db53c0844686e5a377a93d498186b06b7a5e45efc3539a8e10ac79d3f68b42ea

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libaccess_rtmp_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

7KB
MD5

0bba80d9246f2f89f5ff88d478da6b6e
SHA1

e62166a03335f364aef3fc10c7ff130fb6b9c067
SHA256

db53c0844686e5a377a93d498186b06b7a5e45efc3539a8e10ac79d3f68b42ea
SHA512

837ce03cc71c6b072c816e8eac61b13516754e452b629f099f2946df11c2be0704a61682aa5335002326f3e387b6e0047bf3ded3f28fed521f09d1f8db2d8fc0
SSDEEP

192:ZPvTPMcMHyuv5vwviJv5vCevMXcvav5B/lo33vnvqvnTv6vYuvqvdUQE8uI:ZTPMcMHyw6XN/nE8uI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809435c13f92da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC73E431-FE32-11EE-825B-FA5112F1BCBF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419682384"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000928dcb1859bb9babc5d3adb576e2dafe6c32a12c5a3f93b23d59165225341b1c000000000e800000000200002000000066ffc4a014c19c06cb763a7adfb3fcbd212ecf2e84ffc89c03bf422a2d75375990000000e2cd38f56100637a63b49d9e0c69ce332320c5a1cd5979a676116f3891fcb8931b4a5a8b58a81fb71d9593345da4189388eaa9f3c6bd3a774e77168d11927418bf46e7cb70a37057d40b44d7134696837873b23e700814a0df280c1f02e50f769474d89dcdb1b4c4c8bfa3e86719b7a7bbf9d1acdb550d480b6e56809e135d731d7d65c35fbaf30101388b966333ab7240000000bf593f5a57ff06de8eeb2f61a24f076e3623f967e4acb9772f8d1822b310f6e7fbad00da3e31f4297eb13e28a53bd571b3f1ba8cec03dda77d3a17b37bfb106a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000555f3e0f59c660da52c004d55f340a91746d8b97c64f5627eb2dca1f4aa3991b000000000e800000000200002000000065d9184b9e77a90000a498c1f2d3f8f08dba88336c5bfe9c8474f9ebf9ebfd9920000000c2f0b8602d02f21160fe2d78b9cb8b6140913fdeb5b2e191f607e87aa2ea2c224000000064d895e17a463c8c94ad84424685b7744f4c8adcb2198d277c23572f8b0b271ba4f822b61f562f6a7689b7c82c697b9d1aecc6cd80b1a24e214e5871059dab14	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28
PID 1928 wrote to memory of 2732	1928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libaccess_rtmp_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86d5a663f14a545050c51cd649ed07aa

SHA1
a2aa3684177c504a3103944f5422eb8e4b8218d1

SHA256
fb6b7521247cc970c0475de179bc2b983b09f08b7409c9674b580456dd54cf09

SHA512
99374efda8d5055efc1887eaec810d792850888cb3bd5a96a4db168f41a3f9e84d2e58b7f938fe9c1a834a58fa940c88e7db4b356df1f547a84e03b69ed250b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37029a16650362eb29b4c6ab9ad8f3a8

SHA1
28e9b512df3064b840ff82a5a2068f51d67a2bed

SHA256
be6a782b305191e768ccc57267d8a29264146488ff63344de73a84127514502b

SHA512
a2d65e2d9fb9fbb44bad5e95738647311d7d537ce54cc83b4e5352d4183c1312a8ecdd3eca68c37393cf5399d95ad2a31fae202a9c7642c96290bd80141dddc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1632d644c4e226f3a3304060922d65a

SHA1
b18ccf8e7f8a6adbb666469a53b093c46821cd89

SHA256
2a8d6ebce02857839b6dcf63456c38090a6edfb2b368f9a7153c6547b7b05c94

SHA512
5db808eec921aa37d2c97baae82fcfede0651f7f930089e1892111e33f1d437a75bcc66518126de735a58085620ed7cc03e81b43486b75a9df1f790abca134d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4dcfaac28374bd1e77f5696070d4ab4

SHA1
9cc2ef39043b072aee85cf262bfb6fd6dd6a4a5e

SHA256
dd95393108a380209ef3b30fb2f0567526e67b17b7cb5f7a1bda93a3cdb4479f

SHA512
f4390f07304cc36c981187423acf9686bdc5f25dce5be8ea84ba5f8771e2bb98d1c97605e99a4175fb9fe9cb55be568cc5fd6b28ba1627fc7153555eafeab092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48788c31e2581368ca5dde05cf187864

SHA1
8c5e5084faf68a09164ea3b97e15f5817b5e29c5

SHA256
3b57bfb2dd6df07f3eb5f31b0c37bf11daab01936e3bd6bd7a7115dd7627ea38

SHA512
fcf68268b789cb81af13118a042956c69b8f9cf574e4402a700815c688cc0b07568854e13b0514d1f0e03f37e5608f7372042b0244265728c5db92f125e28b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3bbb12283002b8517cb3f7f0fcace7b

SHA1
1d66b4e0677381ddaf3320177ce81fb428c1aafa

SHA256
d6bf849fc1ec005de6c335d8ff66a762d0d3a31bbcc779a79ad20aab9aa8047f

SHA512
ff1d84e4b36a48509ac175f755f17cb0a0ff4ac370f221e13912ce8561742c29263bf4c1c35e58c9b2e7be683d0595a0692cf3d38627310aea08aea818c9be8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe49905263c75db3e5a65c3716345a54

SHA1
c88304be3c50d90374e7f8c09088ada8dde69705

SHA256
92aea0b9f449531815f4bcc2a582a58182948154086922d36c6bb691b9420dfb

SHA512
34dae6d1891ecc70fed4116c54e21ed949ca2c5b4e3f1986b6091850a1e6e30b356432c672b018b541633b2c4b0b86409c4401fa649039dd35d52aabc0206439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a74f3b514427fbfc95abd5e8d4b97244

SHA1
7ee3a8e4f400f2d9072a5ec2642e542ab659b95b

SHA256
8c1cd7764683ec63483b401b144f89879a5410347794c8c0b765ec53d9bc3d26

SHA512
a4bc3f26bceb71824b3f7c002a909910c360d22158c2af77bef3f31a9e74e0f24fffeb9e9262c50514082b8f8c3105877c6ae961e8859aff6339f9c73ada4652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f75a3b4d21e9b9979cf3ba0acfebfc5

SHA1
5583df2c4d5c69d7132e87c1cd7b69c6db26aba4

SHA256
4a95dced0c04c84a42155545d4ec3dff42883fafcc5f53ae84e9d4b471e2dc42

SHA512
71203b500c3b14b572d5a95e45af0007d553878f04751106b606e93b332233591f67980513aa26bf90a77d0e66dafc5971a9a75d4fb06b523647c3526b3e5960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39121bf3bfea571cae9e6c8f03195848

SHA1
39f411fd533b6227bd8e4bbc28d4531410307bab

SHA256
d826960d6796d8072488ffc246cc0bc147703c6b62a3e1820de0235fed5635a5

SHA512
4fa1517d495e81e1395b1419e29d47bc222c4fc17e618a15857844da6b6048c51d182ea2e9dd9a2b5600b7d37067214c80f99c8da49ecdf20b152bbd6eff7908

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43F5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45C1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit