Analysis
-
max time kernel
134s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
libhttp_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
libhttp_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Resource
win10v2004-20240412-en
General
-
Target
libhttp_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
-
Size
621KB
-
MD5
f04107cb06323b39d7116be8576191fd
-
SHA1
2232866ed31d41e8e69b1ac74f33e213f5eef4b6
-
SHA256
00d1e2dcdcd9eafc26bdee82f0f0bff6ca19b5b7d6069e3638bd286c9608b644
-
SHA512
26f6dfdf8766e56e6a8cb90da2eef8431bb8201c0f0158494c6f4146df763bbb38ac4af6340672a07df0e154671c51cbcac3cb2ea141c182e0773f2b492a295a
-
SSDEEP
3072:0h/3ABnuYFEcsQIiX48CUq9M8GIAr6afMNTUXAQ0WYqXIO3/JK:XecsMX48CUq9M8GIY63NhQfYqXIO3BK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F871B291-FE36-11EE-B708-6EAD7206CC74} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000007a22d1a881a81cfc2b06d819a92786dfc1571d63e0f52a89fdb87546fe75c141000000000e800000000200002000000006c10301ef29b72bdb37eef8a197737956f0ce7204707a4c0a7420e9fa0e56a790000000e17a7c72343ef54c289710a6d77cce920a3483fb6631a44f5418d3fbc8ce2ad91807138f0c778e0dd15362c8c81762127fb8813a1b6be23ebc559b6e9dbb472ef8ad481f249bdd736c74368d5f315b358afe1ff908c7d20467b067e6dc76515fdb115d988d3fe476c3034fbfdfbe687f8990653ca69af5488743cb004bc18447567830b1d0d6a2449d301eab1cfe5f2140000000ed711ecc798be18756c6b96a6298341a0347560a2918dd74b171254b809ebfb8b7b8ea17ccf1f619c824c768bce2ae8d6107ffbdbb182cc847c01c1955d99600 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06533ce4392da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419684123" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000926e3d3e3666c416ff7f66a43fc8a2dce1ed19d8f809620d95ace568ef54dfbf000000000e8000000002000020000000c1b1018f097c47c7ef6b93650eb165157d9f201060fa78993feb168bacc7cf23200000003d15bfe865585c71639692c7272796fd7e097a21a22b4bc095811f26791485bd40000000bb2c27d332bd7755c5370ee79f47039508e8777594cda7d94949aab934310651b1c4ec2f450f45c5508a5f5aabab5d7314368ad318d6a8402632413750c4a375 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2840 iexplore.exe 2840 iexplore.exe 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE 2948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2948 2840 iexplore.exe 28 PID 2840 wrote to memory of 2948 2840 iexplore.exe 28 PID 2840 wrote to memory of 2948 2840 iexplore.exe 28 PID 2840 wrote to memory of 2948 2840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libhttp_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f26ec73b24500700a8b6650949c669fd
SHA144e255f2aa23135e60a8badfbd9542c1e34716e2
SHA256eac1eb882dfbd0fdf9d3efa7f64efe6d489538d71e3528f55b9748445a5ffd32
SHA512c09525e4f7d14f09d2b8605648121308e79ea628838a70b161e4703a65101b2a8fbd9db9617e8831f2031cb8aeede00340140e99b4e0217628169e2dcd9c61ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5941a075195b5cbd1ec350c4d0f244c58
SHA13c26ed873f9a70b98e65e0ebb6ec7db678796ae2
SHA256af2926e78f6555ada56147af6e25726ee31edbc4daab2654d651b4e0dab3cc06
SHA512dd1c034ea19cb84585dcef73280864134ce54b9b124d1f47848c1f8cee525e05b5c025ded4576aa56748130ea3f268079dfc56682ba9b8015545dfc48bf30abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d809fc6bfafe80e4b38d9fedd32391fd
SHA1d4ea4e6f61ed61c69614f8f51bcb1fb857fa9fb3
SHA256109972fb85bb1a5e083d8886e4dfcdbb0f177b3fb78edceb41e3845aeb2f4fa0
SHA512fcca4df4ae23aa1f9d1e2868842c9ec82e00eb64e85597ee605eb0e3600971d9d18db84fdd31695d5279232a960b9829d47988165fa95a84a10d38194de6bb90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597690e2b652b8fbb9a3a00eb273b9aee
SHA11c619b60b71891636a932bbdd081cb80ecdda0fa
SHA25677fde74fad73bfe0e80a4a9b2e7a24cdc99ecebac8b4c504c09606249da80293
SHA51286cf6bb3a68d5248fbb4940731388034493f873079d088881aa0a46075742b503fcf91fd23144721ea5f7709a66c9fcc45aeea36a71938a6375f2fd7e2f0d4b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5237a4d4957fbfdfb0d144bbc00bd6d47
SHA17b2b307631a449a948c4582f6b1a11b3344a8953
SHA256985e44c5c1df70016456eea7ff9bb9c13f1a73398d521920955cfaca921b5136
SHA5120ced1e2807ea29c11a87f0ba63150bc57ec2c57f033dde9ef5aca1f81b8978813544c43df5152ca41bb9c1155b9d65031fb48a8779aa33fb038fd541ea12c4eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f2c799502805b0f90da987dbb336c0a
SHA1a296a52206d0282c504c444fe2bbaec77deca192
SHA25696fc4c66e47554264ed304b173a0def16f05cf2d162dca31cca4f9975d0f4e97
SHA5126f370e911111b99e9e2420c096460148da7de97b0be78132cb6773a34be99207cceec5309403ea0752d0d978e658ba031c20d0d7d56b6296cb1f75ce23932848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b57d9ec28f4cf4ee485acc44212982e1
SHA16b2797f0d4faf2cd54c67b35e78015c1b1348621
SHA25610a3f07728be1117f05c350202c3ccb48a2b1de7e578410b1ab9f1576029a84f
SHA512f2feae63c0c96d33773c943dbf05266a42037c3e57da7a2fad21fcc3421d3c32a50cea0efc2571134f82109feaa861671291392ecd559837845040be4164957e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e70f909d222c0ebcb4dfcc94aee6b56
SHA13929cf143cc861f48d6554508c713c4ccae7e77a
SHA256969dc2286a057f918fad6ec31198662b9f82f065559db304389f1b144e675ac2
SHA512ac384c5ff49ace26091783f06085dcfd2d7062d87af56ef3020c484fcc53965b5d0666fe42912dbd81401d9fc15356f6377691197192061ffcfa491d11354de3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d770e24b4ad31a97c94241942f98800
SHA122f46529d974bd35f66cda908f77991647b1c1ae
SHA2565d354ca115280f73403aa5c5b3a3bed3bb874edda3973f7b44aec13efb3885e4
SHA512f33a6cdd59a2ba3de518f196d036ab3115345408d70345dcce5b147b9eeae16e9949b39c87550062544fe342de8888b67e396cbdb4266b9f053ee26c8a4b381d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5408f986c3e05c02c76c3aa1515d852ed
SHA1830ca2e8c0ed1094cad47f93fe1673b16c74770c
SHA256f0c34b7c7d6b71b75681af92dd198b0bc05196e6658065e5ee1750943c20bf83
SHA5120e9171a78a3d631a4a73119bbf30b6f73555b1ecaa09761cd85e8cc5be44a0df099bdb56d501feb19aade7526b52cb402670678e40b08b6f63cebc7c95a4ee82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547d0abfe04e0df7b1d4dd819b7082017
SHA1630c7d49a13a2efc936278f904df96808a2c59ef
SHA256b86f307197620714d783fdd3f8473da5975875bd484de7e75d9986c169a27be2
SHA5122ef2c4078140a9a6efc5450a4a7e9c08ea6ac21d814706f07b219015f3e10c4b9cfec73070b127845244bb9b70f968eff3cab3fadd05fd63557ca3637c6e2a39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9954e5b62120337a5cc9fcc5a658c9c
SHA16a63018b70e700053b6eb08fb5da2f3c59639300
SHA25613592e7a2ce6af1748521b61415dc8fa008300accf8ff6ff8fc44724668b43e1
SHA512abe5e4ef79f286c67e53127db754ea9552f646c72e23d263ea343d9ccf1a489933bdf28c4eeb63c405d3ea178c8903111cbd3e76d837c8538c725f084d10d603
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff2daec2553fd545ff823dcf51135d5
SHA19b2abff053c206c3e2573e9118e19945a5d34c40
SHA256989119bdb5503157fac940bb99d6c2d61d1a0b04da9178d668d9678b9b246e6d
SHA512d853ca67b6d395e5be9e4bc3d6ffd0547ed0282fdcf341e5177d29bc5ecd6a6e2b7b14b90b67b2e1fc907c8f8b510e01a0daaa7d8c1d5f3d38c983732e51b271
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5141b7eeeaeeb525ec17028becee09412
SHA1edf17715b5c0555ab6a5f63c06ebb046b5e56aaf
SHA256fab00fb906f032dfc5abf2069b505ef5f75d04e5061b9b73a30996962d486424
SHA512f1b0385bb1dfb0fff7e85abcbde4524b47f9acf3a707fb23866fd94e389ee4726672e08b3113de8c954c01d008ed1bd0074c1cf8188b62c3cba9e2013985a37e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e959e4267de687987e074f12e3e3df6e
SHA1b0c9fbfc6bc82a4fccb765436d597d0cf0ebdd6d
SHA256c379c373d847ba06963e38e22bea1f86a218f704d2e7c57988daf56752de08bb
SHA5127f42f86e589966125ab719a68930da9e69f2c97d65890ebeaae4d0a66710d8ba2878f52a4685acee6bc58845ff35d67074ad9f289326f59421d316cd123b58b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588916d5fb2e56d755d3bd0e38d1a2e73
SHA1668138444806427679a991e43800bb93e5821f6c
SHA25606618f9d3648b183740c750c984c8b0fff9519e36e2d0bcd55507e045079db75
SHA51256fa8eca763a31c4e6d0e181324a3dbdc24d038381161603168b26f92f561eeea09d8536edb00f153593e7c846d9ce5eeff7c3d21be1e107823246d5af16a655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5828ea630f2c573bf05ab8bbfcf7bc89b
SHA1eb639ef9b1b0a0da2ef7c0bd8d1b990552e772d3
SHA25610e40dafb68ed53c9936a3638ec39ff84cdaafffb5a3023b3817ec550ff7bc7d
SHA512b422bd8642bfc9bb1687cec62d71c186bbe60800c7800cf8f785a1b42464cac8c6ddaf06628233fbb267d073f22b73f83cb1ae3e2cc31ee6dd22237c0b6e88d0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a