7aac638a7ccf8a5d8ccc82fab797ce6f7a8cb7403de2ecb96840795dcdd541f4

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libxtag_plugin.dll.svn-base?id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
Size

7KB
MD5

f819cfabf4798b3a6c65492fbb35fa5c
SHA1

c69d9e69b86990bff2005cb39b09dfca93b30faa
SHA256

7aac638a7ccf8a5d8ccc82fab797ce6f7a8cb7403de2ecb96840795dcdd541f4
SHA512

ec57f78b746d85eb4af7837eaaac7c6c98070e5cd544e4c6e0284d850d5aa2c75e44363167418a2f4f0b6e8cb8685244f008c54163f37a9484c261e7d09bb38a
SSDEEP

192:ZzvTPMcMHyx16v9v/Xv/dtv/KvCQv0mXHP5BxUBv/fvST/lo3f6vvdv/Fv1v0vMj:Z/PMcMHyx1q3dFBmXHP5BxUpiT/2qrBN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE3E7901-FE3C-11EE-AFAB-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000165988ac4c68545bc0477203e2c236e095ca9d89eb05183ca05755e8391e109e000000000e8000000002000020000000ac0ffaff8e47b909cb278e2b1946de3dc5c79f4adb298eb09e433f74d970b7749000000084961ef4de4db524eb8ee78052a3358e37ee9222c10e5db020fe03805cf3ef466ba3470b603a2a776233abd58ce0e1de64c470cbcf23450a6695db98677ee09328265836cc1460b66fb93137dc1c9ba70219220ec11679ba415946d73a42f2c3eba5030dcd01d39cc7e95249738165c962db2a78a0f9d22fdb883a48e844514335a2390b244bd708650dcdd869f54634400000005d2a42eae7527ec50afba84adb7a498b6ccb543ab665137c58beb870248fc03982e3b2dc5f86d4824bf75a2027c4a478344bd75965388e0303fbe52164152bdd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419686710"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000303fd9e5616f45a6151cd280d2a383f7adf4a352e6334b0a2219badb539eb3c2000000000e800000000200002000000050f0c7e8900d3c225b7412077ec646dfc1a68f98fb0e391847fcd055f3f3a3c9200000001ad7265a2a07829edab47b000e362c2bf9c17b2a5bcea05d4e1b1c7676d5a5a34000000016aef45ebab34fd5ed449081a82afe883c05d957142fda9c3920c3e16258704bc522b10422d7e68ba85d0099c0eeeb892a98537f7fc63488150a8c320bfad16f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000df3d34992da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1528	3060	iexplore.exe	28
PID 3060 wrote to memory of 1528	3060	iexplore.exe	28
PID 3060 wrote to memory of 1528	3060	iexplore.exe	28
PID 3060 wrote to memory of 1528	3060	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libxtag_plugin.dll.svn-base_id=3053a167982e379b031fe9fbe2a1d57c23026a90.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c09c6217c1da6ede36bf2ddfa274533

SHA1
003cb3e382f8dc8af158fb4ddf183ddfbc4dac80

SHA256
2de1f1c6af3316a511a9abdf8ceacf8b04d3a0ff595359470414b729f40e3ce8

SHA512
2d2f9c7f113be98700aab9f3542380e208b84dd05e34e586ec7b060758610de2e58a084f600fe928d1f420a7e3d0a40b7c96a4271565ea6a3551b05755f90718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
243bf58d702511ff6ac554fddc63798f

SHA1
fdff3466394c31ea9222e4d9bb996d13d6e3bf02

SHA256
a260cafd7aaa01c509443bbcbad4db4e96422f4ae6525d025b0bf9c00767a35d

SHA512
e4813a6310f78efa5cf4d9a7b0dff766f0a946ccea27095ce26ec8d2139365909741f535fbcc735e8b5a4bc6502e64b016791512eddf1c12eb3575fe3ac376c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc3291cc37f726278aadbfc6330a7a98

SHA1
c92763dcc9f1014a122e0c6ae652dccc4da4e35f

SHA256
4e6d4e805869fb238fa4f6023795735c8eae86710a012c4de0209f28fc55ab49

SHA512
a6b6082abee94a2b28fb8841f516bffc6f818a9917bd664b388685805b79ab0768f91bf876bc1cc4f66c9257f960ce13ebe826ab19d7d6d62901aa87f1590211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93074f1054d45c168b7129425535bfcc

SHA1
6ae9c1edf0aa74bf60aa13246b086cc80ffe3deb

SHA256
fd5fb47a86d02e1148cd8041f5c87633c68132a65136eb8d78a9eb5686e6aa32

SHA512
a53aca4d57895294341fbc6d71abed64d734fc32c39ad75f42b82ed21006bffb1563616ad85d1150df4f124ae8d82e17978574b175a17be3c94e276f7b7e4f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9b30a192014becaa440c409e9a392aa

SHA1
2f5da2a547dd8fb1415c1700153d7f90406bbd2d

SHA256
9e14e4b3e80aa842bd272d88b43fc62a8469830dce5a61cb609bc9d20794c78a

SHA512
186aa6866efa44b1d6fdef764d63cf55a8f8d83cb68824a470f7c4837136150ac1bd7a8cfc097ce2d1b8c1e60de74fd74e4c4dc877abdb77214d59dba432555c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73060922b970bd98e15e5125a53d0ade

SHA1
6f0dea84f0b7298a6ec001008dfa38f53c32dd12

SHA256
3a6ae67d070783fdaef29677bce0f6f85af387ee448dcfd79d442be714f03682

SHA512
1dd68e45bfb8abc54965fbb91986c8c267a7ee7b3e70aa04e9edb3ed7ab7cd0afc4126878d1a87fa83989764f2f5708ff678b7f4487c767b2ec29125212fbde8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea6e43a28146638fb8429f7e05ba8e04

SHA1
c92e9098d8e5cf0099d63ca532808e6aaf1a7a90

SHA256
70aae464d5b446348b66075cb8b017a63383494970aa271cdf4b1b4289682746

SHA512
b15ec831db6caabef814c259b7aaec7b8e95657d0cfeec43d546daf9950b717c8e96590631b23a137448c53be0b5b5052e566199733923f02dda787a1051dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf544ff840158be70eaf6ea3a6f43a8

SHA1
e7f280b66fc6625bf34f0f11cce5e20c0e61b356

SHA256
e5662d0db725799482315c35fce86812a13ac65be6b04905161c18fff2cd5082

SHA512
8b5b3c8d340430cfba0ccc5fe9f4b7fcb7a1e2accea09ce920082cc78a130db514b83ca3f7418bc380751b91646a821f0d6d9e6794040306a50f5fcec7b8a167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a4df57a31db78af4835121eb3d3203

SHA1
6c45b3e2c01c808459dcc48372dc0fc09af75a48

SHA256
691db3a09369c7dc0238ec5ffb085cfb7b187ec54213fdd12c51ef613c1fd68e

SHA512
9f5d48b24311253927bcf57d1aee7b1558a897436e39aef6468c0fa0ecf74244a1f6078427d99dd042a3696088d53a6483dc5b065099d7b7aaff616ea72b4c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70281a0c62c92e35aaa3420f625ca6b6

SHA1
ae0a35e636cd1c86050f1b8114b6726c0e82e2b4

SHA256
8c90d668f3363deb9ae402c600dd13517f3bf1d804697aeb968baa021fded2fc

SHA512
9165a2341cb9a26c86e22492729f3639b63bd162ec0d4d9a61b7b97a27590ff082a21231ac6ea5fa7465a578279cad206ad87810e4a5328028982000be86fcda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca9fda82f76472ea67f2a2486d2b272e

SHA1
d0181332a6994287bb8a263da98fc1828a4b1672

SHA256
eaa197e078dfe3684d6f9f7b43a549c865a81a4ad078521dcfc507a791a4f36b

SHA512
cfec5ca5801c14aa3bb8da9137241c7ac6f6c2f4716403dab260570fcb1d8033008d12e4e2d216f2b008dff4b4ca4de5132a67909790e2db90f39b4719f62be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b767c89857598171bfd17401be1dcffa

SHA1
c131adb707514a9f36248f5998f3cc18957722a3

SHA256
c51a8c9a2a5c3c9d6f94870bc42930154ffdc748763dad5051143fdc823a9243

SHA512
752c204ec14d80459fd538b503ba80d1726268a3636198f7f5a11138b9a23daf41330e0f1bdd379e27246b5725f4869f581b98d35e8194293af0676e9f0fa2e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f01daff95d9ad8ee5d457cc762c52e98

SHA1
37af13e17a991fd5f61dd7ac2eaf3ab8468422fa

SHA256
b5f34ccdac5c23b9c75352ca1c32142e50be6e39762241e03bad55f8060f61b9

SHA512
d0073fd82c5abddb55f11aaa3365af4407c68f3283bf11858751a134d1c0faabd6265cd70f8b2c0d238e760f1026e24c7126a7bb22298c70aab24756c610add0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ab8bec01efd82fec38174226f77b22d

SHA1
1cb68c22b95c8bdc5316ef0a1c89f8c9f8357fc3

SHA256
38be54e67a7dcf73225ee7eb4d658b99177d53b9a56df98f15a0f8be769bbd86

SHA512
2598627b08c28a6811b1540c8c6ecdefeb9924158bb604d5d61c5242ca01115a55bb06f8e14e6a4c3b812fd06dc7ef16dec73a6bb83e296fe9ba640029c387ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc438714e2338a8edc8b953d3c42402

SHA1
cb8da285bd058373eacb74aae9cd4e9f6c83af48

SHA256
6156c1527208c47c421b1e7e507f21067985c389a05177a8098ce0f1a4293b2f

SHA512
5f917b5a6ead60431cb42d9a20688a60ac2863882517715a45b65fb826ab140441949664fb74d321a6d2af78f6f7dd976ab3051f6127f9803426d3ea859ef0ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfa1eeaebe824b4b16d8aa025381d241

SHA1
7d927c7dce2aa0861825ae3625d2242319762b37

SHA256
781361f70e2e78deffe5f1204abe32b2c5fde31d3d3265b115844d82ad81134b

SHA512
fd59b9245006d172d8cb092ac8fb782a087d29692f0072f758a89e828fa9e03fcb56b114b41aa7038e18b7b93b27c320d194e69395d3e93e3077ee53ad4eb1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7ABD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BA0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit