e800000000200002000000099169fa5661de8ff450199c43bd3af80f3de97acdee994d3a4561e8e4c5970762000000048b4b460586599ab75c6815324c0a62ff3abe6985e31768c3636985f776937f140000000ad7842bfb9babb67aa16e1a6ca2c5fcd10fb5c0b786b526f430804c7b717a440647fb13c4a7674f7d8ff196bde9018bbd7a3ffd440c908fa8efa5dc176e42c30	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e490c72591da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000015f0cc4a3f1a114e42d5c938060c2a50d4551ff89176e489899a162d498af3ad000000000e80000000020000200000002f2722aed0b395c77e5c43c723ab7102df3cd5c5c96700a4420eea303ed34cb4900000009775abc2459950da804ccabe6c0b8a0f552f28e720730f89d5cceec4485a4007429c0ef818ee90a964b09dd7442069b320d078ebcaf02dfa8e9909f5a51452cd764b1190797e9325d4ac219bffcedc1f3b2e9ad61398ea13441070fc2b5d1486dc00ab950a06fd5040a7315ec3fbeb101c84418bae02a88aa5c867224e7a686b94110daa038d681895a484b7aefec30b400000009cbda40de5f6310d12222936b5e8c3381fbcaf2832d37cbe491193c5540c543cc8ddd4fd751efc206e255f048c6cf9f6db865e8c65c757165c1840a4252f63fd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2884	1996	iexplore.exe	28
PID 1996 wrote to memory of 2884	1996	iexplore.exe	28
PID 1996 wrote to memory of 2884	1996	iexplore.exe	28
PID 1996 wrote to memory of 2884	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libequalizer_plugin.dll.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a83cfc765d4d884704c75c0312b03725

SHA1
ee4c655c18aa94948cfe2c4d9608511b8ae46d68

SHA256
ca9115cb8f7d36834d5c2a063ec172763a5e417c2be1195d1f8fd85746f8943d

SHA512
8d2d05158a9b80583bfa898678019dc08c74a6a7f7a4cb5af83baf0fabf559d289f86ed90de348c0346efd47a72f743612fafe2480acbdfc25dcaa9cc24b795b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e999f334ade268ef3e4cceb8df748eb4

SHA1
c91ca2d54a9965d92c86adab96d2019886a72e37

SHA256
b1585e84a645f9193a7dc388896fa14c718a0a042df53981b94521b53a000bdf

SHA512
a5ebbfebb31b225918a4a8a0280a907c5375fe35eb2cf67b1f98957a604f6fe24456c3a15e36c04eb4506f3f2799e849762eea7c40379fb00d69679381ab09a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ea059e7482cc4744cd6fc5aa25083f7

SHA1
a55e4c7cb635ad69a7041f82c49fd293f8f19fa2

SHA256
e34a3a0afed10b837b90ffe59db12ef6e41aa0d72c110028614924e50da3a978

SHA512
fe0f08cf522177dbe508194b799a84eaec06763d1eed498f03168b8d3b58cf188855f83fbaf74ae583f7f2b0a2a9a0229daf5592641b639297d634c78017f793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f819cd3b4c1f42a40786bae8158943d

SHA1
221f0a196907ab6ff8b6f2ac76e9a11e17f01e44

SHA256
b70b445dcbd21989e9aa0d36882a479f693cb88bee5196cd54fe4543315ae62f

SHA512
757d4b7cc03cd5eedd5166bc699cbc29901aac4a99633b8fde76c9623d55eee3b6ef2814aae2f04353a2b0aa94c68948f1df18739714e883aeca8f533d24d391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
556946e3b69e273d744b98788667c519

SHA1
05367e06b53c2566f85a02f938ed4a7f864046a8

SHA256
4621d8cb59319f892df5a9259b72c940502d3cc963bc279aa0961e338cb25e82

SHA512
29573801895d1c88dd142dabe557415880e9dfb0c24ad108f53191951d4dfecc033b55fe1ffdcec22c10ede69a5f6df1cebd3358faf0cf8d00103136ae31a1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a723d36c51e540ff39919ef964c3044

SHA1
95f4bf1e799d11b500431a35e3600464252036f1

SHA256
9f99e8d0ea0dcdb72ac842ba0d1aaa4ecb07eed78c4404266a7f0c7921989c41

SHA512
5d9b8133eaabae4fcd7e4326674310f390ead3dfbd01ceb69a354d4ed60f55888efd74815a47711e16a83b41cc4c58df5487d84267a41e9440e310860666e478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb84576c7670b6968abd077dfbff725c

