019cc2ba9f9102b347eba6308a6ba91a23469e548f4e12ed7d084763dc7fc533

Analysis

max time kernel
139s
max time network
242s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libcc_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

15KB
MD5

a5e26793d3fa33c69a60d537a3b2b712
SHA1

7b0aea7936621a067a07a1203f66f679e341b31a
SHA256

019cc2ba9f9102b347eba6308a6ba91a23469e548f4e12ed7d084763dc7fc533
SHA512

d93c1e84a05e8e869b8d7f2deff88326cf99a9169f73857246941e8c5f6dc3741716f6dc9dedbe180a6e1d1e49a1fe5e474381bac8f117b9373e2fb7682db70b
SSDEEP

192:1vczvTPMcMHyEvdmvivTvhvCUvMXFvovGvhv5pdLzl+Cq12cLkpw1tP6wxEcS1T5:2/PMcMHy8iXfJzl+Cq124kbrBZFE8uI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B549A80-FE35-11EE-ADE0-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000009fc2de9c9a10581dbe25ee56fd1c7ee66e678921b496a15aade57f77045b9278000000000e80000000020000200000002d59a20fbf7382bfb6fb240793c3b1e92c1f5df62c9b96c9eff5fddc3376980620000000426b3525e9ffeeec580efc02facd8b29944990bd52354fce44d8be275c1b4f38400000007ad639b3da8e2c0c51f8a4c63978ca04d74151a9c16f2037d9a71010c247d412ccb3fc586f7497ffe7ba550655de16f0cfeff4a0557fda39772ac4c309398a3f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000f6913c2b54a74d5088b381a15eb8a5d7da41fde1e5c0030ab7b9170c88d1f046000000000e800000000200002000000023800e4d885c20c12cc9bf4d237801af6d92d495ff72b9a0f2385181765c513090000000bed91aa44e37996171921cd2bad4c426478f183762a777bf66d0f321f13c3228d3479edbf0ba6b4b70a379f641211dda850afadc4c396186ca53f0133a781f6d6c23eb1181f8eb86e9bd51e6b84749de95c90dc91de9ecd46be5e96fd52599553ad5c7f58f576394718435e0120b2b1c0f23a5874e29d2543e2a8ad4893158fe0af641c06f62b4696f418c35e756531f4000000011a441dc2442f63900d54835cd75ab8ca1612ca32841927ba7ca6dd88793daf4b2760d177e8b9d01dc6c1d12f904d8bd57143ac78254f268dddef0f78ca785d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d637604292da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419683488"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 756	2512	iexplore.exe	30
PID 2512 wrote to memory of 756	2512	iexplore.exe	30
PID 2512 wrote to memory of 756	2512	iexplore.exe	30
PID 2512 wrote to memory of 756	2512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libcc_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f16ef465bd14f2d63297a14ec1db2231

SHA1
e14a226568fa04999153bc6a0156831918390b47

SHA256
caa0d4b1e2c086a9794968757c1e65a6636f70f81e47b50f8bc27f590fb471e8

SHA512
b445451ed32b3b32f4764208f59c0288eef485ce32a6a6a5ecd3996d193a069cf1c762e7e88165bcef854d99f659ccf4e61dc64090d7fc2fb86502ecd6580457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5893573407efd758fc4c86c5d95edf

SHA1
72b065c2b33c0161e2f4a77d2a8587921309e869

SHA256
7db0787d42c880ac08f88040605503921b9b59a0b9569547bd3cb2bff928495b

SHA512
f465d0fdffeb5212649439748c404a42900124a580a94af6a0f0675a0c5775bd528e6a4d905ecf78143aaabbb27058184234aa385a27f5b245a484103531db24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a63430af3a12589fb37cc7c8f283bf6

SHA1
12292f1510f41f7aca27e49d283fc403a41b008f

SHA256
be5e38bc5fdde39295b9a7c3f4fd378f6428793edb1c7ad1e72596863c9867ae

SHA512
6e5492cbc489583bb40f74c00e22d52c69012ecb1f0adec79c8fce23e52fe8080f5c9987c04c11391df6b0c6264373c8f225cc02356eaf4544b8e32b96ef21a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c57736a8cb06b524a974b7c203326f22

SHA1
42b7bc27d2faeafc3e2c1bd95cf6b1527e91c0f0

SHA256
6b476c47cdf899e1050e597dffec546b85cf3293246130df309fde464cedf493

SHA512
6078c0d82325f4e126a48f2a7dfdeff0a731aae1df0d4c9e77258d504972600fa83423ac24a7485f6b76a8ffd71a53d4da76c326a485c5fdfd11007d3dce94a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4001e101fc14be1a3bf90c8bf2b6a612

SHA1
9a04b9d6e85eac8f1ea9933e43776892c7f20c78

SHA256
e4ebf09155d229fde98d6225bb313ad409ae9e9a8be1c553a46ccf4e01349c26

SHA512
a94b604a3426019eee46501b6da6c1d1799060847fa02dc5946a061a8dee282361902941fec05bf8deefef0d8fc422986517ec7a1f05c183289df875b9ae981f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d43919c5055621d712db3f08d5da0664

SHA1
99c6b48614972214b5131c301e4bd9b9040c2f2f

SHA256
f314a189652857835602f45bbc6fb5f7ae7c381908511135b05f87dd2b0b0b55

SHA512
711a7758f77ba422a551c696ade6773db7d50cc7053911ac0a700b307b2fcda21b719389331179f5217551ac57a548167a65f3a9a98a7c98bd90b70eb8f73db9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a9a3d5fb4cc58b0ad3fb11ccee3036a

SHA1
4a4015f64a8cc9856cac1a4db2bbf191a998863e

SHA256
24f7bc1fc2e715513a46cce08c14c8b0dbbb1cd2240559fa3bd55ea5d7a8d124

SHA512
b74cca7105d8491f8a0abb7f849dd65d55aaccc90ae96358c9b28460ea828e953d33e82f8c8a698eb3a1a7ffbfb542a1158f53145bda7a650a197c36f08fba5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
548097bba524903272116e6b9ddd66cf

SHA1
43448bffdad7dcd4d47a8d81c9a9718debc81416

SHA256
8c6f1538abf2dee0f82a3c6aa5532c9872250834f053e268240e3cdf59d85f4f

SHA512
88a849c253080c7b67e4a53db8e402bca44e0139d7a9d1912834011d0488d18aec313736374c71bdfbbdc183130fdbcab3e38b1a47feb5955d36e9fd222547b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324bd2fc014f6c8dd58171ed38698448

SHA1
48010d835bfcba1735684be65a45e64e9dbebeae

SHA256
8d4002438de92140a8ac1de5212cccde57b6bfc2cb8de9bff07a211f58a7cf18

SHA512
36883380b466839c02827192353f41c9d3fd411a9a3720036627f906e61f7470836ed69247696f084ac64bcbf479f560057c072fd521593e22d21d9b256d9c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a40b64848c610528222f5aefb9c05878

SHA1
d146a478ce587433e5be8920fd9aa628a46943cc

SHA256
0d396d5d4b4319831f218dad58546cc6cd2e1419fd2d4cd923597cef2c088504

SHA512
c238ae6a31e4016f9cf86af6d58994686fe95365d5eee4551ab03c10c58673745f70093c0d66cc972743f8d16801f3d1de49a8469c196d5cdadc9dfb11fb3a44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98d48ce6e283cc60fefa2d37520b61c

SHA1
29c133ba10d75102c23d587e15d07c7f831125e6

SHA256
a773e9eab5990c38c5b4247b978f08c4da8ea8567c34693dcd96329c601ccb17

SHA512
0883fb9fff760403b8f317305b6b064eed0af4c0b962800ee6844bed5fbb98e0916623362b8f8f56625f0e4ba09a0e9a7afffcd037ba342348d30e1e3b5c02f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b52ff16de45d6a9e3b7acbab71b664e

SHA1
e153ee88a6d26407b6a74c13808778fefe4917a1

SHA256
ebb3cb5b80fc7af4da5e6765910deea68cad54459a4e89ae5ede58cdd113e26e

SHA512
97744cf11901df9d7feceafc670701a8edf0039208624850e491208306676f0cc5eb85c66ea2b19c136f29ff886a45715e68ddae2f729f6e2bed21a15c1df424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ff08e48b98bcbaf3b62c05c5d5e14c

SHA1
dc2d7a94e3a54c64bba6367b991f3a81ffb9a877

SHA256
acfa3b7467992172a315f1433c07b9ce3ee80cd48860bf9d99f7a22ef2fa4581

SHA512
6e1ba350c448b26a9b0114b8c886661ecf7ec9fb3bba498e7b9919d1a4cb01cc7375974adbe811976b05f798efb0441ab554c869ad11b3d775aff681eb29c58f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0ccd72464a6d133335e2dfc96053a88

SHA1
19a061ceaaa691d33ab103bc5c720af3bf3dc889

SHA256
e48038d2a47f37f870514975f4c3a401dfa24b31b946bfaad3b71ac1e2ba5180

SHA512
2c8976bd6a6f7786f03bd7f08b6df9a8ce0c68aa01362d545840c1a45c692a2ac622f6c4674a559cc9067248e66386654406604bbb926a9711e453b68fbb82dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab51CB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar525D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit