ad8d2ebed58626639334cda24b16a15bc0dded26e7c3b46497285a180c0d8cf0

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libcolorthres_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

6KB
MD5

453fb36089df3c523e3377055741cdfd
SHA1

47abd306853903dcfe2e967862349348f3a1124a
SHA256

ad8d2ebed58626639334cda24b16a15bc0dded26e7c3b46497285a180c0d8cf0
SHA512

b4dbb24229f74aeb2eee26d83ddb01577ab33aa7fb9918b6ee882d762fd65138448449d0ac1bc51bb51bc488c478c25ae4230ce6d556e36dceb9e818cd69ef9d
SSDEEP

192:ZsvpiPMcMHy/vpPvpqvpDGvp7vp9vpFXfvpOvpGB/lo3kvphvpsvpNvpWvp7vpsP:ZscPMcMHy/lcxGFbbXfke/JzyvIBy5EO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419683507"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8941A2F1-FE35-11EE-9F3E-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b050ae5e4292da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000e62c3fbcde9d5532bd4b3299d3ddc63a5e76cb2abfbd66eb3743cd8b8d1f61a000000000e8000000002000020000000baa87139acbba0f3ee932a5eef691181f6f4aeadf517dee2cd16a89e73d089a090000000f05fc8e94bc59ce39e778cb4c4e879178f8e5d146b26a7d67dd79e8c14fc68e054bd486ec4d55a61dcf8daba0741fafca0428f5b188c59d78674e67b00587f0f6e818f1d963226f9891f03947fdf6c8719dfa1b9c57e73905aa14bda0840d0efeca8bf0552efac702e0349f01a3dc675651a9643a57b2e39aa99b8e534fa4a3be02ec8a14d510247cff5904dc8f494544000000046b84ba4c966d3072185ef37bffc4d05e674213d18dcefce58386a3d3812f666d79dbfd800b4b5e2532c1879523dd4ac27714cf2effe469a4dab1c922d0e2f67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005996966e4622b0ad58f7dc52387b5ad5f0504d01acb133aca1e955fc8d46a8b2000000000e8000000002000020000000fe49cad9ed7410e05f1174667f48c050635b660f5e32f1ffe6b9d5279a1ab63e20000000cd08ed0a5b6acd849f5ee42ba809eca57c6a4d20c739b2246ffc40354856d8754000000093dbb29e963c03bd3366e524a5c7e92b845cec1608f487f8b48bce4a54cc0c6b2c4ca584c59b4577535605874cab80b26f40e92575e287984c68e2c034378931	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2688	1688	iexplore.exe	28
PID 1688 wrote to memory of 2688	1688	iexplore.exe	28
PID 1688 wrote to memory of 2688	1688	iexplore.exe	28
PID 1688 wrote to memory of 2688	1688	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libcolorthres_plugin.dll_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db34654d86e0c492a592a13e97f6a865

SHA1
fb82a47171740ab3a908afb38b4ef4f316e204cf

SHA256
fd0dfd665bd4c0cdd41b0d168b4a2513ec75782133ccdd7050c003e8dd0de041

SHA512
a7ce3b86086aa409d8af68b65edbdf1a105a13f96e8462a38c07bb780d03bba310be9df566dd5a8d40038e68f7c9fbdfbffcf69fd7d47030ce0419486721d0c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
450569580d9f38e3bda68d807c153b4e

SHA1
07c53b72f9dbefd5fb79de23defa4ef8f36dc2ed

SHA256
a56b9b56212db0337c44b9189fe551570d86b861fba0c7837668eb51a3125624

SHA512
6d67ee5b7854ed6747186253088bc16e3b0d8a5533c5ae9f8eb663f648c318cb98bf452aba9b5b494baf2acf39e44afd3ac242155824011ce00ed7ee03b6f003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f99b89823609fa348c4cb88e6c3fd718

SHA1
82c9d545f630e5dc430fda0a5905fd64d1b602cd

SHA256
1b082c5bb62c7d1ffac1c70be75fc77b494867905ed5fed9421266d25edaba4f

SHA512
9f56ad5947a820bf7eb9044cffcd64a7b5c8031d235ab2ab84a5a96facf0cb1765d5206820ad1c381fc10e2307b4816923bfb597600c9e6c45c09f6111f13b46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
671b54dc2964d30980d184b012eefe7f

SHA1
cc2011d4dfd21e98b8ff3ebc3d77a67cc6e2233a

SHA256
7dfb21554ca03458305b62a3a33c1a53254907f42c1aaa6736b9be6422a8a84d

SHA512
78abac8f7b13f9f6327df9150c5abb17a9d688c0f5c2f22e1f1719343526590f81ccb8be618ab27cd6ab2ab41cf006d7f1e96e51d9ab422356745c60866e506f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d73a8386f79dc56a9ab48e905cd755c1

SHA1
1004960ac2226d42b2ae08591c9cdc5decab7ad5

SHA256
e5db2a9ed2815c53c94112c0154958d94fd6b74c7be5aa6658dc49067db08866

SHA512
259716618d45a017ecff7ff46b62ecc0b040d2f48f074d925d7a410760b8caa5805623960b8681e0ca3979e74ba79d78e35220fb6929f5531d45f4739cc9b23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2fbe65c6662e93753311e96a2994d44

SHA1
fd541acbb812227931587c1fe85314c899de0f9e

SHA256
f0f662f0f1ba1bdf21dc8ea06653c871eeec3a204f436ffcad71d1eb6b278f5e

SHA512
092e38009e000563df2faa76dde249632067e3d81a969cb8df6eb7d75ae888196f7e492618f40a1415f82056b0f61bbc82a81aaa7f497896fe47ce0fe9eeece6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeeb3d529d8c4b5806acbb3f06e07cec

SHA1
0817cba389bd9dadaded5180f557842813e17c7d

SHA256
d167f6a7e1303d09a4169fb2fc982f78920240c81b4cf0aec1b79848f5906f97

SHA512
ebc274c187fecb2c1068cd7be82528d586b30a48fd917edf28aacf0ad7bf26bfecc6c5cc49982241ba9a62301e38e55bcea8c5f5aa65234a9426eb2c67411c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
224d1d516ad36a615875c1da77384405

SHA1
d8c9aed9fecc54d7e280ed21daaadb501c649dfd

SHA256
9ad8845c561837dd454ab151e224e4ade7e2f7e1a2b2c9297836b861f2fb65fb

SHA512
618b5f6335caf1185cf9dae0160caaa20c187b24dd412fb37f13b182aa02ef982b4aed9de17591e0da32399efaa4eb2915c5808da7cffeccaae5ce3cbd23ffc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1848a0e0ac62c7a7d5da2d565d7d183d

SHA1
3bcba52ebce7c4194cef6bfc0a94e93957e32dd7

SHA256
555d79a9ab7c74e98e499199b8fd27f5346d4b678178a76a41f3369e6b8a9c37

SHA512
328de88baed4579275829979f726e6fd013d824676dcd8e1dfe2fa84b093cd29cadfa746ec1ac9a88925bd486c55e065b911f117174dbf3b388cec4dda578fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ecebabc4b7b4521414eef435449f88f9

SHA1
792999d22150361e10acaa9067235cb834665669

SHA256
9bbb377a818a0fa4ac76868cdd7f501882717b49700d0e5fd352224dd4702702

SHA512
f08efa9308f763382e2fa57160543e67f9e048004dfa9266c7119f59587d139942b25f3feceac923c048cad87d0e227e9527b582217d30e840b5622e804edec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
529965529e4e56b3a827a9239cc2ef7d

SHA1
9e283cca3cedae9aad073421a437f878448fe0ee

SHA256
aaff49373b349cb72b95d513cc0644bbf7faa1f1f290438b1336a01f8056cd96

SHA512
bffcfcb8f3882510473558b88d1b0acd69ccb87aa75666ff3e22b50064bc1cc0fb940b89f8fa61137b7d42a76ebd5d6c29ca4da95dcea1920e14324bcac8112f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00f8df85718418bd82c8ac5c85eddd52

SHA1
db009abe21e8e53d47313e8cb5a58773d2785dd5

SHA256
090c44cf4080d43731059bfe96f2883fcb6de4acb3d2b8f9f5d20a3398c808b2

SHA512
1ad3b7340d6cfccaf7e563febfd0dd57c1a79be0e055802df62bd8807265162a82e9a0118637c99693d39dc901d8b8ac64fca9b94f052c68edfbe9c0e7d8d1e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66a19439b6f68e145f240e0897e610a1

SHA1
cd465aa6b0b04fe6d255544354ba7103072cb7d4

SHA256
eb275924cfa0a0f880980822d1fa4d4adc64ba5a7b453c579c9f4f7a10ad40ec

SHA512
4449803f149b9f0bc83500155d1573c63bee20d5abbb5a927b4c7c84790dec2a052a84ff285aa9e75578f7a5a5eb56a7c5c5ba2b836cb21d0d4dfc8c3af6f4d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
835c9734b3475720d84ce88d923f5ab9

SHA1
43e881819cd80047ce590d385c13728c3f951652

SHA256
64608d3d0e3e7e1421d7e3ddcecfdcd595c903df1e7eb1d855cb847c41531c77

SHA512
91d67eead72a325df967e6023c79babe2eb6401162e6030f8de0b2f9c4985b2bed6bbdeaca9ead9aca123ba8c553cf0e8e66d64cd772cd47ca2cc5439cc014e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49e8f968397a39f1aaa12e5666a5cfe0

SHA1
ec5d7eb586bb9ebbeffa5478aed0f35fbcfa1f47

SHA256
0b07059e8ca81a125e681bba7a692672149658fe08e9748c53212bca8bffd244

SHA512
827fc772c43bbdc5a482c63ec743fcd1a1d3cab87aca879558e7e8281d5abce712071a566bffc7c1f248cf31b2d47b8c5d8491f4f47ca7fabec5999629168ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
928d463fb75fe4e74a46ad65fb062493

SHA1
066e1fd70c9c7d313373b5f3aca386dc898e4922

SHA256
9b3b4d46407cd17cbac7025004a2c0ea734412d5dcdc28aba40eae6e00f79998

SHA512
fd55b6561be75f6f4ffe7dbdb36870d9155b8d3afde385adf574c921cb7b745eff20ae0e5a835b2d0dd36996c8e08637b168660ce090696fa54c1fcd31a0d12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA7BE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit