Analysis
-
max time kernel
136s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 00:33
Static task
static1
Behavioral task
behavioral1
Sample
libplaylist_plugin.dll.html
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
libplaylist_plugin.dll.html
Resource
win10v2004-20240226-en
General
-
Target
libplaylist_plugin.dll.html
-
Size
7KB
-
MD5
ab61ee8b8744c640e43cb63076e45070
-
SHA1
84fb3d025c6df81e34159eaa9be3d43f417fce16
-
SHA256
2333ca819878c6fa96a5cf3feffc8812fa24d3912b1c1ddbc7575f79c8dfb081
-
SHA512
1705cb2800e54421bd26a3033b982bb7b5cf2d3575a9fe273857dbeab0e9922ba5d7394335e832fe01af3ca211088b12d1ae44b81925eaae8530cc32280d49ee
-
SSDEEP
192:ZzvTPMcMHyx1Kvtv/Pv/ddv/avC4v0mXHP5BxSXv/9vST/lo3fKvvNv/FvL/vUvO:Z/PMcMHyx1a/dVRmXHP5BxS3gT/2aGEN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80dbc59d2891da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000007c24c247558da4bde56261fadf0a4f8d4ee7907b6a9454fa98b43690b13096f0000000000e8000000002000020000000bc0406014cd633048c0f4c033be4d2dea050281bde9433017801e00039d7a2aa90000000d4f5ffb7e688e1b1f03ab041b1fa4b1e69f295cb971754d3701fe6a605773d234b9bcb8924e2373070acb3afd3a678beb4afc060634e446f3391209965f3e67405c47b90e32af26218eab8ecbc2e0bcb2952ec7e86e99a44b7e99617bb6b105e356a98257c6e0d237fb29423a00188c8c445aec1c4d12da1cab54e0a976dc13768bd0c6c707cf566ae93aa9c91ff71ad400000007d85fdd2d9ded93b87dc7cc8e2ee34d68b8b2dcbaa2a0405fa0d25b7f9d73a5e181e1fdca97703dee3340ccf3704555043c86af75bfb2c90381f8344d6fcf49f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C845F3E1-FD1B-11EE-A619-5EEEAFBF1CDE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419562496" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000b00afd2322514a4fd2182012a81c4aafd66bdc9e5c46ab38e275b07f50565717000000000e8000000002000020000000e6a73a338c46a70b0edc37dab6b1f9214a395420f9621ad93e65db113d5336a62000000081d57dd969e79ff2cb3551b986dcad20e6777f3b626a70728f3ee3c1937f71cc40000000efc5c4bbb9c6d78f32ee2826870666b1bd5213329cb3cc4bbb4e342950eb07f19ce7c70ed305671aeeb47653eff82d3300d1c6dcc2d1157dd6906b16607cef84 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1676 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1676 iexplore.exe 1676 iexplore.exe 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE 3060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3060 1676 iexplore.exe 28 PID 1676 wrote to memory of 3060 1676 iexplore.exe 28 PID 1676 wrote to memory of 3060 1676 iexplore.exe 28 PID 1676 wrote to memory of 3060 1676 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libplaylist_plugin.dll.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af2357207691bb493a5ba5cabac7206
SHA1319bd267f30344d97d0f0a65f99c870d8b4dd3ad
SHA25640a093abd8429d5a2f8cb04fc4f0332e1ee728e6c532f0fbef160683d3bc9bc0
SHA512000c0fcc9702e411785920768f2e3214ab725c7964b52defbf9407245274eae36d66d4bec0f02611405e08709e6e415c75a60f4ecb27d1e98f9d1241e4d51a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b0a4fce6849a7fbd4d11ea0be471188
SHA193b4280398c0463ddeae6295bc9f532facb44bf7
SHA25635a92841adba0c7be345e0dfaccfa3a42015d66d3a5ab2dcebdc5e5d528cc6e6
SHA51225b6bd6a0647c3aa185a1e70127beea8e0d8646fdd313ebe4031d2e8b9312d7280918428db1591829dc6c4187f3c6997004dcbc7681cb181813632576a11163c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e29f1ff30954f388fb2ecf44ff9afae4
SHA18b2748047002ab91bbe1946e48ccc36aa1b9d325
SHA2564a284af12aced4baa86271e446788cc7013253ec820dbae9f3266730d4b2b8fa
SHA512bae5570c6c4ac48d454acc04f7f066aeb0ad5290ed084d18af12fa05ef789fe8f3c94aa5f42cd8e45b971129ce84f505a7145c9bfb5ddc83dc0a5ad74bacb559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f1180d94b845e629d9acf44999cd349
SHA1aa5d6b1a3efa57bb49e2c68af3ab0f607c1b9c37
SHA2566bb43eda19509fee46ab0352ef77d4cb19633f4b80b7416db57579d68d7611ff
SHA51219f2e5122f2e3916a4a7fb8fe7b50b01e400fe75c992caf2e9f6e11ac0b793cb23958ed1580c60ca4e0d52a598f0b9e79709c5d051be346d197c982b5d1a1490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573361b348f409b63d557e7e933ba52ba
SHA1f636055dafdcaf424dca3c6bc1cb72197c403f96
SHA256cdea1d4fbf2ab7b1883ccf9f298dc158d646cf2d25c0c13ecb3a90aaf55b7a69
SHA512642d82334fb39e02fcdbaa6d0cda05b51dd680e95e839124fe00b7586a6f29f03fa7a011dd2f54ec348261a1276f9d909574c535ccccae6218b4a1c5a422f622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f4a7d3a906de1f99e2de3b594279717
SHA138cc849738ff9da27e93d4294d98f20304fa5c05
SHA2564f87248020c6563c2fe101c2b4a44cee473e84ede78ee1b8566b859d286210cc
SHA5123c1d48ab18850f24c30dc4ed475d44338431574789a7126fa098c04f34a1d86478ffdd612809dd7c5e575520b848d2f04ed271749d694ad13b599b210d57f3fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f957e8dd0c2adb57cb55f2d65931cb65
SHA1076dd9c30c4a6c9b31a09ebd67d4a6deb84dca3e
SHA256cf5b1b446c5ff7f20f60c5e8eaff28d7144ceba02eb3f2af1a4470b779f814d9
SHA5123a1ce19a4cde4840b59dba95d401d02c3b923b1db1532d94ec7c690f2e9a9d68bd1014ed6d56de73f36c7afe6f6163f257b68485c7ea1fcea83e917fb1971ca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dec42b7dd1c98e7b8a7340aaf5bb39a2
SHA14762cbac21929089437048be2c552e304408344e
SHA25643bbfb0d7a4696944092319168724d42600f79bf17f4ec767ee4ccb1a31c0422
SHA51296d1881df3891410cddecbd021bc08c27fb61dceb13c100e362666aaa7b064e15ba82885293dda54ae81ff5cb15aabfedf2236e736225b41f72f9a6341b15243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5496b348c4f2283924e89c8afec0e44d1
SHA133c985cc535332a4174342eb5a4539eba0e0a22b
SHA2567c5053943e21ea2582bdc8e7d08aee42abda24bbc3d390726da74adb867758bb
SHA512202b98ee83a0b724c39f27954cb99242589f25c90d4436e4cc5a628f5ff51515fc72d3f7c9f95310ebc06342040bbcf88aff3917bddc26040836358f48ab07dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d8080e706e84af240e63bb480cf2f1c
SHA166c2b0acf97c89cca805c5a56b4fc11b94f9d2ff
SHA256067ce3a548b3915c4b645e8e5e21d98e4f587cd4f07b3bcdfff066769e23e2f9
SHA5121d5ad8755fbdf88b767292b2edbaf50162f12fae521cc538cb775af8858c4e87b8fd33aa2e8b62d7741d432d98b22c752e30fce47e2f74187e9a716f6411db80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557dc8806bec7b8fe3af822b6c7bc16bc
SHA14e4e967164167e33376f40b2686849955f7c8045
SHA256be417be37a95a54c1e27a383babf5803620c648e18fee319422486f5a4748f92
SHA5129533a17bdb06e98fc589dfbcccc7311ef58e793c6a537207717d519a0f8986d326eb7ae77de278d46d503312e903609b5729a8eba9a5fca57eb860b17078737e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af30541defd62dddfd503b3894086b62
SHA16f4950bded7c5fa254984aaa98d239cbe05429cb
SHA25645375ed20c98e92f36028f7d49ae950845fa3dcbc46676188d169ab30fe2b211
SHA512be7d136c23651287729ae2354e232050b26a89b0ac6ec5ba4495f893cd1f271b7409d4210bc640208a5cbb45eb7e1d40458aa53e093e23c849de599c28f2cbfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cd22a6bc3ab17c1c80c21a8ea55804f
SHA11ce5e7c29b63724b8d6a84c9005548bbe7e9f882
SHA25696c6ecdfddbbf9177691c0fa1ea313bc750fa519f8879a39f1f004f194547363
SHA512aca8d34884ef42e66bd97a1437b01cc037bfa3fb4166378564e28499417b12972d2e58f70fca9394fd7cc0aa527c204b9b8f5f3831f27fe4a6c16a10c0186c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a79f8402545c8c6afd7b24145889756d
SHA143234e718b938e1512b49545843f0ff7a2f3d9aa
SHA2565f4b5a43fdca1ed76f41cceb28b9974710b9e8fa14fec52f927f3dacc6fbc8b7
SHA512c45b33c47b771ddf8348759fd93001edf6fbef27acd9d890de359798c4edf460fbd7fa4dab911e5770d319fed9f1a4bfb055b6092eda55171e1717bfa1b5ad96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569ce0b631feb17efed1dad97d370d4f5
SHA1dc967da82a9a4d8c0e6346351c9877df1bef0177
SHA2565f3f4eaf53666ea0f8e474cb4f0c327334d48b50b2f35de692d2b6c68fda6d3b
SHA5120c2581b95b0d072ecdad7c31a00e0c4456a55b02dac6d0eb9b01fef574ea9f8129d51e1a3fb926e90650afad56ea18ccb7cae0b7e65226f5c1d5f7fd23ed6d09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536bf2e0e8ec42fcf56bb9f66a20e2105
SHA1b857d59daad02e8ff28a8b89ea57590955261155
SHA2568f2f6fea28138310aa4fd83999b48ed7f986fd1364d4b50337f2775aad91cf84
SHA51226b3746a2c5f34dfa04cfe445bee924343256c757b7e58b49335cb0db4dad38bfc4d12b6de9a6b44c1874482ab9b9486e501a91276b310edf6ed842c26f73072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7e01645e654ce0160cb19ed71107354
SHA189ed76301200bb52ce41fbb89a50677f3fb658de
SHA256883ed6d0bbcdbcafc2bb1ed396bb60f48e5795b009617c1375c47961e5f0bcdc
SHA512e259716c11a7ca254a0ef4221da042bd66290bcacc09e0c500de8b64bac676b440100d640434d364be640621e4e0223bf1d3e5a618cef8e28cee7693cdf7abb6
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a