0f7e144a9aa8a70472831fdff3784af6aa627a6abbbf2f77ad8ed130340fd9ec

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libadjust_plugin.dll.svn-base?id=e3b43bd36fd50840467669364014ee53553872c1.html
Size

15KB
MD5

30df49615315a50becc04156876b98e6
SHA1

f586c79b1bc19747781e465fe4ce6dbeb3a46e56
SHA256

0f7e144a9aa8a70472831fdff3784af6aa627a6abbbf2f77ad8ed130340fd9ec
SHA512

8e48917d131372a485c1ac2cb19ee4014d07d8de155b20327ff32dd6806d4b284e05601dbd4e27d22ceb0a7a40843f2f6613511c4e7492d3fa1a244a9a995325
SSDEEP

384:f+PMcMHyAcaU3jQdcvXkvDZ3eaNaLJzl+Cq124kbrBZFE8uI:2PMcMHyAcaU3jQdcvUvDZ3eaNaLtFE8B

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35D55281-FE33-11EE-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419682509"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808fdc0a4092da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b1cc4aece0d3a8ed425035a74b26c340f77d3b9302197f82f6d167ac6a1d5042000000000e8000000002000020000000aafae8acfdbc4fb4389a5bca09c0b413f3955fb5a934838fe9f6ec21566ea82c90000000184da9c9fbc4f3494728ddb06a7eb34e69100624f3cc9f06f792cd12143b558420f628f67bd40281481f201af915ea20734b5b471c7c23df443758a862543b87786da670a10ba7abe6ea7dff646c7e8d571f860d0d661eeab3370e4bf886fefad760605b2500984c2eba48c9533e4aa686448cf1f8ac750936eead88d9ca413f35775f943cbcc539d50bdc16c971e3b440000000d405434d46305e1715228d1535e483daaaf83fb3d733f28dc30066f4bdb0b26fd59b8a684f5ea37233a5183f34af3e4a477f93d1391ac702e4b3d9bb6ef74348	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000989066b8378bc6e35deae9886aa90943fb3040b9555b96e1e300718dc8e36686000000000e8000000002000020000000e594f4defbc5fa6cba1f8d1efda7c3e937ed2e44340a09b85290db60dd923a6520000000dc8b0c68eb386b45e0d217faf3bbfc9fa9b73c8b90613e8ebdecd8c0acd8dc6c40000000fa0b77f7cf68eb96e531464a27a6d7787a1d0d42e673d230875ac3937fd7ca7858b64e9dff9ed6c5791e4eef651fe776e8c9766f3891339cea2e869edb426cdb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2784	iexplore.exe
2784	iexplore.exe
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE
2892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2892	2784	iexplore.exe	28
PID 2784 wrote to memory of 2892	2784	iexplore.exe	28
PID 2784 wrote to memory of 2892	2784	iexplore.exe	28
PID 2784 wrote to memory of 2892	2784	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libadjust_plugin.dll.svn-base_id=e3b43bd36fd50840467669364014ee53553872c1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2784 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52127db57d792a41b23fb5d871d92766

SHA1
d2991c5d626aece79dd7874946183e0bb1143f51

SHA256
9994f8a998e89b08904dc8feb3fa75507276e318a582bcdf1e45bbaacb509bce

SHA512
fafc775abe122c962783d9b45eaf2215ff713c965f76d81d4eba855d67f4ec7ac5b6368982c648f2302dd7764aaba67aad08c38771368bb902a68275784a04c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98ac1b4ff2862f1e9d0009582d9cf3ba

SHA1
e313bbbffe957f6121ed4dbd2ef25f63444b0082

SHA256
030989e407f87eac93b94e11f3ccf508b357bc4d569e9da219f04f1ce08e75b3

SHA512
c3b9fc26b4aa20783ff500b69b28126efedb8f1cda973046a732b5d08079a760d6074d5f5209abf58d974f7277da112cba5bb7b09c896882ee4af2cebb378509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e49583fbc122f545a9089c2272841302

SHA1
7f5868c5e65a579488e68cb65cc091aa80177d53

SHA256
99f054a01ad0719403bb4594b2bc89bb0dda1b6d101c8216de56af9282658246

SHA512
eda4772c0b363f51466b39c31b01c775a79a8bbb5a2ead35a24ad87dc7b15d2e64d6d389232f81fc0e07399c62d8e37929038b4666d70f46abcae9da75f84efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d2953d1735539fe2911567cfd149f8

SHA1
e2b12afa2354cd2d2f3bbb87dc5ae676986de68a

SHA256
ac78271df048277ae53cc9500b55cb12b28dfef4617b415d17aded2a9075ea0d

SHA512
253e6f025145a27fabd5f6777591d125b3e5fcf26ccf5c1d16ea711625b971f6ece0a8108a6bcfa96039033379b62f78a2f9053101c14ba905f4c6c3bdea2123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c265be3c27c3c93324f815d90d6f8606

SHA1
2914c16132e1e2dde6d5fb70aa924ca02afd180f

SHA256
417da91b5dce0359b8f7478d83deee9f59d8b0f76330fed63525fffe99aa5d15

SHA512
331b907de15c11fa89fd1720d8ceafc6fb76f9efd429949a95698600ee4716d73cf4150cb68a280735832f3490926aa7f9f5e175db45eae1d01c750da7777f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8e02ea07adbe58c4636b2c92f67ea0c

SHA1
fca90ac8deb68fd6b5aa804a2ed3efeb84e37e81

SHA256
bf134d139dc5b247978fd3c60142f9e82cae79c4070a12835942cf7d14c5d5fc

SHA512
bf2a3d53ad8bfcb25321cf23ad63c9ddd92cfa2dd10e7dfa31b3fb516849ca0fd33104919a731b9ce3dacf733d589346f568393aded82dd1c040ae23bf096216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
875cefd5ef8c3cf7882a07f42198252b

SHA1
72f3114c0a4fe2f5c235355c195e14d6a57d15d9

SHA256
57698ac7ccd3ed23a4c3c96fa0e8405f8a7853c74c5547b59146fddd50cee271

SHA512
b679b1e2ea4c7acf27b6704785fe54b85374a90b047f4277b1d3cc249923c6b9bb827f15d0e42662531481d3637ef629f4f5d756da816215fee53c41260e6d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
babe7a7e309622fd7dfaebc4e71686fc

SHA1
6c4c406fe2ac868b1fa66b7d993d1a37d47fb253

SHA256
0bc442886110c05b020a8960496661a813d5ed4c24b31b0e7464f49317a15305

SHA512
83c0c9f84ffb89c78fd5fb211d22b540842f0d51e323ff4d3debc211607a20cfcc11db9fc91f1de49f3144bcd3d7c889fbea76b751f78cd3bda8afca723ad095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52c0d44cb589c8a0d7f42fe768c3d839

SHA1
b9eecaf622fde664b250d5c3c9193171ba084e9c

SHA256
223fc9ca8cfbca75b3324adec8ac3b7fd244c2482447e68918e5d8aaddd92c8b

SHA512
a68660396c5bc8b91926429631733d5e929190e9a94d52e744ac9bdee8057a9e464172133b8867e5b85e1f92db8f35ea3aa250551fd5318861bf8a908a78ae5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a50877741e7aff9b47793de261deac4a

SHA1
ca96de010099a8366bea65a931168fe2e1f9064d

SHA256
166c697d9dc422c1c3fa24dafb8638bf734d8e77d23fc1517460469c5cfb5c9b

SHA512
091ad43f5f9c36d0ff9d6b924e59b3c2f3d5314bee584d761b6d3c9ab5614acbe9584f36182208783283c05f5285a6c6412d2befb692b54feadcc8f05ac3478f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6c1eb4b96489545218a6c1d96e603ac

SHA1
14e955f40b04a478c16557227b1d60cda9031b04

SHA256
de21f55b704b836faf19113c4c8c1efaf6e58576a0f89cac05ec0468fcfc2e54

SHA512
15a0702bff36f255180d22a475584748d8a122512a377b6b14883d93c66c40c9b894f50103c06766918c8a1acbaba38945c907d2fc0317849f9916d5671fbd7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db93be00549bb70d77cca0a2ad81bf69

SHA1
bc9fd6321a90561edae869f6ee92b79dd7dd86a2

SHA256
ff91b1dc0625069781293cae50bbe98568313efd3e28a3c2203045895de53e8e

SHA512
9c9ab12c83a39d843ab036512256e0f907d8476bb7bb399233678f94ede1ae051b5977763d8bf50ef5281372dd16c1567d4f65453af96acca85ec4b9b009c761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aba50ca961b6427aebbf7c65ff88056

SHA1
d64b142094c9f49cc87290572f646f83c61507f7

SHA256
f99fcf1084c0520da429d85c782a4321f14557876958b4d9b68c66787a85acbf

SHA512
fc1930d649d8be1ce46c5f8d2387bab1bdf85c3428cc045747a3a79b27021eed93b4f6199f6ab5a78de9700b73fd0626b4a1f35ae68c139b5431a6544937413b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a1efe6a5ff7c3b71291dcda93a5178

SHA1
df841013317bcf85af1a992b8fbbe69713904f56

SHA256
6101afd0587029e5d5b572ddc1174b9b4e1727f881610da4e573114bad197abf

SHA512
2ed570ba57b40e127537744bf4c06d19cb1a26464f41ea3d084270e74647545b77ece4e7f2179370d757cb05aa16d8404dbbc7c4c9d42d7b4130ae9038be1567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41b3625bf607f3e8c2c61021f014e0ce

SHA1
55b860b878b53d0db00e1669209a074e834c4943

SHA256
eb67a1b07f19d2dc905d87f39de13a3757a35e1d0a04c27b835a63bbc4a0ee70

SHA512
3a4cce187cf4df1eecee2b60a3520088ae8aebcfebd8d5bbce62a76984690c13d0db8cb39f75edc244ffa07b6dfc4843a3fe2ae62761048319641d87fe1a736a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB53C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB620.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit