6bf2fbe79946fa6c16e791091375fe73cb361bb9374b509e101958cf3cf9ce1e

Analysis

max time kernel
135s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 00:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libpacketizer_dirac_plugin.dll.html
Size

15KB
MD5

c5887718ea99085c151aa78e902aa867
SHA1

e303968b6733c2837dc6ca7aa59a34a23ba981ad
SHA256

6bf2fbe79946fa6c16e791091375fe73cb361bb9374b509e101958cf3cf9ce1e
SHA512

b80bf1ef128528ad3fd76963a5e84b071d7978775f770065b3078a8ad7d10c0f9f035d9cc1ec1650f4e866280586a9764e4e5005d7ab62d1d8cb632ba71bef23
SSDEEP

384:kpPMcMHyAcat+aRDcvXkvDZ3eH7HLJzl+Cq124kbrBZFE8uI:6PMcMHyAcat+aRDcvUvDZ3eH7HLtFE8B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000a7d796ca9617062c5fecb61efdbee7e886089773b15dcf2d6e8520983d948d5f000000000e8000000002000020000000073606801a4c1066c8a5465ddc18b924c7252b2eaec5418b74a7885767e94247900000001d742c71a2074815b1852d1b48c2b80f0f9724fa6d2ebd95be7895758dd3ae3c652b18869bed7bc198395e48567ef07a2d73bd9dd2edbdce92aac59f68e2d40b88ca5c1a33f1041a0d5442cca119eadd737fac07084f5f1cfb1e6b366ac6b1e513ef75fd731e4d3b091608994c3caabe48b397d87dd994ba4b0bc0879140d1b0f09bc189ce9c6b149072134eae32475a40000000c3c5cf3e8e44baef5fe83cb6f994633e4d680ef05e442a596e03fbd53cb6684593f90a07626863660ec3db22e71d560c325994afb31a115d865f7d03523865c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419562366"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000ef6ca5dfb60b09861b327ca2bce8e45e5800ffeb85a4bbe5ec7dad857e3b89e1000000000e8000000002000020000000ee25931384dc5f43b6ade6ed502fc03bc7ee52e5f5323bd033ba25824f119b8a2000000065d84cc1b46f7a515b08e82093c62d1df54295cdca71f514e1c2485ab6fb025540000000c159f48462e3f7a49c8b1d5fbe65b09dc796a06c609f0dc3301febe22a82ed072330d3157adcfc90b44cfc927400802db66cc258da921f24cbe3ee356fb5c9a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0e311502891da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B7B98D1-FD1B-11EE-86DB-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2348	2388	iexplore.exe	28
PID 2388 wrote to memory of 2348	2388	iexplore.exe	28
PID 2388 wrote to memory of 2348	2388	iexplore.exe	28
PID 2388 wrote to memory of 2348	2388	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libpacketizer_dirac_plugin.dll.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051556d30c70c5269e742e6f51cdf5d5

SHA1
b6553af8a13a04be62ad261094959f447942b9b9

SHA256
dd7f0d5edcb510126ee5e42c4dfef8a752e6284130cac1972c66e2d0f7ade38c

SHA512
2ebf695fcfd4a51b4a007bdb1aaaf4d7548081b2a0470eded71aa13eb94104a27961cfd4a7e47b7c7d1048c7ac254065469ab8f8d66cd8b4b383b58b858d7cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee84fff47b52c0807f9cf1f0aa284a6

SHA1
9a1503c16e0acf0b8043c6871cb4a8aca151723a

SHA256
443c1d3977b4a910ad197c9e7958885c00f4b34891aaa67d63e3d29c68ed6c7b

SHA512
f43780ea3fa1c542b55ceb6f05cf9bff18badb7e9500f70fc4dad619517f99aa90853985045af1ae64b472219476eb335bacbc5e9f0faa3e85d79e009c49eba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21481a7fce2ecaf504b7cec770242919

SHA1
415baa2fa04a625ca7e3483985ab55a68c2d38a2

SHA256
2beeb1b1f25cbf65d1e920698c003552edd24284811ae92ce959e2a2bf5b13a4

SHA512
3451fad66da7aeb58d55546d794bc2ce2899a4c30a1e84ca944d6778d9954dfc1a9ce3a416671054ef0883987bbac785a69b5a32eb26ae6bbe8f594e96197f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c879d6bb445709a79f465c89ecef4a1e

SHA1
15a53f16c40bdae23759c51ac6c7ac1cca6e3f2b

SHA256
0e616b7b61de9d38eec5024c63f8c6686fb9fe7b41d70fe96f1786fe5dd2041c

SHA512
30571565d817bbaa0a1366332ea486ff98414d6859deeb98d962f59d1843ba60d613a8b79b9ca1078e62142ad46eea7cd4907c48f0246de93c7feec26ac471c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9dabe102ad055b58f7cc529c2ef1d3c

SHA1
d49c4390e999c0154fb69c63a58e70c69d807f1c

SHA256
16def614445fd8f72a911485dbcd2d809a229588ef75d085da2343f6931fd75d

SHA512
d123e3646b9d6e5f656d9cd1715e3338f235ca4fbac50cdd8a26956dbfe8b21e9b9e5255c5cbeca4b2b3af09432287fdfd62630fbc7eed27913934cac627d713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
121dd034542d28c6af0fe2c93b4d5d26

SHA1
3dbe6c64a074b0d10c5fa3f7be6d6de274455ed9

SHA256
2a096eb65ce7e7c3160d181a29aa9e33703bed8732390cc5b0333758023c8311

SHA512
cac6c99bc58a02650ca1802ca9d8712a4ee52b498bbe62b92fda2779cfe6e073d87477b04a6643cbcd0fd23b680407401ca44b6410a07e99963f31c0089c5c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f6cb19e9780b20538e65708f358b6c5

SHA1
b0f1394eaccc0f8038a03c87005d871f2e212e03

SHA256
c93eaf3fb713ea2eb277dff8a291054a1ff1e9e1865bf9700f125f637ab8db01

SHA512
81b913f7f75fb2c50567a3752840d64c1a18406107429249ad1360b4954f89abb77c820b4054f468c6e1da229c6d98e96f38e2d7d0e49e127f2e07e4fdbfcc85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9766ab1852e2b007883d252339e559ba

SHA1
76e91e54562b261399517c4c16d8bd0ee06df7ef

SHA256
d7809b515900ba3f5c8fa32eb8eaae16e4db960573bf63509707c01d0d6e3d41

SHA512
42c020794ed2a9c8eea159bac16ab4ac1b5633f36bd13b33c38a697cecabaeac4c3c4fd39289229b2934f04e14bfee4aaccb4bc7a1318dce651fe06dcb1b0651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
281ec874cf7435f96b9ca26475dba669

SHA1
e4bcc0f3061942d4f2647e73b036b64500e70498

SHA256
58017627028bca851902e08baff0f472e4ba136ddb6b3158bf6e40a72b31ede6

SHA512
495875c855da91805ec8e79cf3cb7f73aaf220404794be98195bf55cd942221084e20776049c1f237f5ea0a319e35a982f5337aae267238541f6c485e5d36cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5614e4fc33b0bd1ff0b578c51ebb0a8a

SHA1
e7b71d044af94a4723b54d7b4d3fff7a21687186

SHA256
c8cbd5ff03fdaab637e6c1b6b5422736a15734b977394e8029505e6644e1ba27

SHA512
6156ddb78bf16e60303acf34f463fa1e52e840d9c50b89392cefb9c2185d3c864107ec900ae9f3e14511e1deb2acfd249dec243796570b79e9e42de19a52171e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
813ab83d1facb703c6de833a42de4357

SHA1
c9b8c2033dcf26f9dc304e237b7dd9d4b79c40f8

SHA256
c2a8d0c06a47f6935bda78253403b53a1c81edc484ad862798723f1ad765281b

SHA512
18fda4273af97dce71fbb6a18a49c4ffacb9b61218f1fd75fba55eb7ba3629a0de0ed70d76ec839edcc69621c12833f1f56f34aa46f03d24009848d51903cd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57f6edda666cd3b473a87579746f677

SHA1
aa3e318aa957116929bd957a34fe28299fb31773

SHA256
3b26261aacf85f9b21cfc963c06faa568f7ca2fba976a09848d24edc52174f4f

SHA512
fb948adf7bde7e4cf87ef8e3b31c2c1e4ad87d05c7ed0cee700580996efe4227e2c9e978d8e8cd50b70e801cca32b0f5b7195281f1796dd9df719eeec2b8443e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8f9265d5982068f5541141c72587d11

SHA1
7c02b39033fdb0ba253ee0892964bfac11028f29

SHA256
7871c0f2ea1baf0f50db4dd28bf4c51062726e9a198e5e1658a9e66f4f9f336b

SHA512
9dd70f322bd914a13fb380306c31fe2d8c318ab65e18380802fa6a4176b6fdd02e02e979eeb6b50ed29f2bca99b6bb921c89c091a6bdf17d23f3ad3ebd5f6b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F5D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3068.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar307D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit