4bb2d2918574f1127a6420513e8197d9b701b5a95d3a64afa86171e941220288

Analysis

max time kernel
117s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libsap_plugin.dll?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

497KB
MD5

d099a3dec6b1bc2664e2dd27c56876a7
SHA1

bee44d12fd7903dfd899dfe0aa5bf34dd547c04d
SHA256

4bb2d2918574f1127a6420513e8197d9b701b5a95d3a64afa86171e941220288
SHA512

c164fe127e10437545633860ec4c6d4ea1093702b75caf74a72c6d001a6f6c255f73763b1d1f08fe082ea1f01e0041c57f4f027c1645be347b5470bf5b985cbe
SSDEEP

6144:BFph+0mVoScQuz28CmJkx13x0UXIvlWtw54fOSX8e8BoLAj7kFDW8:/LWoquz28CmJGxx0LUAjAx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{579171E1-FE3A-11EE-A2DF-FA5112F1BCBF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419685571"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209d2c2e4792da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000007d8fcdb615bfacf89e72ecddd8f5722a24083677320e6cc24109e61883b82046000000000e8000000002000020000000fbbdc9d2dff604a4b445d635b29426afd9608f0152323fc349e71691138f1384200000006d9514f2d63ef7af195f197c9beac6dff271ce4b0781ed4c3b2e039a6b51ea7d400000008217aa19592295707521a7b32b7e84a7911109ec4fe6a1a06c0f2099838a611f2a660014e9f87264ce452288d2e30017af1822e0833e9fc5ff268b9cf45df709	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000006406d57b1c08c66e178802bf0f7c3dc10a7803ff31176de3490b5ce66e0d1ab6000000000e8000000002000020000000a5248ecf6897a584f9076d8cccc432d4ec1c8e32b3eb7b917ab24fbd2ebb4aea900000002d605139160a574d206767db9800d9a35ee821745468ebeeaddf5d65e8ce82e33a7a8e20dd5ae01f09c533e3f1f3f13e747f6006404c52c68c78cbfc4582de4ee9692b1d20a1b23e332a090ef6e0dc0390f52985dcddf68bd21737ab6c33c9ff618730c364c011181a58bb7f9ff679ba65d6206cb2a40aae7bc749adeda69246d740071c83cb69dc3fe130805a81528b400000001a18bab920673cb098d81bde2233424b5503cf9d54e6a1a40c7baa170f9af023139bc9f0aa511042c9e6796ea08fa54eb7326064255717276a08d5c8a29378a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2792	2192	iexplore.exe	28
PID 2192 wrote to memory of 2792	2192	iexplore.exe	28
PID 2192 wrote to memory of 2792	2192	iexplore.exe	28
PID 2192 wrote to memory of 2792	2192	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libsap_plugin.dll_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e2a2842f920485fb8b31fcf55c1af7

SHA1
f864a7f6fd36512a21e8a43cf17b758ceeb21e2a

SHA256
33a264dd4267318d954a8248fb86cd40d1a26cf1f2a815d5255197c94d7b8d75

SHA512
0aff9b564dd4d6b3c5af143c520a6913ba2fa24b6f3f7358a3a8f26fde4449d51bdb450feb8da290539b48d8149d7adad046147bbc36430fe5d848fa370af25a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a2c1ec947de34daa200dc84d5ea40be

SHA1
170fd21939998362572c70cde432deb138745664

SHA256
427e37c9aeddc804a9cc100485a056ae6ae4f3d189dd32bd5f285611234e5c12

SHA512
d6ab58a4fdd12e21b9e015760fe4b3d39b26fc4a4c0390b60686492683a25df8aa18fa7ad78e5b2d81e8125e79496e722ef4287b381b37483de0c82a9d303498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
90b86e85d16d548b19bd47c9752d6f75

SHA1
fa6f070e328017f3afc75cb9050998c23b81bae0

SHA256
89eab5d450d0a70d82fbaf95668e1405e87884aa63633d370f99e99c0e67dbb3

SHA512
d759e8c84fad3d31c01d325c3671d5c98c0bf9469ae7b78d80a374506ecad6ad3380a08c101153e5a650003b85f92237d885a171cdeda98cc4d424e4e8a6e62b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ed3da49b95ed53d4136ab51e1072230

SHA1
dce6f2a48b77e2229c87209475c92ee37910e41a

SHA256
4b3a2cdd268a293c11f7fd846eea654ca35e212f2c44102d8d3e002ee6263a46

SHA512
f480035e25e6ca1e93286d72e2fc30b9efc7e1ff95000a80243a0b13ab6a70f17666588b66388c91f664a35ce27138fd998f2e4896a8bd3fdf132e1bfa128f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ebb251c70c64796d10258fd59c7ccad3

SHA1
be3b82f036ec77373c5ad45be5cfc8d1b3173459

SHA256
ec1572da18a415ba5416f7fc48658d81e5bf9d2c590cdb125ed6d91a0cac5aff

SHA512
3fde05534689250891feb310c39eb7f35b3d00403ccb16bc6af83010b5a7752a126a4fd63ab059976406b7c9f25a7999af5bee3356a979d20650f180f5536d85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f51454c1181f2462f749776e62f05fe2

SHA1
35e2560b94747d52a60d39f5bf928c3a97382d25

SHA256
8dbeeef7efadf9357614b909bb121006438bb9d4a1c7c499aecc763f9016d132

SHA512
a2cce23ff8569c5d42559303f7ec504363fc795bb7960f414c6dc95fa72f9b8200e8b350620a7b2a7f4c454378be93dfb60edbb8891eadb50ecdb4455125202f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32fab2f382d3389d4a440f1d30e2fafa

SHA1
efaf59e3c1e5c83d81c8a739b720cebd146ff8fa

SHA256
81a6a01589e36beb9163ada8afe8b583aa1104aabec0a88cd4cfccab9ebe9eb8

SHA512
40ba63ed3ba60a7a9a2baf64e3c84c8ab1d3bd09e37d7b79df595e7f24348ff698dce1d6e8b29a08ab382b21001ab1d88d2f507825bb178bf4924413b21e83b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20f9fea6b95c80437708e0d7a3cd3726

SHA1
5e6536f7b12814baa63138df1df71ca9ac34fea6

SHA256
475fbd0a220ca202df0ceecf2f383f30407d9084004e7cc85fe0087f235b9c3c

SHA512
aaff2ac6d01c154af03de92c5f5f69739913c1c149bcc4892c43430396c1f46568685a7400fe736836e9c6680681d8cfc404fa9e9db80d8dd0c11c90237b7153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b070b291f1bc04a15d638d73c27bfada

SHA1
888d91b23070022f7872cb2017fcac88e49c3a94

SHA256
afc6b949b616917bf8242dfbaee6582db1f8c891c50486c4b1a8805b07546e9a

SHA512
1b79b9064693ab50cbe54c8d2febd66e552f76967dfa9152b50e58535e7b0ca4e1d28b505c8923e16e2303904dd12f8181b4ce7743de24b6a01b577fe7e9067c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94555972aefe8e1ec4b231d6a79b8df8

SHA1
85c6d87e2e1546479ad2e31d168e12aef5dceedd

SHA256
b5205339568629e86b3ab0e78de9cb9a195b0ca96e77e31af9c2210b6b99ac26

SHA512
9c49d4d9ab7ccef00f03a5f835c55c3fdc6d212b1f57fdf90fc66e518d28c93b748dabce28ce7e94933425d2616463705ac2dca99f179aa114e63f0f49b43e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9db6010c4ab9e5dbe18cb9eccae5ca11

SHA1
7c8334a7cb19d24a6fcaaa26501bff217c5222b0

SHA256
9449b7e908a32e9368039f3913a15081c5468be9a7e4b5b197597d50368d1a07

SHA512
f64018cc3df073a8c0b56b0ea0cf62b676ac0d83f8c6803bc39334e640906c5c0afdfad3f4e550566b11681cd564d6894d859b12a1c43977397f027174b0f7ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bff893c9d2a0359a902c98ae8a560df

SHA1
898e72301d09e92e2606a266e3a692a7b770c630

SHA256
d4993f6c4b1d5ae39dc7b59a2e4f722b5b7c8e410da1838cbb1a4e1b14939a14

SHA512
c73dce4bcf99f42c9635858577bc9b282d0acb7605399a2cd0f1be6bb75d735a5d8d572bb5df8cd3fb7e2a560f6da48165f1868a39e169abad4911fd7a53b377

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab821D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E3D.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit