0f794559313a7855bc7b6fe25ccda4975b161df367fb5a5739bf8bbc433b3dd4

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 10:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

libstream_out_rtp_plugin.dll.svn-base?id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
Size

7KB
MD5

9f4ee70706e1ea643d60463d6e182532
SHA1

177c92101ac5dfe83956baf40f05e35f74ed8235
SHA256

0f794559313a7855bc7b6fe25ccda4975b161df367fb5a5739bf8bbc433b3dd4
SHA512

29e3fbf5d7fa7e630b748a2aff2410c6497c21df369a06922b877658e8a6644ce96efb535cfe0111cec90c52ff7c8b52277c138b861e44d2de3134c0be3a3006
SSDEEP

192:ZdvTPMcMHyqvLv4vi7vLvC6vMX8v8v5B/lo3VvlvGvhv2vNvGvYUQE8uI:Z1PMcMHyykXF/UE8uI

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000004b4c81dc0f0c70f36ab772497bb40ee31ecab0f45ef9bbb11c258857ceab5645000000000e8000000002000020000000c3999d3ee404693ad075dc48c3ada7ea1cbefd4ae0ff4d74bd4d24966c7ac1b790000000d2d048d7956c9ffa0a6ca84279229a0e5360640252620c36151d416264cf39c882c242060cafda7f87056894c9253d16fe483354bd149f6e452b9de2b241e25faf0afbca81acfed0ce4307a468f7a385a11abecca5e62cd4b924461753852fcb843314fdbe3b5096631d74724053fc6f06f700223fbed5f7b80d5f7d66d9938cd77ab35f62ff83f51db55c12b73217a940000000b4b2ce12b895ff2de83e83383abb0f4d26df4658c5e712bf616056b43b94618e15652f14bccc8a71d753acb1a423cef7933cc6ebf356eede80270604a675a8ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000009e3ad212c992b19177f3ec77097a661f9d6368853fa8a3ea4245a731cd8bcc4c000000000e8000000002000020000000617a74655621af7ec2c27ec5e7605f53d509e0c85082a8bcc9e0974adcd3498a20000000585adf4563908ad143c6e460a732a5392ecd6e99c60b4889e994663375bb86eb40000000938e7375b4c29a23d8115e85ab1bd20d691d238588f07b7b8e59a18ef19eebc47791c97444e72cfe6a9664deadf89007725df94ec23a161e63932ff0f9dc3d16	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001a0a7f4892da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419686138"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A94DA661-FE3B-11EE-BAC3-EEF45767FDFF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 3032	2224	iexplore.exe	28
PID 2224 wrote to memory of 3032	2224	iexplore.exe	28
PID 2224 wrote to memory of 3032	2224	iexplore.exe	28
PID 2224 wrote to memory of 3032	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libstream_out_rtp_plugin.dll.svn-base_id=8328c31dba7c71ee20ee32f1a735d639f9e43928.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0dd9b2ba6198bae1a5af14521dd8b25

SHA1
797777c35e12433796504cb6ee4b0ceda5f365a0

SHA256
24d3c49dec3ea3bf30c2d52abeff39a2d53f4eeba4be0cba982237def6114586

SHA512
f15dbfbd26ebc5225162c167cc9f22873fa92c556a075ded8d9f3f5188736117f0be51d9ff5fb5231eda8c0f1e588e517dc8b4b8deb54ac56e69abafbf144dae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5ab98b575f3475e48b6941e70d76238

SHA1
5730d5ed8b85efb3967888ef6801f5dd929229a2

SHA256
bbe593dd9ec88546a7986508a30011201c16e77ec724380d81b615f903cd3edf

SHA512
9d3a479329439d024c41178803bd188919a5e35ffb1ec29016d7ca09300a12794ab61fc9e8ae905ab4b7fe879f3b438e02ba5a29d39faaac41e2bbd2af8dcced

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f47f3e97e6393abeb74653246627b5ef

SHA1
27414bfd27180527c2a4a24af330479e4a189b40

SHA256
acf02a535a0d35752daf6e62fa0cac07eadeefcc4af4b78d0c27fb3cd2bcbff1

SHA512
8e6a9297c2a9129ee87e8fa62220be21e8e343dc4c4fd5c73fb2f68cd382eb3a4ff7586f04aa43b153c2c32d1f9c00767f44f3ead7457bc2c39750d6de66aedc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
548ae7eb14901fc580ac0c1113fb549a

SHA1
6b320f66e70e7dad8111396c53c35486f5c3339b

SHA256
8fa642620342de4e2075014b254e257161df410f0d689eba0c22ce83c83d57d2

SHA512
1ad4fe58a55d4e020825468ae28ce16a7bad9b9c19549092982328998710bfb186f7e429d2d6f6f4c6e7d4951c34f8b4ab11635fdcb2ff2ac3b4720aac694ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d6f8149d0e32ef80c7623edbb8edfd2

SHA1
5f353c62a7b453b102f7645a7fdc3ac47b560697

SHA256
12a5174a6770b25283c900afc07802ef061c2285199fa10e13cf19d186cee3d0

SHA512
b1904f007998a6357ee840e2784773ebdfe2a110ce498d8dea3daef6d63c3ef60c87497e83c6cbd289493079a6a3d206bc3648a835b6b7c99d900af8f4f49f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8da8985d240a816ea9d5758f08e6135

SHA1
836c986a68b494bcda5e203e1d35180e5603a0f2

SHA256
43d007aec3706d873329fa5ea1983664fb790ca5b5fcf43b1f1c91f5495ec420

SHA512
7a28e15eb6f1aad08e12418975a2961c246cdeb3fd713156ef1683241774477416b59a14eeb3df9f601d8fba2de22b19af234f03c063301f427d22b81f6d6d7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431d874cc1f62b0e7f931f6b50c6caed

SHA1
d4547165a70d38db4be3e240fd78500e634113a6

SHA256
5479321c8ad557c2e9bfce188df68dd59f86d75fce67897f4ff796efb5860867

SHA512
bb12e47a5f2cb9617d95fcdd94b076deea87287c0707127eaa78bb04272b775e8eab7f4acaf901386f594cdbb9a705ba3e0e177baf0a89e52bde8339752ae7c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f32744fdb0837ca4b62ae404c8e3bbb9

SHA1
814964e42ab1db594c99480c8f0dce6c9d5fce69

SHA256
003cb9955c5ea13148d720cfa4158fd06208c86c42da9f7743c249f6df452049

SHA512
97701c260a05ac8e9af39d30496bb78a765fb5c1505af264f91bd70f75a98602288436f8b249cb23f7b88eaedfadae71949f138d584c70484189d555e5bc37c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42a1e6d0d5de0a6f7772fc93ed434b36

SHA1
944b0afecbf16fd4695b71d0efc89a3fc7194d70

SHA256
6d9f8af0e1ec26690e7b6eee01d0f44de61ad7edaa0dcc98afb6bad24f9e2526

SHA512
c02ef7ed7902f801d866ccbc5138e8a1613fad5c453285d2c630775fae64d181607db814f80d08eeb77415eb12273146913134a3b3332561ec1a8596e4556ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37834ba55b149a8a97b4344ab9e75673

SHA1
b8dbe9f5acdd3b8b5f63c3f04dfb6757d977dd36

SHA256
36c1f803c7967cb469d2e9b2a4426f66274337fcb5e3b485efaeba0205dc658d

SHA512
dbbe9afd6210d61acfd8bf92a76e9c961737bd8810026ce288b2a2bc91cf8e487145fdf63c9eb7daa247754cc25fd85f6db5ef8da195dd55f71234aba4113b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0682a6a775a737dc73e950f01a540fa

SHA1
1da1e59cff921d2e47f5243245601c2900d8cb7e

SHA256
fedd8c4f8d49b3b3d1e29ad4639545064841ac4670835aaa075466640f2b24b7

SHA512
d32b3cfc043b39d6f24e9f24551eb968ce04d73aa8288ef4359931b26f5c55b58fc0ef6f830eb0dd7cb2d89c619376ee81c389943b90fade475ca2df45b64fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff873d0b106e71f3edc66be6179c3a6

SHA1
0d9f93a5f2cfe54ef248a7f20b45aadc362ebe5b

SHA256
1e143fce23e4e958daa5b45d1b4ba65d3e207077094100a5f370e2031eb30fa1

SHA512
17541dc6297160e6365e8e12f13e7fdf86013e99c910c14d4b8009883d562efe275819ed894d099856313a4eb52bd4b2d85e6e0ed87354c9da271d5d27709753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ad4962656494f64891b08e0a91718e1

SHA1
5136fb6cc21d63fb4e7ce169db466b097bab3532

SHA256
f44da31aa85d0832305b47d1f68ecad911c20f254d962a14dd21789db1a193c2

SHA512
cac2cd8ff79f1fdbef41be45c1dfb2110f5ea75ad143017df27ad9b3f52a00170361a98a68b82ef35df69e428a7d1961919336becd095f830b2f224259095002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71f2512045e9d9ae03573067c6884389

SHA1
b48d696a166e9a7b9cff09074a9b339e340dea8a

SHA256
0d7bbb513801b0467fe3ff54b3fafd03ab56258f9d7e32bf35359902019433bf

SHA512
e5e53b6071b1ec0dc7b4a1918b281789fc0e490408a14fadad2190db376bd4399152e91781491b190d477d5108ee91477089bfd66a6a94150f485c6292cf8972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3c76d303fbeaebbebbe5be1af0f0c98

SHA1
cfcf3cb9b2d537768b421f0086847f162ca325a5

SHA256
c66b4d9ad2d887547923219f515fd4a4351089a7606c5eea200435f3ffdde07e

SHA512
0b6defcc9a20642bc7dbc72fe55e5fbedc9937f1b4a3978b62344ac4a47536551391096f22cb7e22b97e180ef207ff3c3d0be644058a3ec330e08ca6ce149d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab713C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar726C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit