Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
libmotiondetect_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libmotiondetect_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Resource
win10v2004-20240412-en
General
-
Target
libmotiondetect_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
-
Size
7KB
-
MD5
61a44327c17f354c92e9fd84bf8dbcc7
-
SHA1
ab5061b9e23c552ed202c462cb7117bc0de3a4e0
-
SHA256
16797866ad9eb745d1a0d5ff610d088459ef99cf30af3c89fcc2ee4a84cde846
-
SHA512
4b226a73a038ddc438f45c025c3ef2ee77e6b7a8788149c19b12059c8dcbf024720ec7aea2fff4d8ded8465dce1c389e12ab94df05e7f63f8b797181d52fb046
-
SSDEEP
192:ZmvTPMcMHyx1/vsv/6v/d8v/vvCBv0mXHP5BxUwv/ivST/lo3f/vvMv/Uvvv1vlO:ZaPMcMHyx1CIdiPmXHP5BxUmrT/2qe6N
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001a5e9d8e23a2d4c0c54407fec3042236311a15d512dc6612a3902cd43a14dc8e000000000e8000000002000020000000a16c0f056caec1ce25092b7866f3396e2eef95c0ea3c675de82af5a7f171a46320000000c931409bf7248e1e5206e21f96c40f4041623945eea5cfe579f750ad8e8d9981400000005487cee55dc207d4c2a330ee2e20865ad1a392ee1fb2d83e50f355697d383b6740b3bdc40110d352945453dad64070005a0e5d02468d395696bfb9002597940d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5091c28a2791da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6308C21-FD1A-11EE-995F-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419562034" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000048353d6a8758aa855da9b756ad00e702b4de9fff2e5bd416f9ac793170031ec8000000000e8000000002000020000000263120427babcf166ae27f8d860547bbdfd24fd6a42659047b330d74b7d673549000000038162ec14fdd74d83216510884439c9c5e4defbd16506a0ddda117b3b886a15b12fa0bb380682bfa1e4f5f1d46c5d2ce998c00761c6385f8d2ac8c94dd1782302dc1a71186f2f68463d763b7bed6de75a4d0432894b420d237ccdbb8dc79a78f34a8949c596b0c586087b240028d39ee6047cfb459e406e36bfbae0230be00455ee4c19e8119d46a82870a00290bb1674000000062e89ee64c12b6685e3075d6c10435dbc44e0e2adfc1a175daa4f79344c66967955cc1028d2581706f09d3363ea0358556c98563c6385525c710f2395587e683 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2952 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2952 iexplore.exe 2952 iexplore.exe 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE 2484 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2952 wrote to memory of 2484 2952 iexplore.exe 28 PID 2952 wrote to memory of 2484 2952 iexplore.exe 28 PID 2952 wrote to memory of 2484 2952 iexplore.exe 28 PID 2952 wrote to memory of 2484 2952 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libmotiondetect_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5163cadd2f2942176d4b579ddc4b68f77
SHA1dbbec4fdb17853a26b95015687b5ff76f56c5958
SHA25655e59ab806f6dd1d681cd62ea15c215ff83f381d17ad5b7f3b5375865bf05530
SHA512fbc5ad18c3de581fca625f5a703f936e04c0b3a302863a6d473030ed9b02591d425883e267ea4dc36a774d43f46e1a220a1e1adc97cefffb5a72e8759994a23e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a64da9f2438f4cb48555a081da91aeb
SHA18be4a9649597acbc5fe60bad81d606f28391ad57
SHA256ca08fe54523367e51486a658b3e2361fee62da72c2ec95cb1294b231fb6815df
SHA512c727eafd2f347ad71511fcdbe7a7bccfd412e23e907520320650d24467b9522620b9be3056619d2b90250d0caa90c24a2e87754b66bce4076de27c35293a0119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cd577ae0c14073439ed25dfb7621f96
SHA15fd95915c0841dacb1c6bd45b995af0bf0040f7a
SHA25634d8366cb14cbace7b8870137a2904b65f53b4914e95b46c2fe9ad6502bd2f12
SHA5124cb460a7f91cc3f4297942d1d13b08644e2b850c98957169ba120407349488b50b0c765c86d3126b178b05d36040cf8f21dd30e4555f2af26f1fae17f2db5f9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bf865c0cc56c26d548b47f9be65cedf
SHA1df4549702d37022e93dcf4aafc5f59359719baf6
SHA25699cf60299c9caaf989dd364743f884ab734c0cb2db9de2c7dd5e625bde3095c1
SHA512b903cd537df9850394532674b02757b5a4b6f6c87156a8bb9c1febbc6d25b03a90b1a4d11d1249e19dcc2bd80a8707af53942953f0f262f95eb448d39d2195d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd0b422ba52e7eae54d7c0e606182d76
SHA1fccb1a9aaea8bf3745afb6b717f7eec0741e02b9
SHA2565058ca9fe55b5c04bcb179850fd764ccc812a788c6b3010f06ad32f91f70a21a
SHA5128d064fccbdb4d188956296ca5952cdf1b15d009ac07ffafabd078924bed27f32b88b799bd87cdfaf88505cd36391cb920c58ff54546460105288f4c92a4421b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e2243dc596444e90fa0c79ea105bc72
SHA1f49bdf21a6df4f3d78b6b5dc9af0c4e389ae9c41
SHA256bef03e6ea01c69900bc681def5f0c8baaae7f1c6261ffba257318feb48731ccf
SHA5129fcddb304594397c048a48e6cdfb94a0ba2cf2d6021260dd590a71fe9ab3182ff6ffd87b52397e33f0daa89bdf9d70b45d2327d6b6ed4a8bc35aef802736cb09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a621feacdba65bc3db0d6c7dafd7ab4d
SHA11a9678a0ad4af1d4a10d80c90a0344adf0285fd9
SHA2567cf3e1ca01174cfdd29076f3c4bb7ef3a8eb57604676bd90acfc0eb540d64e42
SHA5123050d4b6fcb4fa3c8bfefb62a20af95ec3ad20de194457374bcbec59837a9acf44fd8abab341ad984e88c92e1010ef47db5804385e3d50eaeb255cbfe7cbe54b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b306216145eae6b7a599c2d93ea81411
SHA1849bed15cc659c391dbb26a19d7e5bc4d5e74378
SHA256291626cc4d5e231af173f422cf5775689ec32f5ebc30ad812fb9aec0e39d8c2f
SHA51219a84b7f1d6f30979b1049541b39452bfd6facbea0fe3039a4e5e8e2bb0bab07a82c0267409e66b1fc010d44ed7bbbccf893d60950cd57a4f178cded35ad36b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb6f954e7b0b832876bc6ba61068575c
SHA1856d565c09df65bd1edeaa0062435bb17b13e614
SHA2569208265a0da0707f7541be90d7c73212f77b4310ba174974a7ba2c3e6980bb91
SHA5122ac32e84d49b463f6c367e683e1d3df898ba1353854b6173dba7c7ac26c7801062a68a3a457398d803f5bf093f443de8b6ba9cdf93414d6f1f2a100350b8fbff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5505c2ad4cae78d34a4a6ed0adb2b0006
SHA116197df9c740d3d0ce846e27d4a3b8cfdcfd78b5
SHA256d9c1be682e6c8c404cbb525c42c8b498219418c9ffa0c5e5ee807fd7f0c64e3f
SHA5121cb72a5af6f77135be5afe6c548f6201fe417039be3a128f8ba982978b3670971c66b338c03688c1bab604f113cc2885087bee6b04b98e95c90a35c33a089243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb9e7bb6e6988ce119eca6b70734e73d
SHA14540ac07b31aaa0a6bf866a5001102837e72e3fc
SHA256e9ec290b5c70639f746bee4086bdf43369651728429f90cda036ca82790c4e27
SHA5127a9af1466a4a54370849f16cfea31aa279224000b886bf877872e14a2679969a74dc9c077e730981762f7e95880572ee207a1c3ed180bf30a407937e8086aff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5198105b03fa4d461b708e3c34a7c06b4
SHA139a1d3a99e05a7c16e36bc61e4e8ad6d146e881b
SHA2566bc5778d72c1f8cf47ff5695e1677f67753ab3149cf0a3cbe623a4286bb82e56
SHA512a92b8555c7989c97f5b7bfada66389bc232bdf33cef7edcce6f71ea4d723c0b07bd2143ac46f40ab5a107fc5334050efc5a58f4d3f778e39a1ebaab5827a9885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf8e53b055bf3b4482276d6a49d7e2ca
SHA1dae2ff286c018c621cf69d7b1514b97b8253bdba
SHA256809a9543f32460b7f88fd1190f799eb3b151337e4a1f73e127e07dc9ffe00e56
SHA5125d5bf396fb7a8a359c40277e8aab9c76f528b7f3b8b4196ce9162fb4a449405af04f5adbaef4e1e7377543d8fc234dcb5524c0f7d529c7a0549dd4450c6f40c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574443aa8d36bede38ba9d720eecb046e
SHA1c40eeb318ec3eac38b06015a286afeddf8254776
SHA256eb17345696a44520712eaeb1a046bde36a0235bec928c002e60a31dab86e1422
SHA51295ff4ec005dabdd93a9314cc05bc6a59d94ed985d59785c079a559cab72bb5f48e29c41421bc07213a1653d33af84abcc7c1672e2252d0ec0a285d8f582c9014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50670a6beb53d03e5646ad49c2834dcdf
SHA1e797c6dc412c63c445a1126376f57eaf277f3a86
SHA2560aa61273d339290b7e4115075f9246b89eca0cbecf50bda32584143f0f702f55
SHA512923411ec872b99d2e8e2821438d25178aa7e6deb41ddd72bc11a8eee32f17642f7ba074b03cf16aa51e0e17599aa4ebe8bd8ea7e0cf9de515d52863826036815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574ab57773c49709e081c465d9160a233
SHA155b3c80423827f0bb2e5f2b0d0a82de0c2103f74
SHA25691b9927d5298bce520986c1df28b0acac4a0eb8060c6f07396052d77e2922fd8
SHA512d439f5ed5a66700b5f53d84eabe7f8b5976427e01845fa8091f61d88cd8dfeb86eb5fe520f4e2ac8b89cded9c54cd90ef7a4324b1f7d092f0acaef62005aa2a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ca45f772d1232f6ade38f7b9de59c77
SHA1a38b06e6ea21070703108410a5d413b88c8cac49
SHA256dfed5b77d723f7cfedc920424f607bcd8fd501838c4005c01201b565a24eff3d
SHA512b322d764691020fda0bd62aea6f6be541828669f3c5476bf19ebeda190b34674bb100f9347c448326de5b3c0448a4f20aabd24df5b07b39f9cae48777aac0d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fb948cbd94a1a0b0d8fa1b5b0af1cf4
SHA145f9b48ce5f6c5dc5f819d6df196229522fd8dd7
SHA2568ead9a2f861acacf499991cd19e019186782d663f200af6b32a9177ca8151204
SHA5128a87403927a3a7e9cd76b39065f90956fd9acda2377c5b41b82e1947a35aae55b47e8203ded063cecb173468f2ac8595e9380eb6c56d59d090f866d002de7454
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a