SHA1
a6be080583ac2604138a0401fb7000a93b151c36

SHA256
cfeef45269a93bb6b562237b98ad9738c52571ce3a57b0912dbdd070b0f1afd0

SHA512
48d5b3b425da1d3b114848deed824f174c30c41f4bb1ab92d8d51c96b262ae1cf8f360f9e4fd6af816b1cfedaa709406f70cc8f22bae71f315c02acd7f7579f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c5a808f6796db2ff0e5bd9f635676a9

SHA1
6c811a2ec68a0f0b678bb5fc2de5035665de3c26

SHA256
ab39e849ee856cbe48ca9e4f88e1c8ef7ac625f730d3e042ef9cf002bb0da54f

SHA512
d2cb593e0beded3f6d22a04fb272453531792d5deb928ff66a936d84c870d81b53ac775eff35866e52d99f49eb95e0d74fa52c77342e993168e2807bb8012862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
050ba8d09171cf7bb81f255e124f62e5

SHA1
45dc28dba7f2f80ed0c7cbbfdfbd8806f908da39

SHA256
c59bceaca853a322856303a044803831ddb088a2a15269913c9859c377114acb

SHA512
8082d7e8322ca40f8faf128995b7a103e176991a0425396039317b18e7667d52749b5e977825eb0ab6c1d266a5d21f2728782c15715ea449c73fc25b150d26de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
480d90b2508ee6733be90939117aaab0

SHA1
bda1f46e317089b6b12a5631aab11a6cae16fea6

SHA256
4bf8de931546f36fc5ed04eefa482ac5696430fc88ea1278c3e7907df717a705

SHA512
988efe4320ea39268fb038fbf5d1eb195544f28988bc68c7519a661a29c19255fcc6dcbf08cccdb5178650c1e7d0af1528dc11a99918bd9405f54040602861e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed2206b6cf0a53e871f5f3d8a64c2d3

SHA1
372bd15171b148ac5a5ee31b63c3e830863817fa

SHA256
66015c688cf798cf4d98d38bede09160e09580fe48fdd600f8b4ae05d98d538c

SHA512
e76125c9e11c2b503815276b864e9416d8b3e0acc87b90348587d65a71d2f3c511c269ada9d6a751a98d5dd2629d620efb09c0657562d7467a283322717f0922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5be6050f63109813f8022117040e31ce

SHA1
eef77df991ac7e43757eeb6f26df42ebad0bad2f

SHA256
8039d586ad844d220d1f99dbc61d2ee2c039ba2e2e985e1b9c2c61b0c4caf938

SHA512
9ffddff50f7f52ce6f63d5b9d915430fec3556649533e652312e0266ab3491a588f9b7d4836507539e4e4205ccb69f1ff6bc7aad04c9594c1062f524d4f58193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12af86f2f4695055e3e0dd3adde25d37

SHA1
1b3571f2a8b50ad25b540202a03c5d1e811d76d6

SHA256
b5f27500e619999e35cc7c6bf25e9b452e7e5904cc5611d99409749c9065304b

SHA512
15baadcf5f94300d9ea8c19489617ced31e56f5c24fc4fa3a2acacb3af77b90a5086e60fb8fb3695b0bf0373a9ade3b2386cc56877d66d60c56f98812e6d92b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5094934cea5dadb4bcd8503337844dfa

SHA1
452f3461061077f383734b6f0cca29dc1fcd6cbf

SHA256
0939d158522c5683ac435b7e8b372dd099ef80087adaff18bd003ff15cfca688

SHA512
b692c9cc308ad679ad420f45f3dde29c8b3116b228acdd6d9a6159203d6fda03563dc9f606faf7e6b101c9b912942cae4b59f53515159190a5ddf7f67bd85ff4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6031bf3cb92936384ec38fdbb956740b

SHA1
bc1fb8ed1348e1d8544ee6cf820cc5c9b65a41e4

SHA256
7f737c445567d9bedfd456903c458de22b36d805dbaffcab580065ef6b3a7fcd

SHA512
baf8679f800d180d62c46cfa8d1e2b09ca4ec5159e3582aa9e7420acf574606e30106596a5a12cc7191e13fcf531c4fb02c34f18909dda7c6193bb1e26e9fc38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ea27c0becb5b26eab4aba9750e44baa

SHA1
25e657e3172c3d01db4d3aee6a8c8485f1419e27

SHA256
33036dc09532eb6ce7828f663c218ac1f5e91aaf0ed1ebf52d84dec12649e57b

SHA512
e84fdd3f5b29e107ce47fa67c48012fdd1d04f00bd9adb8b3d12801f970eb1776ea8fe12587e5c1d85ec7536218fd87973c028753f36b4c5b90763f3bfde9e31

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4A8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD534.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit