28e375bfd877393d8b263f58a3c28c63a36f0ba0857db99e66e40b06609e2aca

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

FckEditor/Test.html
Size

1KB
MD5

c18e5e3f31928b90e0cb1c387fc4dee0
SHA1

36030aec94a6a9d701e9194cc2dd46962f7797b9
SHA256

606213af42ae33a3273bd8f97d7d1afff8ef96d7624362e154cb4f579707668d
SHA512

30edacf1d64dc9dfe8b5fc24582faddc2fc9ec7caf498fa2ba4b583c757996cd8de493c30e6a9517b64f0d54e9da7e81eaa31e54862b73ec9c8a88c03dbe567f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34A22131-FECF-11EE-AF55-CE46FB5C4681} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000b1934d5acca22f5a22c20379a961bbec5e1e3f77b26ab2302525b23fddb44013000000000e8000000002000020000000065f336e86fb6653f18c3660a1e37f8cc0ef6098fffae5368d3161f1412a5569200000002ae4405a0235e4d3fefbc5fd3aa60ac97d3906cb16e67165d607088d665e03fc40000000317edb23ae157ecd14edb0fcbc637793a86dacfbcc2ac00521438bd017b70470fe40d3f7a2142874e6b006912109d76311dbb79cc548684aec5de37969a428e8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419749510"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000648ba451ce66e58cc7f62f264c1437845578554fc92f60db4df9d6d18594a4bd000000000e80000000020000200000004df4a7213771e75fe295b78735c4c2bd3a28b7f2a35c153f31534a1ae50692df900000009c8d6ea54da3f47fb5f531b0aee8f039bfcfdd2e3c44432c633dbdf3ad02bedff1e045c031c53639902a2179e9be670d708470f07ceffd3090ace1dabc57eb579e62d078db4894ec7b43fbc8692a44ec09521e90c5e4b5c3d4d1279c6942ab92093787102aba365fa2a08a72c832a00e6cd504813dac7700364aa87583b5c1a26bc86b87d53922f4e1278c9332890665400000007646ace7be5245f313740fa04cb2f59fb30e971d7ffb74123b214f20dce93e661ed3bd53130508404b0bb94af7ae4d73806fe0c8050ea74816433ff991ed0343	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809a8109dc92da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2664	3008	iexplore.exe	28
PID 3008 wrote to memory of 2664	3008	iexplore.exe	28
PID 3008 wrote to memory of 2664	3008	iexplore.exe	28
PID 3008 wrote to memory of 2664	3008	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FckEditor\Test.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b277ec821e977bde3210bf5eb186c0

SHA1
45160288d3528c095380573898b81bef952567d7

SHA256
e2f0624e89d57cfe6c389163546723bd7499ff3bba4dbe2c55c6f769e27b82c3

SHA512
c21da4677f8a662601db4524344a6bd5a9b286041110204e295738b668c66462425ec7d305cbabc202a19175f558e607848a0eb141f5a87b63e17fda0c60eab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6760947179f418aab70f055dbad7636a

SHA1
cdf8331f9279792e9d08e3fcaefabbbedd8207ec

SHA256
85712f823d0549c469ae1d2648328debd1bc4068245defed70d7fc3aea5c5a30

SHA512
a290e9d08e232e8a980c365b6f96e369159f31a6f655af3b85a9fcdca01e057eb79fe506d7eea5703fac085aa56a3b66c411d9735a637726faed8b4a69b4f194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82c50b0421a595d35019ba02909e564d

SHA1
87691891734658ab524ea0042b1ddcce025acf91

SHA256
50f217232e040f3f75c5bcfa0bc1021d4b3ef78eda3221467ba28659c1d12dfe

SHA512
b5ce92b687cc37bd90600c12e302d074b075c6f3077a48636e5b33da717b40a35442fe37780967e810c70070e57da88ad85387ba25708b5e1a49d09327108d7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58dcc1016e73fcd1ed73bd036e33afec

SHA1
eb033bb961acf1f69c5b44338c30b9dc85871af7

SHA256
8b6dbe40e83507aa40d7a5d4b922aa978b72766969d407d9a8453bd3c88121ac

SHA512
a6778f3cba13af4cf9d19d815cb5f2f0968e844bc501b8ab9762a7b00763fb01ceda92017c158ba7860e07a6ae4f1b63ce9d6ea5a3c49febadf732a1f75fc1a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ca4c2ab9f98017a4ccaa493a1d639bc

SHA1
93dd2330c83dc25319dae3da2852fd8c725c73d0

SHA256
45efab9e45c99fd3796ea77b424fc15a5a83771e85bc010f2c16d9a342cdc35c

SHA512
5ca1f81bae75d4ee8bf586df72d7f0169c37442ff88a97c26019f1e69eb0e95a7c3d1ffe2794f6ddceb93203223d0285b653a454f1452c844988f412756f663c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae2fe17f45be7b1640a1aead83fcbf2

SHA1
b40ecd4c325ee205c5d8f4722b988b444f40e9f6

SHA256
b90bede026ad47b2130c52f0dc801c9da29bdd2d9bc5b1cd57ece58b175e92a5

SHA512
074232fda30177199e383f5331d8c840f2e66b9633dae030453d876616e10c81b2f237cd47ca50a5728d044ac94b842a525fb33ea18266ee21b71a651301a1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0435bd9bc566c8742a8573eb5140fa4d

SHA1
47a795d6f11dd15ccd603d0a28d793fc3f9519e2

SHA256
ef01335145f492d680d23474def3dbf66c69eff0782ed1b34681d04b832e5663

SHA512
200eac4a0ca82a1706d2f31e058586f30630f38bd7de4edcdbb0822d3ca252ad57696e70f42505131ac3c1ab5e70e0c15a954ca6d6776dc5fdebbacfdf20d7ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb0b421d7ffef4319ae1a8077e24d6a8

SHA1
bca1aba1608689df20493ebf5550575cc09887c3

SHA256
951945af5283b2311507a01de971b7f61cd34bc4002262dec022c2053089cfbe

SHA512
15da34488015a690814436117e778b79da8ca0f939045d61bf6f8b10f83414d39b6b5924f2f4d13f32648c02860f431d551566384a8d12a60600b5d383e3c2ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518b07759760ccce444843b7eba1d56e

SHA1
9025eed87e60266baa227fdd4d30d66bfa69d108

SHA256
e6d4e7f711ef7a035ca542e69845db4714c09b92ef043a140e056e58497b6f96

SHA512
540ea5b1162fd9a80669f3b4cbb2bdb6e94fe2d1f94b8d94d38b8ce0524fc12a4e68ab68cb1ee26d90fd8d55eb13a3c21aa6db559f04b6fb296f8281c4fdfea9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f98954a7c4a23a5dae807810cecea6c0

SHA1
1ba2360eefa70291f423f5f363a7a0a5a7362baf

SHA256
bc3ea11a0dc8c38c80e5de1d6ba947fa9233faa02db8c31e5dc901b4e03c7a68

SHA512
fec1f7cea0f9e26e8a2e5c820a06d9c7f4e6fcdd1113905b293f4b3ff5f65891599b3e03964cb1f079ef2f159bb0965064ec4c2cbd555ebcfc3e15c7a3af7c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8521e1d5047c253b86871ed331e6e368

SHA1
19854198a26677396a69039c56b15e3d287a664d

SHA256
537a5b1abd528328ab138e318cdcb992ccbacbaad5a7c5d0b6fb5218a2026096

SHA512
9b2f8bd0b41e93f5cb4f3d38da9188b23949a7d0ca2eb074a84456854eab72f9901da58933ce269ecacc3750bfa708d49c49fbd3078b07cda892669598512665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd368a249bf7916bfd88e26c1b4c516

SHA1
e7596273cd7b99a28d6f73cfe8959f108ba3352d

SHA256
507e89c15491d5f783a7282790bf52c4bf838c7495d3ede53ab80f6d75d390cc

SHA512
2fd47392efabd5e180aec05cc119a240286f5700d08d2ebd2cb3f0a9b1bc88b69c6771d74dd2c1d2c731b54bc1e5935387d86a9e0cb8930afdcde33a0ce9aff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cafa06efc14368fb0944721daa8393bc

SHA1
14877719dd1b90f8e585f1d138e5824d45622e2c

SHA256
31190c2b1d24dfaf4034a5b9a92fdc7a61aa3b1eca8dbdad3cd2cc93a82dccea

SHA512
f888ce465a01ce8b2611f431d1cc63422a33806ee2ef7c564f182510272426a99703806ad847eb52f1aeac588ce619c0e4db455565bb3eaba14e1dc3a27840da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b4f46121c57eaa9120e5a6314aad09

SHA1
7f89238bfd03b15f297afa000b72206bb470741d

SHA256
cc6518d29a70fd3b827c5ebb66d3069380bd84990ce5e934625d935afd50e7c4

SHA512
7f1b3777f84d1a8b5c20b25b1152d7a753824e73b90828eda164fcba7394056e70e311ff052b56180aaba7de190c34bbe1883a783862bdfbf9ee930c35cc1ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2a071e43512a0df9e9a28f9da41691d

SHA1
ca8a523ef2d74f4372b03497965d1101dc64a867

SHA256
6769fe613f1530c44f7b7bec7a712c95a28c776c4241673694593e86f6176366

SHA512
bd3cb01f5a015aab16a1e204d7652a0a9c70909cf8be8457e355b263d207119cf588cecad79ad8b9c30baee41cc115eb75abdedaee88abf92d9b08b282302391

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3352.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab343F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3454.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit