81170b1e71f8346e080351f18f5d928f7f5916972ec409f0438d15f37f23f789

Analysis

max time kernel
177s
max time network
266s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libcolorthres_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

7KB
MD5

73683ae6c28232e6116c73434aa9dde8
SHA1

4ca6cba5d2c68275a5f5c2feeed0d5b458551d09
SHA256

81170b1e71f8346e080351f18f5d928f7f5916972ec409f0438d15f37f23f789
SHA512

05e76e4c4a41adc502b9b70aef116c1766be7ab08d5535c7d46a192ac2ced6749ff9c96191ecf3b2384b296c7ec029496e20d9f299f7d5e8a21c5878f397cbf3
SSDEEP

192:ZavpvTPMcMHyrvpv4vpvJvpviovpv4vpvC7vpvMXlvpvnvpv5B/lo3CvpvSvpvXx:ZaxPMcMHyr+T8oSC+XlZB/xk90xM9nEO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000e7e0c52fe5589f69bee5966f948e0a95964171fa6a31cdcca5cc9a1c47bb9333000000000e8000000002000020000000f260850291618024493af926e88408a396428c350b5814c11ec7cab82bc0b5f120000000ccecc618a0ccedee8ad895d0b8191592078e204f13c8df19093b2feb23c8f9b04000000034c1c3839ec7ff62054b98e256bd731461972d2a7985861dc20ac7e12cc05d23804e488eec85a3b6abf16f9cdea58c56b7f74d91a8f3a1299754f8bf3fb4190f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000279ec00b11b455dfc8d352f6337443b3cece0e0580e94a8e647608c873c3f510000000000e8000000002000020000000d5b46e354bdc30c6051d37f71f70ec480c53a443508c4a25327b1906d7daaa0f90000000e21917a8c4fe024a848793647693cd03a1d9819b39a67d8aba9ed831278fbd86bfd2d1cf249e103b513dd5773e99bdd531a29c12a63ba09f9634f58d8e0df274427f32215736f80e90360f0af05245ba719548dbde10ea3ac0899b841efc5af6ee6127f0ab09c75ea73eadb0636e348b765b775e00384ec93630af411428f5252fe6fbc5a33d4e2135bf383da55340054000000036623a7edf9a5a8ee31a7da0f4abb31715c8acb96ad36e44cdb0a74150b76f86c804b60705cd465569355f4f0732a7eaccf1654a6b2d3e83126d82f39cd0628d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419683719"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{056331A0-FE36-11EE-84AA-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cf3fdb4292da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE
1608	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1608	2704	iexplore.exe	29
PID 2704 wrote to memory of 1608	2704	iexplore.exe	29
PID 2704 wrote to memory of 1608	2704	iexplore.exe	29
PID 2704 wrote to memory of 1608	2704	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libcolorthres_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa27b89b2a964d1e0c62f11d9d356d2b

SHA1
0611139c55d0b4c18dabc35faab4a03090209db2

SHA256
109f541216b9b0da9db734d76cd42ad8c855b2ab62a47ae50f88e970d235c12e

SHA512
1c74037267b6dfac3c013e0a0406032ce5fea0c0f700405d1366116f7632295a2708eff07228ce8d98c9ef37d197a9f4321a591a709a5d9f0bc5c277051892f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
734cec311ac36795cad82899cc943021

SHA1
853aa5b47be7c24afe10678637894c0b2cd57c6f

SHA256
7cf8b2b5e68b6a7c23dc04153ab344dc2bc155c799d32b56782aa62e2aa6bfc5

SHA512
b66bcb8c77f4a7a37ff6f9490a6a047b4308707ea6205f0dd28e7848ac71f1b2389e76a1656a394be52a1b680c27ffe378c31d786bbf793a08f0a3c21c786b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8294ef20f5c739a86aa6727490a4be81

SHA1
f6b2b099abbf9d570548ae6e91505778bee1cc91

SHA256
49ceedcae5c67fe4e38a0b30019baff7b4b2826738097be85d713b3c947ba632

SHA512
16f3850d5505759d6d29827103f5cb450395669e3c630254b280ecb879eb3c46ff8aca7c8e8f639e543e2bf70eaf19e5ec1b3440821cab09fc13dbf71fb1b8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae93cf17f14443e44ee01341b158f0e5

SHA1
67844fe7f183effffe3a12c2899440d31adeebe5

SHA256
7d57406c262ec700ab833d360da14c7ebe3aeacb27de9e91738dc6685cae2dea

SHA512
6ab74435b4c324344d2d2e0502a4ccc2ec0126010e625ac6dde640aad5b8bcc85714f3fd27afbffd529647d64f796801df54ccf32fb1798a7ae7ee23900cd61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55847323e7b400b3ad213aad5c727f4f

SHA1
01e4411b46276dc2a20cbfce43e8f20bc3ee4167

SHA256
94b4498afe3a556622975401f22ceff8f2f65e85bb92d007fae9b6d22fe09e3f

SHA512
e5145139c46cba5a9bb6fc147c8fc1c82f9d907cbbc53772291cb428615ac279241bc7b4cd043ee54154b068e064733aa6ff2afd3a717282e360226fedd86f66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fac5daa6e8a9242d1271eef15e3ad75

SHA1
145993784d30a757b91680404068bebd7f93b388

SHA256
0bc58fb9875ed02ae519a32d9495bf5ce26754aa9a58c6956bb0adc2e78d9dcf

SHA512
0998605d40547d324e1748f0c3b61ed4d2844589dc0747bb835d8dc03f7162c012725c26fe2487634eb5b317680d190ff9882f8b03fda43e8c1b37d5f4206723

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fd971a82a91cf55feb6fd2c5b022e7b

SHA1
ff995697fb447aae76bae3e9d045f1ff30414b5b

SHA256
4af919df0198a81b4840888f34086e8a1a2f7ad4c76b8c8fe9794745acbe8cc3

SHA512
91e19c00f4c1bc27fb0af3b30c3e8337806c871d057c89bd1bd8e5008266f9eba2ae045ae386beb9456fc50fc56ac3e0302698e25f3ddf0be3c5feb8c0853a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c205fc2889e1fbe782bb3db8a617cc32

SHA1
c7098fe30c8e8a3433233baa46d5d93ee733d727

SHA256
9aee9ae59e0e7978897dd4c82e24169ce6b4c8205067b5da9ee5354f60cea6f8

SHA512
943e14c1a40fcedac881fcab6d67a2d045bf52fa8300f8159e59a610e73941036c71386a3db7d2555caf9c416c3f15536679ad3fa3e86f0752a555fb6cc9fe1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af9b48aefdb03d168cd1358c23d384b4

SHA1
ca6e980050c1940d4e4ff768748713fc1258c64e

SHA256
745e9ebb27b63a297e7199f3d0a37796c9b7d37a1eeec7ddb453da80cafae2c9

SHA512
6550a726bfaded7ba39455c36267d856c6bda848398c9136dc42d953de3ed8d0a48b8afbe00cfe6e15ed9f40ba41307f42f7301ffade1123acd9646ff224b927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b40190cb50cea8eba06eca5b8c96c91

SHA1
7bc0faf4904f52ad5ad69f61087a6c32b47011b3

SHA256
ad04b433f4b64f295af5a9bda4c85386abcd92514c7a5d8d98937d664d7c6e1d

SHA512
4870c7ca2ee1f13a1d476f127c565accee0fe1307b6e54554462b5303f866b908eb525b8304be92d364fdb9ef35cb9bc3dec5501e42183ef5ab466bc21428ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c5fcf3c54b3cd4f86ca2b708eb2635

SHA1
f39256142a79e2f511e89cd3e9462a352eeb7d51

SHA256
65f3e8fb15626e013d837b11d2c356724e25c1e4d6812b5c2b847f4b4ba5cc8d

SHA512
a349b2ec0b73b9802785c0618cf793f4ff8d74b2c4413922aa69777265f789925fe945499715ee54879a3925f3179edd0d193aea5526b73d1824d5b4b1a45005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76efa2a5a4229eebe1f450aa3827a818

SHA1
65228d43aa0f54053902f72b552cdec2b6e603ac

SHA256
6e7cf326b93172054200d3db183e606581ed64c7c2921345b2fb8469b59b5571

SHA512
6c5c2d2de598f2cdf238865fcec200ac6ec9b539c360e8b9a314a78176d4891cf110c3d7b35a72764bee41dd40577453a76a601dd4dcd4e9c38dbd56a2fd4bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
832773f4f8b2dfa6f28017243500ba2c

SHA1
0c3878d7b8baa2bd339801f0169f802bb2ab099f

SHA256
c1d4de26abbcf60b88d2957abe6b8e307778d565d8d98615b2e83f07ca133100

SHA512
bfba248adada85e7cf041d082752036b6d892802eb5ad5ac866b7f80686dbb752560d3f897a8447b52dc975a4023b747ac4934c7835b232796f79add9664f319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4e739e563fcdab81f9c42d5237fdca72

SHA1
23b4327473f2cbb21c36fb9c045e22f8dab2a4d4

SHA256
7c26883864545eca95e14f3c02768186aef224507d94d3319f8622a59080c1a0

SHA512
54539fb186427a8e0b11827bc28cc14306f939ccf600cae393d56fd3614c3d3b406475a30273125b8ff2887ac62b9882d23a2d4c6de49cfd1a90ae7813c52385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84e76bd53e57b292617dabc85d9bbbd8

SHA1
7c6893b95364c0305ae6a31ee0d6109a9313010f

SHA256
f3a24acd7c83e313639497e96948a7080d5fdade66e23d0bbaeafeb27574be3c

SHA512
8a8d0109b42416f87ec3dca5de95b2da7e343dff599ed6b9d1e872b48d3cd9cc1e3000edb55959859fde5d427b0e0baf0a3272838f2431a088a70da78efdc650

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95BB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA9E2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit