e705ce7c714dc3554163aaf48a6db11564c58c104683d8834ef637d30e054ab9

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libtaglib_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

6.5MB
MD5

26c8f3c129bad20d23cb0bbc5b490a54
SHA1

932bc529bc1174e2d7002dd55b95dd1bc71975f7
SHA256

e705ce7c714dc3554163aaf48a6db11564c58c104683d8834ef637d30e054ab9
SHA512

0f4724d685a1686f2d77891202111706ab28ed9d3d03747eb295f0127f33a8a7eb3dc0965ff3cc419dcf9f6af38dfb14f14c83367a92c40b58c12b68a07f6953
SSDEEP

196608:Y8Mr7zGawTt9tAw45+/F3ZqA0AX3Ba8Tmj0vg6nVpfn1PYdpReUH:6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ab5dd44892da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000391711232c373c25e53ec949131d598ca9f84a8c172fa7866361373e277b379f000000000e80000000020000200000008176fb05a70348758083924b19cf83660bbce0945ccafd798cc9bc845b48238390000000ad66d58f58dfab19d8592496dd56aca0c28e009a4faa9a1db2ff0f7ec943d788683d122374d59329a7ea6e3cf2f6ae382923402fb8a0f268bf85b4fb75e6b5c50b8f299026e20278aa4bb362f317b68a5f4eb2b44a1b735f0c04ae5b5331f101e9adb7faf6e2a34b01078d15873d0ed86087a83060b1f26f778a948930ce6e13e0ac5059a6d358c59d1e1137ca98e2b740000000e03dfe525f7c1c1f8b670717eaa969db7679f4da79e68e3cd4256deed1ee2df6a78ff6de06de33dab3a06f507edcd3366e1dbfffb754690e095eddf20972b853	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF366AD1-FE3B-11EE-9DE9-520ACD40185F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002c9d2c3b1dd47becbbeaa4aa3f8459f3395e6b6426cbdcccb0eff87971657dab000000000e800000000200002000000072e0cbad7ae275971fea2a0b1f75862f1a720f9cf79d27afff7815d8390ad0f6200000000f33477bf495f2f8382cafcc33f20faf1872922d5d50f761c68ac9c46507c27840000000a825fb83627ed97ad3b41a08b0d29cca73203e7453aabbfc5329cc4d17398a9f572a6a4166c0d7d8d4d50731a818424104cc0c084a7fcc9d58bc320150a93336	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419686280"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2900	2956	iexplore.exe	28
PID 2956 wrote to memory of 2900	2956	iexplore.exe	28
PID 2956 wrote to memory of 2900	2956	iexplore.exe	28
PID 2956 wrote to memory of 2900	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libtaglib_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
695339ec6c01fd8f36ad14950d4e551c

SHA1
fbd58bbdb871c6b7f0252590d73088b93e7eae9a

SHA256
15dc860c156838255793cab1cc2806ba09a4984089f2d61db02ec82bcce802f9

SHA512
a346e610a7968be60a529cac9cdee610cdae257acc8f01f72b031eaa106b9bd77ed896df2467d2220beb5878939c60e3e5dca5f863e2a5f194e596d202d3d806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4759a97929f7829fb2c535bcdb65a461

SHA1
e7961af5f19e04e2a98c95cbdfb19e529717504f

SHA256
52241264ede17dd9221e1e91fb3fbc27e82909afc1b35282bca661c07289818e

SHA512
3db68b516894911c48212cc0727dbc0a474356301f75ad9de02a0ab3b1ba97623fa7ee09b942d4f59576af0d864407e6392e13adb42aa793dc0a1abac5b5b395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26fb7f7bdc238fb4e1171a569c517550

SHA1
bd86619dc0c24e4ce76848ee2aef76f29c591907

SHA256
52e7f853a4ff2f367533e2f6a6ea59bbb340ffe6d6fd7cd8ae722cd8661135d3

SHA512
362bfe375b223ab0b39604066413e1757324841144329fc44c80c8e7ae51e14ed5819f53c12ec34b4bcc4504e8afbdcddf850c870ee35f6f62a17160876382b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b6cd3e510e72ba6b1fa21ef57502c9

SHA1
90455b4a03e0b7657ee0188b1eb064e0dbee2960

SHA256
e3da170a0c649e7fb84b3d1591755ffd7be9e12cb008968a41914b5f000c9670

SHA512
b76e430ff1c0510f87d4e983058438a0d5df1083c293238446442c54cfea43a1491f078536c978b0de81af82d4d7208e293b193295d5bfa42180870154d8a6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2515f425bfe265064a5b466cb9088b44

SHA1
d3592a4a912c90721a94cc51c5acddceba253be0

SHA256
9361c3bc499b4bddfde45a540df4daf31de5779420b0ec16f4addc7064592bb7

SHA512
4997bb18e918ed26a1b0989539cdd5f2cd82e6169bff5ad1d7767c4222c586a731b2dd49b5d94fb1c65702694a0c0030e86db2e1e8c4ec449236e3ebb7bfde78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08f06d0346c175fb85e89b2c61e6e22f

SHA1
9ddd628c91df203eeb48df18c676c438da469394

SHA256
72121530a717adfdcabd375b59e655bca8b5cb05f81f6cf1763598b7b6911732

SHA512
553fd0f8daac4e7dad246099900599d85f9a43498212fd49d1e02327cc47fcfd25a34a2352cbdf86e28da000af05d2ff526988f0842cba06eb7e733a910c3c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb38bed7824aefe638ba49895ccf41cc

SHA1
c4bbe95103279754294adfbbfe7d0cafc4a2e48e

SHA256
2a725addd0748b7a0b226b3747cbb07fc1c8304f735b6f8dfc3d661005641ed9

SHA512
e64b300606e21b122040e8532eb2055bc3a8e7cf7465fbf389c29a9368bdf723e60b9a0ffac9ccf093c63edcc450353b9aca15d4b57749dbbd888ac2d2b10c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45f1a7c45b974b2c2a8bffad357f9bf5

SHA1
faf0ccd633d202571cf32a8d32eb0fa65b08da96

SHA256
6b8ac34f0b5634aac139a97812378bae5ef9fd2ae3d7a13c33f16125345d1a79

SHA512
6ba617a53fdd41b36384ac35365d98ce1ec7d8f7ecabd77e5c77aad0684cafbf7a93b9417482b312ee15ab8b2fb25110a20b3ec355061adb4e8dd091e2074c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d0db5e26312e87c3ad259b72ceb9979

SHA1
50214a5f6ad5c35f93ae3bfa3855d811fdc08dbc

SHA256
d4328c6acc7124b86858f1fc39506a459c2c119c38320c7a30034eb96a84ec13

SHA512
ff4d6ec150f1c8a79a5885cf3661672af29ba80fe4f1eb504d7f53fcf614717f9955d23e64addc07390adc4f67d2eb42bcc583daec500964851ab7feee6d1d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8a4dfee826cddb2953bb7367f1bc490

SHA1
672b369135c9ede6029687936d993b4a72c115ea

SHA256
1981921805e13dfd342b7da06626994f7777f6e2a1163fb97fc38a4b014f298c

SHA512
4436f07d7f20e9f1d56f3fcb128efa2bc452c596c5d5d8069944e402dd3f45875341f41fa1530c3e42d1c2898a9de25a2382c76d3dfe4c052c785ca7531e99d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B27.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C48.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit