Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
libfolder_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
libfolder_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win10v2004-20240412-en
General
-
Target
libfolder_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
-
Size
7KB
-
MD5
ab83d435f7ab7bd4e2176957eee8c3b0
-
SHA1
3d390f0344d612b9c473b470fe4842db4f3541ad
-
SHA256
85847e88234f8d995c0deb8c41d8aea07f3304449fe7b622d98dde80a12e90fe
-
SHA512
f47245d4e8e5f6ef7aefeb6d57f0b41189f8361f75fd61b1b7338ad47608d96ffb900615e896c194ac093a2206df8ee3f69991e055718f48b2109b8a184a6843
-
SSDEEP
192:ZFvTPMcMHyOv3vYviHv3vC+vMXEv6v5B/lo39vtvKvnJvavYOvKvdUQE8uI:ZtPMcMHym4Xz/BE8uI
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000bd92c5e70799bf053934054b6011e1932fbf42443f8f86a18b5b412dde9cd582000000000e80000000020000200000005e692ff252fd41d14828aba948f4e70e6fc5c941888631addc2d7c5cf63109b8200000003491e09d005f1745e27d093e4665159b192ee516988f313d4859feb4100b0cd840000000c5c22f9087ee09f80529a46f1360f4a2bb9d300eb3880226664a4c58177ebfce4769d7c2f978ffc7096a2628765c333a412d58116701e9dbe4a4b6f0e6f7cfce iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d014f2124392da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E5ACFE1-FE36-11EE-9BF8-4A0EF18FE26D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000003866bc081acc39a8b0f0927793a949fad83922c0c70636397089633f2c44a08e000000000e8000000002000020000000f518290d86749eeb261271abb8ff13470af4487a761e944d80ed9dd2d50eaf6c90000000d5a9fa361b9e5a387d76231887ad6b19ba52d0abb535fc2e967c2ae02507cfdcaefda15145649eda8aed7e5273c4496ce59eef9cbd9839e1c665c6149ca06499baa02425c9039ece76d26569aea83c5f3e1b6ad875452e72dbddde5336cb6dfc9e1783d7704a9c4484da7976fc73d14920d3a0a280261819ed0f771d8dcb236b21a1c5be7fff94cf8b42b2dbdd653ad840000000f6284fff8183a41d425111ae6257167a6b644a7ee058c58ae7d23fb1a8ec04c6b4aed348b3242a14318ba1a2b9dac318e9bbbb57e6a42334c49b2c4b9c5a677e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419683810" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2040 2292 iexplore.exe 28 PID 2292 wrote to memory of 2040 2292 iexplore.exe 28 PID 2292 wrote to memory of 2040 2292 iexplore.exe 28 PID 2292 wrote to memory of 2040 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libfolder_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58709de0bd4afd8068697bf4c2a50df0a
SHA157ac810c3cdfa47376eac66f7cb6282b0937f1b8
SHA25677b31321ed9446efa0a43971f3bc9352e4faef06a4a1f07791f88b5454f7dd9f
SHA512228699e51ce18fddfcd30dd3ec2c0ffe18d646bd6876e2eae660effacbcecb1fe22f3359ed8776a2cfe65f723c9dfd2899d4b9a33cc66ca515bcebcf16e075c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555114c3dac33f5681b21ce6b65e362b0
SHA19144605818f0ea2addfd641e5da5c3f7e20c6157
SHA2561eaa78524990dffe4e35cf875c4cafed1855fd6f865640068a20b45af30270d4
SHA512bf827c7fde0a35a2fcde02c1af5acc2ae2bbc4054a0b383df9acdeb23f76605cf5950eddff3efc164725d7dac3009cf27721086d48a0f17efd4e82e47852803d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54404cdc02d34a4fd71ef3acdf282ccc1
SHA18f76b6b1e15a286639602d0e2c8e216c979844f7
SHA25670a04b1f5aad978b7b5434d22dcb78e0e54cc23fc98dfe5760a75ce1f2593088
SHA512a5f82accf7ea406d70ff210ea4cc2e95abe8a7f313da5aee6a8da292f52c86c55a902ed885a2a7607d98963d4d442bf40019f5870ecab95523956b79375578f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512c4d2748ea4a47fd7822478df86bacd
SHA15ee6175fb3f86c01855864ec64cf67e0e5cbd0d2
SHA256383551838624729aea5cb9e1b1387049ac76cacab316e279180542b3fd329daf
SHA51227e62767c3f4495802d53c1423b70ecb124dfd403cf7db41e6ccfec00d4bbecd5dfc6a2526b730c1eb450a83532f5a5a11622a836555a4104997ceba3e2cf3d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569b179cad83640e7e7a2ad880dd4d538
SHA194b1b5f5a03fba9cf4d2f94768e6f746f197f0ee
SHA256f980f0abeea4985bbee821322a1471109d05d5cd8c281b6ba57209e90268981a
SHA5121007dd875eb62ff3c7ef4db4e2589168549957a83aa470e889f43063afc2855848a9ad668da59c0064319dfb6feb322929e1b6b054e3e4d436ae66a35cfdae5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5802183b67277ce9119b9fd8d500b6eac
SHA1950513733a8e7cf42fef181fd2809fae7b367786
SHA25655bf62d21dfbad16c3f0f5ef887d36cb35175ba323fb8cc5bd9ef4d26b0227c9
SHA512bb783ad130234c3c1d6a2445488ac955be8422fb883bfa9a52eff1405b3d9eb5c8033fd5d523db5254b88eff54eb6942ff63a1732222860184f4a647f409c53b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5598c0128d9a7cb10c4d6341ad51964
SHA1f4a03d75ab3166cf7c62b7f98cd7e43834b60c92
SHA25685793af29e18d2bcb9f878a8e2c0a40f77f95d5785042223356ecfc990809753
SHA51292824191dc289caada04b80681c36d5f1185ed3dde5a97a8733eb949032c5eef8c53f07e3c40bb7c78ea2969a79aa3512b9e3ba7e9d15fde0bf4a4fb41a710a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5612f9f799d46a55a32aef2e8dfd0d59e
SHA15af610af5ec942edb3910f60c098688ca846b2a3
SHA25684ede7a80616f19a69be2281409cd5e5a49f5d82f53ca1d55248a8d932a9ef93
SHA51211bc276d99320efc08d774dd50c84cef60c8f1c274160728e80109ccb1862cacd2bbbb0986d246b7b45ae1afb7f0f225ca2eac1ed03130ae06b15461dffba490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59731d8923f08ef532fffdafaaa122028
SHA1d25b61285cadd30d18beda9cb37117bc50423900
SHA2565d845fe6c98fa5d74b8882c4a49e266f2c023fc45cdc67f132b4ced264290c1f
SHA51219c3d65e2f63f2d0b12378901fd46a72b925d9963f9183117895e7719a27cd8e0251a02a36493a9b57c23fe623f95390b7d092700bc7dfeeab880e89cf2af938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56803e34fad10c53126792bf48c510a4b
SHA13705e469e49c2fe190fa091d1be31dcf94a907a0
SHA25622c64cc958416f78496ee0398ea41cf2cfa915d3e39d1166e938f9687582d788
SHA512bd464d2c9a07ce120bef84d073f9a24bb12710cb42b666a148305575a671f079835a74950b8fc2a059ae9f6e9d0bc9a47147dc9002f1806f83b087fc697bd959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9b11aaaac5f59c6c8b24793cf103e39
SHA17c9964ac424a4d219788fee5b7097d5938f6c18c
SHA25608ed3d942d24032860a8ac92bb5a35879e8a920ea73cb63f656ab778d2083c61
SHA5122bd931184f418743b793a90c40452913d71f4ed2b81830c9c44d8cc76b76fa93bbdcddae47f3722b41bc22fa189976ba0829065d42ec9a03e899257f9198c3c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bdca560c6efb5f0b423a1bf09329bbb
SHA18d1bd8dee74eacdb041c5064bb157402b77429cb
SHA2564e9e6c3624f67e0a242dc5e3e7b8067d7d042e74ef2437815392df3b84227153
SHA512907538058b60c59bcc8c2868f7b6670762f25c3fb8dd17df56ceed8fcccf920e9215eef40eb47d09aad1ea9f551352385764f39bc0f01d15b82f4f551ed89b12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5223064be30e1f75263f7e5e1a8b1da
SHA1fa4029c87402ea1cdbaed635863e86d403105fb4
SHA2565739ed66080980aa61283e110da2a98dbd6c5bde8d9e07c981e8a1c9f8fe0593
SHA51207cda300f616995c7ef3d4783fff2ce4ac8e3817eeb61cf7cd77394d73fa1f31e47f81d3b0bd0ab2291d9270e96143b9934f86e71a940c5ffb265244ad6d7c6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c8a7f5c2a6f5d98f4564ae97d4a67d0
SHA164157ca4c24bce56d03289f30dee64abd80b972b
SHA25630ed0936cfb51a4e51f73874c4aa6be29ffb73af596804668450f5257c8209e2
SHA5124f2fdf990ba8c247e99f7f25e9c9d27b9379cb7946d0d1c88ccec641c3529aabb06fd4bc86cbb1a8cd79415ddc06dd80c13a0ec6de4ca55d1a50ff6a1266b12f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2efb7382056c4bfce82d48ea85445d7
SHA12dc4f4feb5cf1b7e84be1d45f36b3d9f4fe05838
SHA256119e41168ef15b29a66fb4c7f1cabd0f9626af0471a4e037a37145a29bc02038
SHA5120dc82231b8269ae09037b6ee9aa5d8370482fb66b2cae9d3bee5031f6010a8b252db64d92db1dedfce743f0c69a01fafe8019c42523c0b9ed5622d2d7405165a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5b269d67672a309618c7084e3711525
SHA19cf019df63acc67f29a8b955040bc95f6edee05c
SHA25628dc6c74396c4ad72da61b1ec307da0b4dcc0ce02794d15bac9ce93296639649
SHA512c4efc9dd426d502a8c063b8fd6f708cc330ea5ff45049762ee7acc99e9a9eb41e6bb2606c4823b3323506bd5113642428cb3f149ad87f947406dd3d5a2490c10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558fbe77a051982dc0b559798a16b5996
SHA10485e0390804e86d8439300cf7efd2baa765b72c
SHA2562e99f451de35a6cad28f7008ae94935957a01e220282f688fde49a04ba9482ab
SHA5124a0b61a949d0d32fc7e1e0d81aeba55ecf69ccae184703cbcee137506e991624921c49eaa29e0d15f5c4ef14e22625a85e1e909bb4aa9e5c61fef63085b4e215
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a