28e375bfd877393d8b263f58a3c28c63a36f0ba0857db99e66e40b06609e2aca

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FckEditor/editor/dialog/fck_link.html
Size

2KB
MD5

44adbd4732c06b6a886e73b548867e0e
SHA1

6affd099db6f056b9bfb734316dfff15d834efd3
SHA256

894253303ced2d68ec011372e0a7ab46cff0151215f17c41414f8fd243b07e72
SHA512

3da4db0d3a102f525f9ca5bb3a767a673bb84e3d002ab0af29d72c926c02cb2980b164db6e6967aa396b70b805aa0bd0962e932b31fd4ea56b4187f13aa85032

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000169cbb83ce66d9f916a488dc3d9d624cf1a166b54f5d36e058e1418db79d44d1000000000e8000000002000020000000953c4c340f866e3d3b04fca9e806cb6f9d04d5ae389964c1bf91760d31dd35f920000000366336501305f4ba3324dec8f2ce85aa6cb61acbaa4c2e8c42ef9d95195255e34000000020a08eafbcacad864ba00334c3213e39bb0c2ef1fa57f5a3c8ae9cf190646fbadd2b5f3353dda396a99f03fb92534ed177cd9393fffad2bb646e64172c1f4374	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90935f09dc92da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{347F8DA1-FECF-11EE-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419749512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000009297df5c83273dd2369d0567a450b046164b120375c355efc8f51be54bf11c0c000000000e8000000002000020000000e9749b04e6a7131a1054665ebb434034309486dae7deaaf212ca3c1a7e234cc490000000e6ea53b47610069c3c52de7cdb4fb008981482bb2f02b733c31bdf2372d0ea9cbab9c06611c7f0e58eb195605c7278054432cfd23bbdcb2519f45ebde0029e2b9eba47318578cdd1c5b9606a83d2b179bbef763030a5b264e886931f9689fd5e2186c6e0646ffabca5eb93b5bd322d836cc76df0c7df3719f2378ac7d65b1d394b78950d07b572da3f4ac8222f78622540000000b5d15cbe0379c27714f9fad182399647a09558514c6aee012befef14ad822cb5a0fe134485381cf17eff18d89f85a1b74fdbb0531aee89acd87fcafda78408bc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2540	2240	iexplore.exe	28
PID 2240 wrote to memory of 2540	2240	iexplore.exe	28
PID 2240 wrote to memory of 2540	2240	iexplore.exe	28
PID 2240 wrote to memory of 2540	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FckEditor\editor\dialog\fck_link.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbc46db67ee451ca860688c23bfb32a8

SHA1
e383e87e343d2c1a885eecae0cafd6373046b783

SHA256
3fb58d67f76fea0fc99eeaaeaf7956ecaadf99cd2310fd606989d22168de0ae3

SHA512
c8d072c1a9ab271bfdb797798bfc1617e885424fa88620ada11baeac9fb3bd73df3dbf24cf01818eecfafd450ea539a7448a63b382bea3fede8e2430a13f4187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d1a990f9ed0b71499cf0249622a1f51

SHA1
c4df163c7d57fb8bb9f80e148a6eb55c474091a0

SHA256
998c51a1b954e1b8e69e481a71c4ae863cc3b10204bc16c148fcd69fe17f2e3b

SHA512
50bac1f83ac426485c4eb19c62a5ed88155b36667834d1333908ca653fbee5f751e7d16598a4a17db97bf0e78e43a4240e328e7c083fe97b91cd2a2ca63070d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b25e7b1f601e8c764f5f5a57dcf5fe3

SHA1
6b2f8295d0b1bdd95c82b3977b120e60e5380337

SHA256
c258314de57aadefeffe52b7b04d7d10cfc81079e7daf15db1ef5220cad7b5a5

SHA512
635e3350269f292371afdaa1c81a516941b10eb707d931123fb12e29d13da99f4f59144d22c1249c8d49f5b2896b30795d0633510ac5a103ce246bf736a096c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42cad305e4a4249c6f678ddd31f25e76

SHA1
c155e659f15b1d0de344e27aa45a0427bc3c0d29

SHA256
cfff852fd1d19e8a579a6619a8a584fbd6b1f29af9f5ce45384bb7d231f61fce

SHA512
cd2045de25c20e8c0c3f4781f304e546d67ab75fe7902b12d974f857af8d600db03f4af50b702ad03badb62399bd2745b067e9b2e35fe551d7bbaedabf6b9556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2afde5784de189d26ce48a6f1a5e606

SHA1
2adc404c9ce9a538ec63a2c003f8b9670a69a00b

SHA256
fbdff4243f7c42f427daac8e492e75b42ca2c5db7da54d65f5f711d8a64913c0

SHA512
ca8660f5753489e99ea58d00c9eb4097f8abc59de049b5170ab0ff1d28f354a53010a77239fe2500fe5b241f2227a0a12f61b5b6e8fab82280def995831df1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
426fd03ad94938db6493b406f0d04564

SHA1
ad220019fe2fd2ed5cbc54add20b5ab36983b0e2

SHA256
97288ff45f199508045abb6d82a0568ce41678e12c9698e3215568dd0de61b28

SHA512
6d5db75e3992af4c2c73a328a26045673d751bb8d972f1b049fc36217baf26265238907917692c3797bac55bd6404ee12f0b87b2ad395ab4a8493c0fe41a7941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9395566b9614eb75b55979efcbdc4097

SHA1
c355e90f22a070f8bdadc9947e76fd17f73cfc6b

SHA256
0c805af167e54106d35c72e546269d822ef9531b4d25797e9ca61bef9da0b1b5

SHA512
594e67f9e522249483aa6e8a951fc0f50add03a011f909347cc43fd1032d083101fd71b6e7ae7218414a769be4280dabb4edce80f3d54518a0f182bb0858a40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ae77bbcd02e5dec9b1663fc67bd0f59

SHA1
4dbe9b780134bd962ee91dc795bc0d81e33abed0

SHA256
340799a0ab6253b66dad5b36adfc63ecc21f550f1d07d9d314e7b9ece81db67f

SHA512
0250584d67ed2010a56b6fcc3f7d8075d94f59c735d39b4c2e58944667b9f97790675f51a212df6df0aea15d3cb1a26fd399434b07ed9d91a0d18ccae823bd99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddfe58fe27c52063f830228cbaee6f81

SHA1
38d4d4725cb5b87e2f202a3f69b0eaf4e03d271e

SHA256
2f664a3d523ac42a0c6340196ae62dbc069e6d3697aa509359d6f4cc0c2274e2

SHA512
5e7ebe9d7ca6ea14f7e85df3e75abb680f61faff6fa0e5f1adb9eaffa03b1f14397ed4c9f311982de1ebd3d4240bdb8fc215bd166be5d2d5fba04c8c3b43f783

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
000bc51a3d84157dd17f8c47f97a7c22

SHA1
b95d556aee78826a8aaa122e1ca4df85036b84a6

SHA256
100c9af8b4747fa2f2137c0beeb22587f3683a95c365133f0c6800caba4f96fd

SHA512
90374579c5efe0f6909bc06dd2efb73c552a13d6f1d758ce9e8572961968b7913891796c147b1ff424241a3a45a197f388317e8dfb5bf48cc3961c917a6145a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed6a41865d0586e88c0cf6a4fd62f1ac

SHA1
cc1abdabba6d30f22e7618e919b17016f1298d9a

SHA256
a20a1ee509c28df736e1bf66346027273258191b33feb0e3ebdf9ba76422d07f

SHA512
afc464fc2e0fcf9302349cb0abc8a447fb4b362626c9672c39ec3f3ac4305a77ac9256daf8fbc7b8d722125856497a91b556ff0e875eca4e3971ef94cb208a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d6aec31a35837d02125a3f8c79667a6

SHA1
9215dd7c1a41a87aefe6be6728fc3df93e37e1a8

SHA256
3662ea39eb10dc7852afb3a4cf924a84983b96d7566eae39dc8b2cead750eb66

SHA512
1b1f474401d00175e31f23abc70dfd4677cc72e81c1f2e3128d1ae5391d094ee5985b1142f37aa7f1789512bf440016eaea08f41e8931c66cc297680587f1c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6DA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC9DE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit