Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
libaccess_output_shout_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libaccess_output_shout_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Resource
win10v2004-20240412-en
General
-
Target
libaccess_output_shout_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
-
Size
2.4MB
-
MD5
cc1275ba4d88f8689229d6f4a4fbbc9e
-
SHA1
af37aef7b82aa371802775074bbcae9e9471ac4e
-
SHA256
8fbfb520b083270922452d3e2fc5b96db9731bcbb36da5ea519d3aefa8044047
-
SHA512
d36a6aeffff9b80a22cf46933b7d245e9618fa0a0ba2c33dfc1a8c11c2845efe9448baa839981da3ce471b59843e795974ec774482c8b9961dbd86009aab46f3
-
SSDEEP
49152:qrElqxoJDR8isfuDEhMrmLvbX1ithpc3id:AElqxoJDR8i0gEhMr8vbX1itbc3M
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000050714960711ef7c7752dc4658064685a7a94a92e11d4d7fddb01e596d84806e2000000000e8000000002000020000000b8bc5c8c56a76b09d33c176855dd3874818a11270c297b766923ce3e09c488a1200000003a180ee82ce24299f2e2aace3ed0f23b5fd929e40c334de7e0fa9998d693384b4000000009c6f7bde0a53fffff4f79b881e290cae29ab6e9d82c9f555ee69294baff6e3b376e1643765da9e1710b1a2e06d53265621d59e2e6e754d63d661bad4a55449e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 103d9fbf3f92da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA033A21-FE32-11EE-989B-729E5AF85804} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000562129dc6c510ceb0feed62b3ba915f4ae781587347eb93535edfc52526b7288000000000e8000000002000020000000f2a0fc494088f97d783cf3dca8c8492f2dfd91ba4a33674823082e5bdad2f57f90000000bddc3c9fee0b64e8df7399050cd5021cbf20359eda00d86c16611eecd87f37f33a809515bbe10abc2f5f37be98b045cd78aeb4d53dd021c9bd9d6cfda0ce000558a838b10a468219019813133f6b46d08cbb099780d4da66ec629180fefe2e4ca2c8ef3d49efa62d80a78b6c0be2bc82b65121dba79882c902d0db3869c3bc90f902b70b213650884cfacf9544baf34a40000000dc66c95ae8868e608cefa2ddf3ef169c40c38ad68fc8db32830ae17c727eb22aa782920229cd63c27971bb3a8971714ec0498fcfea586673ed8a9cf339548b60 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419682382" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1708 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 iexplore.exe 1708 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2564 1708 iexplore.exe 28 PID 1708 wrote to memory of 2564 1708 iexplore.exe 28 PID 1708 wrote to memory of 2564 1708 iexplore.exe 28 PID 1708 wrote to memory of 2564 1708 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libaccess_output_shout_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f66caad54ce78a622db78dd3196137c9
SHA19128016203e2fb7caaef06f61f1ba84981542c9d
SHA25635afa842b9720b0adba7c5ca27a497793f90bb8909ccf141e54825b29d617293
SHA512f2ca3251bc2d441730dd93a4da5e750dd71c21097035d62feea9d5f6004002717c21931ec709fb075652f94f1bfcb9abb15b9de3000706dafbc76495810af498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540d505ebc5e1e8ec6076ef8a3190e217
SHA1bd45d409ed8a3c5eb86443b7a156904744e38243
SHA256e5d08d0df6676c493d74b608540055c193b16a0ffe545e208edb5c46899467b3
SHA5125e89c74be5a74e7168ebd99ea51b7da4d8d0c5279d361f3f38d08a70a32c13e863b3c30658f884084211ac0786ec96396e975ad6d4b6c480ba99d00e0de30f8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ef182ac4ab1eb63f5021ef023e4d7c4
SHA1ad9e5fce3a2865f9c29cb41a85856a5fc9ad3266
SHA256469ad23e0f8b45e87c4c6d50d551c4b4021f0c9c188cddf16382ec377e919fa3
SHA512e4ba65641b5aff3b57447552d2d80559fbbd86c1cc930141caddfd01578ce755ecae6028df6c46b1670a52f32ac940e96ddce528344fad7f1566d7e62676b0a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb97c430f258479ce4f77b1bf6656b42
SHA185ae3175a2120e6ea7fe457cabad1802249b0a6b
SHA256b227554fc96f8cb15a05b1ca97ec2c3e2858fa224db90bd1c1d5769cecb7c208
SHA512e3ab3f4db7e66adb07544f8fb01f1312da4a48d275ec07b52e6e911e0cfc0465337af1f418310f0548bf41c05208d1e80f0082f7df250469d0b83edff0b3d225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500b77f2a05a4771676f032f1b453b62f
SHA19fbd7bac4465f4ea4ea8e6091ea8cefdf0d130bf
SHA256363c9eba31c5307d129c344b0bce91acaf211ca74fa019eda93d28c59ee08630
SHA512652e1b49a0e91ccbe44d131d81a70fb11a845633d3e85ec5905f17238d722812aa21d7c9ea044637875f5b404fd4630ee684b35018812a5ed7b5e3e90649756c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ac251d81726f83d490f3cf87f005801
SHA10361747d7a57ea4fcadbc0aedde1332c7ef4f22b
SHA256d30815f7232dce27c9824b1814db5514df46f8c22bc2694e9bcf3c3f02dff7c6
SHA51234896aa548868deb367f5e43648f1e84a0641b59b1135d6b5eda10c8999f47d20c0cdec2539e484fcc957bb1868ae4c86513a7448c325d61ea092d6b35c26595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5557b09ac1d5086b16d6a729c074a8144
SHA17949fb1f5273b4717d48d19c5dd4ec084ebf3036
SHA25606eecbd9f4a8a16a87f098163b67405813231d6f4010ad6ac9d20d0bc5b5b8ac
SHA51256fe7678a2057cef8afe172747eab7162b765210251a13bfb6dd79a4ce56e90d920a3e4c0fbb389ca4e86ecda72a8194db2254166014d5d9573aa84ec8810c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9621debf7fc60d9f7217a36a2939835
SHA1a0accb34cec61f4c691f5c31e79187e44942697a
SHA2568821211e420b87a7bf001b1a047e1eb3af565398b88fddc5d38cabe1a7ca4923
SHA512781e5e454ed22ed53c8c8d9100b7e5fb658ac3fe67f420e3c4b70394dc4fea2d14088dc0be5d51d529947115cfec76cd1f4ba8ece7e01fe424aa3b9dc7cddfb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0a22a4ead7fa8254c42c3d1f2d74d8a
SHA1dc6b584b0c641215ae5613873818f1f7a2fd028a
SHA256114b10e8ff6a84fcdf52e3f63854089f00b60b52dff8864806295659539cda89
SHA51285adf9b6745f09d040200beed13052fb9b7c72fc7c3ca1141b823aedb3a8ad97887e1f9982ed512a5cbc734ebd026785830a0205f9ee4aa26d581295f3c9b398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fa4f69c6c17324869c44584f8bd7f62
SHA1683acc0dd9ac585d867cccb8856cbeda30b787f5
SHA2569a698630d696d70a88698f9eae4ab1228f592b62c0e3e29fd25d49965726a6c0
SHA5122ac3db2526cffd1095d7590411669d792bd0fc6548d224f69f6c859801b6e8216d03bb29936d86326954a05b5969ffd89d3496e38205476d5a3dab50d1216a96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5888034627e02f42eccec1a38fef75400
SHA129bb39a43af681a405ca1ab2b639c68151ce0208
SHA256fe1aab05809fdedbccd0ae0d2f58263419373b3af4830d0f5ad4556a601fc2f1
SHA51249bde152ea9c55c036e8920c4a31d961ab57813888b70715e6dc2fd0027df2632990f2b18eb2815993783a20a398c6bcaaf778c774cb303278734ce06cf01bb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0dda21787d43c644e00a8a069e2f708
SHA1244ef8caea20a3f28b6b43c2d40211f27dbbf597
SHA256ae0a842363837e937b539b734eb3c42156b5ca61963087f0dec06524dbd370a2
SHA5123ef2f460807eaf16b8b2b6ac6939e13879288df56692b5cb0d0377adc60f826844670d0236c8081b09b6ef163f8b27bee7d0ea341218d4872970977360ffc91d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50273422395897dcdfc2be137b410dfd5
SHA1706eff6b2877674c68672d991e58fad2a2714bda
SHA25687a9337ee4109422ff79773ffe3009f91133ad85bd21dcc48ebf563df20e9512
SHA5129136333c99bb13f2f15078cf02a69dcd5e9c18211b59d93260ffda0cd18e2f9b4a4cb7a80296267ae33e2f44dec2ef7c8814fbac999f2494c2c1bb94d74b21d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54db1329d75923d4b18cc87cdca0dc62e
SHA101c0db406d4d4d53ecd8ed38056cdfebdecdf019
SHA2565f8a8fa5a3c8639a5efb0d3146aa1312acf42d7db6234dd6ff676cce960f0f21
SHA512faeb39afa6136043e25e98d1f6a990ef404becd82ef2482a07310d18cf6f8b09c90a6875e053e938999efcec21b7674a264c112e12cf6e97cb8dba97ea3cbbb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5499e38346d10d25129fd53900c4f648c
SHA1d8d8d43eca909a70a0d185e7b96e4f2749f60f2e
SHA2567818ae597732e3445c9ad7aa38a16859e1dadadf6cb451b4a68da27071bc7506
SHA5129ba00757fa57a7321e4079f9333bd7a01b9419e690ec1238b7c4796898c474606e6f436be4f16c46bc9d8a01254666999c3a2d721023120f80c32e5ed51859a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b83f7a27ac8a00f6f3d34af8b355cb6
SHA1eb2c55c656fff6362b014c6eff26814b72362775
SHA2569417e1f31d2e419d0744ab4ee91a2c1fa694f4f31892e4076dabf036ac9d8e42
SHA512437d96b80efe8488a6f5b4358171f0a84bdc2783e72a3fb8a6d5432ec0feb0983fa64a3e85ba2f490710d625ded5fa3a51be35df3aab1b95ae556259375dc3d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b713c23eec1130843da1516bb175def
SHA14f8788fef3757e49d115cde11ee1bea97d32f356
SHA256b50f98033bc2923f19faa883e1bdae1f1d4ce95ee433224549506c5e14519086
SHA5128308fabec377fa7cd061b23f6ffac1a23a799a2c3624d12da98f06da94bbc8473a01430e6bbbbfd752002787c54feccb87e1460fa7e6d8067ce0cfa782913b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d692cacf64b049ca674aee162fbb9a28
SHA170262d345ba533df618d9b541b89e3b9f6b61d31
SHA2568d7233299d8f153bdbb20cb1b02948836f892b0fe5c1184f06448e5cb3db809c
SHA512d242d68da5e7dedd91f3864e4b97e06eafd2b7f052453cf4b1c026a462fa9e29af5ffb0636c478d8ab7e00b1673c5b893f621d035faf8ca8445c3faf2a4affa2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a