a9386c22392b60e57ea375b578ea0b19155ff6c2370d50a0391a91d297db8848

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libmemcpymmx_plugin.dll.html
Size

7KB
MD5

1092d429bbb475dab2dbbc5e73f32a1d
SHA1

c6c4dd1a94cf70a1ada5bef1c8ae2e0d75e82049
SHA256

a9386c22392b60e57ea375b578ea0b19155ff6c2370d50a0391a91d297db8848
SHA512

d57eb382b6c3e7d2feea1229a92ccbb528e999423f4393a0d39847ca8e356fc87d622e32bea1577e0bcb012c3c8d57e59bd329cc9b781232f43efbe19c4cbe35
SSDEEP

192:Z6vTPMcMHyjvYvpviIvYvCzvMXtv3v5B/lo3CvSvnvnGvXvYjvnvdUQE8uI:Z2PMcMHyHZX9/YE8uI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6BC1AB1-FD1A-11EE-85E5-5A791E92BC44} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70332c8c2791da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419562035"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000003c2b4092d0d0fd8a90365632a14b7ac46938e43c8452923aa4afb67b81d3a0d000000000e80000000020000200000000f4bd7d5f94fe35385ea4e0ebf365932fdf35983c2d2a7a9ada9dda225f16e9a20000000cf04d7ec37dc2491705f03e7f40be5c6604281bef8e7c8358a8bb02c1218c5f840000000edf03cfbd17e94dae57b180d4f4351594f7ce642ba9dab65721997bd7023c9d02b2d7650b2e5f4f0071dc7bdbf354f70961a03218baa970301b939250806c4ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000a9bd2ffe618b68374e75870bf96dda5193a4b34c0d8cc02d6835076885ec300b000000000e8000000002000020000000b530f4403e4c7047fad8cc277f8d4c309e0c2f14a1c1842a94b04427eecea446900000003254e04789e790c4ca1927efdf8ebf4cdeb3972596ed2a43737575aee09fa4a116db6a41d2d1418de5ad5abde2e8ec66380d5bd80a39df153ae8b8a9b504696dfabdd9a9c67d3acc398bc723b730e2e75002e2dc3fd3709e8178354c8ef92d46346a4a70e59eb6ba13bba8b202d75407e2ae93d4164fe7cf60a38789a20235b3fef59a20adbddfd3c3b62c34289f6b52400000000f422387f7d1fccc11997edb48665e9cb08b08f640190cd71f5443483fafb1ea79211bc8ee6072e49ac37d46c4c135f51b7505d3ea6b6fc953e2c823ebf1fb5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2516	2168	iexplore.exe	28
PID 2168 wrote to memory of 2516	2168	iexplore.exe	28
PID 2168 wrote to memory of 2516	2168	iexplore.exe	28
PID 2168 wrote to memory of 2516	2168	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libmemcpymmx_plugin.dll.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4ab9559a1dd9df96b45bedc1b84f054e

SHA1
ed686cbaecbd427300d7a91511a6f87e894a3560

SHA256
a8f5ff54058a0177f167d2215fa8d0cd2af0354a2a5a442a302e47213599397f

SHA512
9e867968e7b40755257c5d20b53fa2d8fe957190b826665b8e303112943fc7e8493e88c6c126d5eaedcf6018082d59f0734cce478d840139ff4e364828d13c4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffab5affed6be6b5461d7e6698580772

SHA1
d7e3c0a4e93d2efcd4278405d14eb0e52a306cb5

SHA256
f01e74ed097ec401533b3e2b4f14cfbc92097cfae3742086f2297e489e5e7ee0

SHA512
1936402182601fd50dd9b83afbfe57d9714f6c975a148944b70eb138c93d9e560bbab01ad4a21f9b4a4aa655131f457557acd8bd16c0e9ce6ed1400737224901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b379cf8a73c8ee15dc0fcd0e06a967b3

SHA1
f8f24f5b574e05e350f45240ea59106260b999c0

SHA256
ff141957198b23563982e96a573b74bb222aa675f00938b07bd0690d82ae57b6

SHA512
68127e7627478eb1d93ab4bf6807066b1fc23d548aafa8de7874efcb124999739394864e7b70ca603edcc8d4e7584f725482100c6ea016e8d2c9e1695bc4a3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
363d6fe3c74f3442edd640d426b91d80

SHA1
d7cbd970f42a5e574ed3ea2b9fb0502959a5ea92

SHA256
eab25fbf1e2f27617dbd3eea82ada69b263b7d1010dde29ca86b56eb917a74eb

SHA512
b5132df97ebe5f7c89f3279b66b3411d2879dc378db2f6c5342ff06b9d0bf6f0b1af34a1e2c3221744dc6ac058108a4c6e73efd1f76163518c2e3ba2c22faf30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b0d1f99186642388895de7b044bb268

SHA1
435dd4d78650c679b7dd717b35cde373e4d742a3

SHA256
196425525aa1ece3c0d21fdaf1801b6de1600a0daf0a556432af618105fe8206

SHA512
49a321f0462774222603cee7d9604a934affabf18613a7f60214d1e470c95766195b9953a590fab103b333b248912765deb5d74547c5837bb5a4013e98ec0cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f85f0bceb15c2332af07848c64eb2498

SHA1
ba0b48458f348b6cf83d6d5a5af74bf797c1d6c5

SHA256
b4f2521bbc3fb90a0514d23a1fc8f627b1adb36b273f850940f598824603b60f

SHA512
b75abb7b9cbad00f0caec45e0eecace4e0648f0544e17d9fc130e11fe7981faa9086d8a829e1ab963574396446612728a04e6e6c6eaa6d9c1bbb59e02d216880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd15d8f3d7eca86f06368a21e2df964

SHA1
baaab4abf3a4f2c17db822ea1e6e3b0dd0e5866d

SHA256
3d7885bd33786f243ab4743610ddc8dae53bbc7030c0fc31248bfcdd5f9807a5

SHA512
6df40aa3726d3d5499fba40794ad4d44b937306ff842b8cbb78731dd13a617289ccfc0316ccf61352b0ce3786437a6011c5733797b5d23f5e9ff64a9ac7f3fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9278cba154950f74dcac05b6db1b8fbf

SHA1
74e2881eb8069c387a51758bec00a87be1a5c13d

SHA256
8940a459fcbb6a77e0f351c2e0b536d651611f3fe5c635dc23ebaecd08c621d3

SHA512
9363342e53e7e158edcae454673a7508c1c223b2dfb314bdecee6c320ab05de6ec039988b45233512f2bd7d7f0301ae1f8be9416c84912fc4db55dff42f1c626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
130814201221f5aba414755ebaef201b

SHA1
8b429d2b2fe8584d63654a777a1eba32027526d3

SHA256
0d9f47859d987911a0a20d8cc0086bae55f1f837d6b44601a150d3db1512e115

SHA512
710ab65d2d5595e0f58bedf1da0482cc53aef33e0738ddac9f4f70b43439e46172f35aa19259cec7a481be59518ae71b156aa1e4dd13499b2beedd1cf7f7fca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b648d6b6cd33a00a93a697eb337344d

SHA1
11192ccc77ac7bf2dbfbb386b5312924459e2fc1

SHA256
af65355f4f0fd05ea0f1cba69afb3d485d95e15708b0de7ba5de6124e7a860cf

SHA512
4058fc83ca5672d791a932b34ac5ffc4540f1c176f9311701f00b32e870db5beac2e51ffbfec1fa40d53e2a2535becea4363676f0a0cd9a48ddb234589b2f7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
968f6fa2ae6d9e3e015cc5032855699a

SHA1
f8833d236426ba4ab74fcd5e463f8ff837c16098

SHA256
c4c50cf343457e7990101dccccdf23e085a0160a91d8841c732ee0bbffa3e5c5

SHA512
ef280ddb922a55d7b57ac1bebea0eb5e9d75f618370a1f350fc0c42c96a0e9cb5360b612ccd4404140271ededf6f65ff99a6af30687147259b8184eae37259da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6833b8196d3affba7cf03fe5dcf1c764

SHA1
31d93384ec51fef9690b327b87a3b12b71c812d9

SHA256
bc1a8e3f65e6ce6e30682d398b0418c403fd9986e311cbf257fed1cc4835106d

SHA512
cbd7fb19513d8f90ab8195747ba646900ee192f368fa7eb29a9aea28c11a760c2150b0f46b44b405ec371174e8ea018ec2cf222e75f3a0b9882a905912480a82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bad21bc44411dd3e1df211a4357c3919

SHA1
fa7395a8ef087c84a0775615c10b65b7369577d7

SHA256
b2a3d723573520d92f74247d44640c8d2035f6286f8ac10e93cc86288720ca34

SHA512
e20a9b079d8ca3f223ddd9da1e59ef8c415028206863f4682fceb56a1e86de0c2c96c41db9cbd4ccf2ba3febf4e3a32fc16c07cc0c627b53cad7293095752bc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E1D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9DDF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit