28e375bfd877393d8b263f58a3c28c63a36f0ba0857db99e66e40b06609e2aca

Analysis

max time kernel
138s
max time network
133s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FckEditor/editor/dialog/fck_about.html
Size

2KB
MD5

9aaedcdfd9fa63430ca0bed5d7470e58
SHA1

7e9a72137a2e2dadcbd1d56be6a287ab1a0c1098
SHA256

5869470ea9f4107e421d1350671b5ca3458e2d544b37fbb256d74154783fd19a
SHA512

bcc2fa434e2250939ef66961e908ff2b5f412a021dfa762bb70f01542113e440a29530332a9548b5e50886887e3679e697327a6b4b9da3a58eaff19135294626

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f7e3b37127d5e5dce9545987d878c225d74f096f6cb2385a04d0a6517b96b98c000000000e800000000200002000000049aca779f967ad923af7d3456aebe93424be17d0d6b2e2e6c1b46fd87678ed4690000000c4ed55953960e2372a17d8a51ecbab40323c45a87887e36b4b7bdf8adaf5c10bee5cfc2fb0210ef706972b864de959a071ada27db45b944a4a8251fe2708d40ae7fe7210b86cd3822cc7f7f21b02a0b103f70a096027ccdd4cd5dc2d25bb39cffcaed04ac13954df16a4fafb38a253324d5ce4cf056e0503559670a5a64536d1562bdafd0b2f7bca07177162c7f5914540000000ca2875a753f35e293b90d0f4d1d66af713ef62b11bfb65be00109c61609de562f981df70d193e237ba9d268b94262540b4778b568a45e74cc82d9ecd89b964a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419749508"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000202480c6002ea97a938ba8d78470b5172a05996299ce29c45732f4c3c81588ba000000000e80000000020000200000008a2f273ba397d945ed33357b2607fef8b0850c44086c387f2a7a4343c8073ae32000000039f2964470697cd0bb8cdfe7bd44b0e24cf3a0498153c0c33a540c240684029840000000d52ecafb601f2321c73952e50c6e3214ff9cdda803390fa2f3cbcffae4eadba90bb5515b41c34347b8aba7d08cec4c04d0039f16f5b9be479f598f1fbb61ebf9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70507e07dc92da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32EAC4A1-FECF-11EE-B804-569FD5A164C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1444	iexplore.exe
1444	iexplore.exe
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE
1652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28
PID 1444 wrote to memory of 1652	1444	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FckEditor\editor\dialog\fck_about.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1444 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca75288de4f892c6b394282115fdaf5

SHA1
3436abd70705d77079f93bd9df027c78d0503d2e

SHA256
bd1989f9cb724858d27bc76ea59af62e2ca43e6a2b090b089310565c73120099

SHA512
888e0002c0ad324eab0e7441094875d8bc07d11141de2ae9feded67631e586f69bc44bf36d16835a74129837d13d5900555fadcd91916d814b2ae9645b4964e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b9fc566d38d616cd88038857013c17d

SHA1
28cc8a4d6de457ec9b66711c0a29ef98c74f63c5

SHA256
64cb34df425474585325cb49cb53643baf405e42b0502bfea4679fb1ddba0413

SHA512
6da16d174cc4acc2bfc8dd192a67c0eee6eae270d193c21246c9d74313c22287f734e0e8df03aef6016137079ff3999a6c9e44c72296f96ac613e657359288e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ca1cf12e5fdcee24533e91666ea797a

SHA1
4ebbbcd85e5e79347566b0ad6cb4984da8de02bd

SHA256
e770e32774965a2e9f8f42beb5db41a058ff60c0879238531f3841926e5f4813

SHA512
0b95a932f201c22b6b29cfd9f4c14a936e86d80a91b111ff009dcb20069f8c30342ec58ecbbf576833caedd94c8ba44b0012bb2ef5a5eff271b3a0b07b2ba408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9057dd0c6bbc0fa45692421f0d7ae02a

SHA1
e81a9c689ea19aac0628dc7b49c1b5bccdedb115

SHA256
b8377cb1a49d842df3f14be77328f3b216fd3b22e6bd7b47b38b987260a3bcf2

SHA512
8fb69a994680d6748c6fd253b4cc3cc5ca4b4fdc45cca6a40f6a380889ace1659e1f6e062902afc38008c38f246ed69b756b59638d9a4d86758474abade67842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff58162a6cb5bab881a8f7ecc8a9dacf

SHA1
c8ddfe7dfc01dfc5353f1f8dfc6b019b1da4c2d5

SHA256
9d3c4365c80429f71f574b1f4e0243f029e52ebcefdde5df6f3e613eb1a36579

SHA512
b4be7456ea7a56ae2d820b6ae92588d70bbdb9b576f778519f2f58f5113b02b3381c3a232cc2d0c65c737c9b15f9e32134acad38bbbcbde4cc17de49615e7cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07ad6b767d3b445bd551b1fe583bef68

SHA1
eb4a9ff28895f17d307be3850b0448b02b16ce1a

SHA256
f27e7e467fade3a69a12b54bc15a197a28f92f683b24949ffb0b67d1bfa1dd85

SHA512
6fd4013229df717beecf789690d1fa13e565c10c2a28c57869c6b744d811bd8db3de671bc5f2771791ce5193dee9ff13c4a67758cd5b1c3325448bc787d59c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
149c80efde92502655eb0f6185daa6fb

SHA1
7c036ee3e6a73507e383f7acdec15e0d47ca46b2

SHA256
03e2485b3f69afdc0ec6710c89fb6c23764c88408283d13db1390b04dc6e0f21

SHA512
a1c32f1f9880d23d18808f69e8b708e347e665aefd1f8033d5f53b9aa5780ddde1b70a8258b527b26c60ded113362fc3cfe238e3eb1b8256aaf842b0e5efaa32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b53dd7b7aa4dffcaf9bc61123105443d

SHA1
d8d776af62a8cb2987863da58db48b24176d42a0

SHA256
4e2db03fb2e79b0e04e11148a12df73934bfb4b8a5c3f81079ff101f2d90b2c8

SHA512
7512f3e3507155d750349e24412891018ba7cc4597a8b7d5411aaf7aa86821502321016d70f52769ad895776fd4e3df5831cad2f660c12b8b76925eee86b1505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f9548e71522559c5768ee82cce69042

SHA1
a19515b454fd1b9888ad9c2ccd16cfbd5b2c1d07

SHA256
93577c3615668b0b4960f991d6cf1f1b9374b4da79c1abf2d56fbed9400267c5

SHA512
a6687352df85f593a2c00aacf480673ace6a31723ca334dd0906296a916cff39aa03d90bbf18a2eeacf7cc72001c13ee5552d6454f38340a810872c7195be23b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a18293bbd45a94f44e236c488193208c

SHA1
6195c3206ee5752a6f119851e28f0f540c722c44

SHA256
44affdd89ca74d45fed00fbee0a2c5d40892ac6f4d896a905860144bd3262028

SHA512
50dc94746c6a492e8419f6ee314ebfedba718043c08c2a6ba5f8308e8e7b1d5d767e9a6c2c81de537d44ffe1ff63262f37de3c0480aa6f1c813371fe4f0f5eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c9dc84af3d14d994cca6c648f3218a

SHA1
d500c6cb6f43a789fa96e63a78d1f1fe0bef1d8b

SHA256
1e15c11cf3fd44e3dcd7efe3aa56e51bcf38deea6552385ac33c7c3f5bd67cd8

SHA512
898e13b63fab8757e17105ffccdc650ae60c2dfcaa243fa12e0dcd68c0e4fcf071201cba67cce0e608b8aca8b1521d01b7154bc8196b5e2c43b5984db9ba6d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dac07844b9e2f3e608c71342daaa1cb1

SHA1
dd22f7d20afe1142cf93d0bff512102631c79e40

SHA256
7fcf6d08a4ac6497112f9480264d6324f7383220ff6d49ee3b51dacb34ee77d9

SHA512
50250a1fe5fdc2fac2f06857c7800966e0b9238522a7b5c0a51d5aaa4a472f00b3a6fa411998d1b57a306202f1305f80fce1b24c8fc10c6fd8b54b54e4d6e9b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b001a6fc666b8bf11f3d29fa6e67e38

SHA1
680c20dddc1e872a263236cd69275b8247b73914

SHA256
06d221f58788ff90d00d27bec2d1ca9e7d03cecb72a2ba2612352a24eb152798

SHA512
edcd2108b1b383dbd6bf4bdefe9f0680073d22dffbc4718762c342fd05ca1cc4d0762faa29885f81a6945c6f7518244028e281103b99fda0fc710791bae1fde2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a221ad862a75bcfd0203c44338c9290

SHA1
0c5d7ab214fb3feeb7fdb13a9bd1188c7bf61b36

SHA256
28f8faf7133d95973f312464749dbb9b55ee7076fb1f1be75f8815fd6a4afe65

SHA512
c5fce1a91f4465ac9f1e9998ecea771997144b56df85257371a2f99441bc15db3b1f589f87c15ed279e71717777b71b5636504d6d01278dc2f7109c8e2b00b7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a255b160ba235ec07b91af698bcb6c58

SHA1
6582e0242108e60247f3bc69fbbe46b9e29df6d4

SHA256
c22f17215239d29bf7ce5188d8556070d4beb3be8c45967a0ea9dd64cccf1667

SHA512
951a80c65b2947f13e84729605f21bee85f480527fa5ea8d4668cca41c485f3c6fad9a557d9d49e8409e7455cbc6506b27b1e4fde423471ba7ae8a1bd6439953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b810cb4ce2c35d8c7f4854f57d272e53

SHA1
9b9d60cf8362a9a38ae402e636c03b54e8ec791b

SHA256
091d3cb31ed406806f0e5ef8714a2422077c86b75b9a0671493e92b1b1b8e217

SHA512
d85b7e55f4224b4d0b1f3ef49b8e82fc6cea73ff0e00f508e37c8af15ff270340ef2a5f22b2619898063f2a6676b262a4eedfeaad9ecc3e8f3b09d9e7a6a660b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab398A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C6E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit