28e375bfd877393d8b263f58a3c28c63a36f0ba0857db99e66e40b06609e2aca

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FckEditor/editor/dialog/fck_paste.html
Size

8KB
MD5

2e4e2aa39e40b9eb1c95bf9408290d54
SHA1

6a27be43b36fdf68664d5e0dfffaa5795487a7a6
SHA256

cd177326b4ebc8ed188e332e51315d7b4ee76ea4de5510214e0cc1947386652f
SHA512

40a8858634389eed2854a89fd55ba6fd2117e93b94e703b3a7f40e0fd496315cc64a0d020939b830139d1fd8d707b608089efdcc683b6bd464c044d908541924
SSDEEP

192:6peWUPBJFudMCi7h6CdR66YKsJEsWdN/7+J/tUWTGmAjvYORa9Nzcxc4:6prUPBJFuK38whYSzdcP6mAjpRa9NzIJ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90774607dc92da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419749505"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba226f7597eda4ab7941093571cc06e00000000020000000000106600000001000020000000e1fc6cd68dbfbac3d43a24e3cb7b415ca9eac3543f79bdb0d1b3a3467f43b9fb000000000e80000000020000200000007111ca58db820bf8508244ba9ce973310e64c4b403bc695198a0aad5323145c4200000007533bc1aa346702560ef3740cc42be94e75d97b03fa7b4ecadd6355214d6b29f40000000c3c6fa2a0b71058d36830eb3261021e1db3a8604ca2cdab26c7df22875ca832bcd71759c9da302790b0416a8229e8459d150b93152ee9212439e988475ff5660	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ba226f7597eda4ab7941093571cc06e00000000020000000000106600000001000020000000fa2e9c9d5df4e3bc98d6f94884f7c8b11d3ef5ae985ab08318c264fe3ae6557b000000000e8000000002000020000000aa76ecebc1e019969a54e509bf1715547813157eb8e046060f3de76a2df08ea2900000007f61b45e49a4de2c46de8cd6ccce6ef62f5a09c871b0b5c29e7fd8b21d30274b60557b531c0ee7def150633ec0633d1ea325b33429e44bb9a1cb4cd726ad721b79c8b79c456de9ef13b0ba52558ea5ddeb1e1a322bb87ec3e39521892fd5b71754027340b7191aefed75ac3aaef7fa5da2a33223aad0771f893752da05392ce54a1031a67aba9e849420e63cd72f190f4000000059a09ea1a76c8c7fd5df40cb8c8d23cb8bad1ad7ab44b4521006aecbb119cc2fa44b9f0669d3c02c5f504b75d8e23e973e44a5d6e9f4ef353b6cb5a31c039b43	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32B721E1-FECF-11EE-888E-CA4C2FB69A12} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1104	iexplore.exe
1104	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1992	1104	iexplore.exe	28
PID 1104 wrote to memory of 1992	1104	iexplore.exe	28
PID 1104 wrote to memory of 1992	1104	iexplore.exe	28
PID 1104 wrote to memory of 1992	1104	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FckEditor\editor\dialog\fck_paste.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1104 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
44adc13676d5dc3aabd6ec8a9aa2a27b

SHA1
b704b8397c111e42b128ed94446603895f994131

SHA256
33bc21b2730b32c952c818c9ccebe5ed9fb2613f373b1be5f39026122e66408b

SHA512
c7e19b890a3ad40987ceba1a190acde35d576d97aa1eb7e1515bd2264a76ec1918b8a5a1ca841af4183230812c729c5ae4d3028caeb703327ea926403a4b2e21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86f64b8bd50d769394b308fde0c6e214

SHA1
e261dc920e49fdd72d40efdf367dc7d17d529902

SHA256
24de8ce2067778486b4303df17d3f4bf295e4d107991b564feed4a4e04ffbcb4

SHA512
983a4a4d35a7d135c32b3529f55192de6cf8943f1a7b5350557ec54c3924c78204a7cb0696c3fc2fc03f9fd3f7513ae7374a30ac9709f1ffb3c6b9dc7d0b9964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a43ca45d65b2d86327df22587f056170

SHA1
c0524f1ac3cfe1388f36be7958a5012ebb402a27

SHA256
47a7f5944a4739cdc03ceca3f0e0fed3b53172aa0a1efd5fb015b2494a4305e3

SHA512
fe4be416cbc82717c86c30ee5e50d8f75189b9dae2b61762371b670c1a730feb558bfb3bc1438398a2479e27d27dec099bf5916b1bc07645f541564646bf6772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
943ba9da3c76c0cdf8b664f26aa6fa32

SHA1
9ddb481b9ba8482fe02e521a8831928d98d3a293

SHA256
829f3aac65b5eaf2b268592b342767761c7f88b386f2fe717a392291eb641f7d

SHA512
b0d30c4fae34682a2d42fc85be7c55d12eeb1cb12c5a05990c397ab6b05c066eb659a7a3839631ddf1e4f480f291e9a0a827b2650985c4d04a50ce5f57838040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
461c933ab881d377f5da063881bbdeb2

SHA1
49625b2b07dc93c6b3a40a410c5b7585d9bc7031

SHA256
9ccdeaf8621684b339d9d919318364f11e66a86e804b77d23b8f86265790f80b

SHA512
4cee5cd398605354a554de8b2e75f2133e7a9f9ce40256db1c6fdd7e72b67a6494d3548eadf552a44cfa7a9202a36ca9cfc8062d537ce1cfdb16608e814ef32c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0689c1b13a16487d1b9a5e4011c89f2

SHA1
f5bc7efcd4ce02c0f6d6808ff1ba848a1bb768b0

SHA256
c865d581085b8a11c1ba1895acbaac45a59d1f606cb7a305bd5c0188f85912aa

SHA512
99216d5141aade3cb1c3f924a7bb1f6e79f0b527146329568b23446dfdd6bf3b6cb316cfc3f2ce0ed7a29e8d7ee518e81dffc2ec567a6616d83b534de9ffc084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
470adfc5a15513622506daf6cd421ce4

SHA1
ff37dc9b8ce8d91db1214ec42bb7608d614ed2b2

SHA256
6d90a68f9aa8297f689906f2645c49b6195186240784096cd3fc1884b57c8026

SHA512
57ae6d503a218d3aa75f8fbaffb6033afd121c79a2050e3e0e2cc8009c3b47a703a71161694cc406a1490d2ad1a0af8fbd0223b3b15cb40c265ba33730ea9f58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8c3e6112121aad795b52ab45cdd317b

SHA1
b478184f1fabc7c624a7b724d3342b0003a79294

SHA256
7c2f1318662973b6860bb532d68b0e474f04aa1ac2423ab5f2f6ade5ca5a19da

SHA512
6127e2e31c485dee8d01a4dc610623b3e2f1038c3e9bf3b34cdb7d1718350438d58bfe7cbc1e2a26d2112c1146fa46c0b19199e1a99360debc34b579117c894e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f22a306b9130fc543ea19fc6d930f4dd

SHA1
2ff8c0c711ca34dc49b96e8d373ef1c5e49489f4

SHA256
5a9c3deb340b1f62062b81eb1de03be3b0950fc6ae874d6bdafe7ced261cd4b3

SHA512
eefb84fce2648b634c53c652f4e1ad66c37c93ff2cc75abf834564a9d3baca437d5e6ff429bb67dbb893d86cab82167160ab86cfb474ed7c46fa584e640e210c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34AD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit