7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/contact.htm
Size

2KB
MD5

7c145b42f33b9e632ae1ea24612a348c
SHA1

ff31388ccf0d2cbbe6aa76b5046ba8c8ed4efe50
SHA256

87202189e259e3ad08ed36e1c946d044264a0d19d739b3e86cd33008f0c4e309
SHA512

bdbc5c269ca1b47f4616a71578dbc7a6e3add5c469891300f2f0ddea9d6be9175042ab18d4a9d96888d84f5cc520ea2d25298183e8d56ce09be346d6f305b18f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8002e4f0fb93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000d4897a6b42a20876af6c4f439170bc21767a2a2b3e5eb0edd25f039261e47a83000000000e800000000200002000000050aaaac9eb413af975d85ff13f2da74de499c0fc0dbaa77985b0cf1e9e9c9d9020000000d090e14dd9d58b502f43f12d8ec38eb6537a82367bea24e5f3d002314a4a9dce400000004921d2e396c19024dbd073c68c0c563b2b05ad9e2d4ea533dceb5a431104c38a224eb2860fbe46c5cd11f12ec8986341b04617863dbc37031019e5c230a3152c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873162"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1C4497A1-FFEF-11EE-9DE9-520ACD40185F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000037bcc03618482558d9634420ea3ac855396af1cdc36b5ecf8d3e747787355da6000000000e80000000020000200000006f45a20cb4ec2901b6a3301a4deda3f489bbd7c63fa5aa4f6ad81aba03a72401900000009eb29d2cb81612f71818219eed97025bb35d9d3c1f8368b6865e5cf8337e225066f0c5e2c812451751bdac8e689bcf6cbd0ed25e3e860499190f348e229aa06f2c8a8284d26ed01af93fdf83253f75d67b10697224840613857ee87b1e90c7f9aa7beb74bb51bcffaf7364a37d0ec1607e4798133ce73dae31b163f80ee87c4b6d11f72bba1dea7ad4c5a97993a06bc6400000006ba204d73e46ff353ac4c10a43d07758862d99d1b1c9767c134daeae77e83859c56952db1b53deb0ec763a29a2c5a4c3208aec0fb7e3cb680a1d2ca1ab18ae01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2956	iexplore.exe
2956	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2764	2956	iexplore.exe	28
PID 2956 wrote to memory of 2764	2956	iexplore.exe	28
PID 2956 wrote to memory of 2764	2956	iexplore.exe	28
PID 2956 wrote to memory of 2764	2956	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\contact.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2956 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b805225f4d22061e52a3895276364eed

SHA1
60ae100e3345d763a70e6753c2034578f6884ea1

SHA256
47b60312535b23c6ddfd3715ae03695f2af09d2cdda409674b346ecfe3db0b53

SHA512
4ec7acdf0eb1afe2a30295af1fd11b53aac52639338b9973078df860662239b4f0cf7e1c7b114ad4cbf40d59d5f1a92588c42f08a6ffc71038ace1e2b01f18ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c910587eac8985c36142289a71f332bd

SHA1
ecbccf126bb6d1f5b33804cb3a274c11f7bd1b07

SHA256
bccea4a1e8dc58f3d353305390caeaa9781727140745065bf4f417ed94dc7358

SHA512
8ab03259461890e624d88468fe0ad811ddc2bbfb87adeaf037bc68f0d4d9b8fe3face8f70c8c31c85a28383df22afe36cc8054d8feaf6a9a013546092f8c66ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3127df54ce67ed2c5bd94765fdefd071

SHA1
edc74368f9abb7dee30e1a8588297134aa69d636

SHA256
dc3ffaa4b64df735c564f2c476954c61e74596ce3d5a8a0c782f7960602c2bce

SHA512
5c9eb658d4040715f7d4f0d8951bdd83cf24261775034058c31fef28d320868793d731b4df9456bd7e2d3a30bc6a9ee09395090246eaed34d46dae025cac3b2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36d1a4bc22efe0bdea89d215552a6c5e

SHA1
ed1c4381aa7f7dc8ecae4fb1e3e0c5f2773874ab

SHA256
901eca529f214c7c55315479f9cbff7b52897b2a926339042c90b27c217dd103

SHA512
1d7c16d2946b497f6e38c2934d301ff52e2a38c7216d0d998882d2b5bf95e76a7bd2bb059be65212679b26939f12082ba2beafeb268377faac11eefb5d601146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75a7e2b294542066c02725c9b8aa8b81

SHA1
0aa3e3ea2c158b4c80f5bf0bc2e2d245a326b258

SHA256
860865a62bf079149ee95a69dbe12e05ef1a8738f0ecfe105c54a191360dc4ad

SHA512
4c505964efdd364bd91d696ef537dc574f1196027f357e7925ef044b8a5c05c19a1f6261b711e73def2eb2b9a1869e934baa05184bfbc1f4e6cc26f13b1f8fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71d5fc8e901f265be1e4e7b3ba60a23e

SHA1
f16852cc1b8696a245d589c6ad42ab38fe3a9536

SHA256
6e9d3a2588b87c4a32ab59f904c6501aca5c3a259f2d3dc50f661e4d2d491f83

SHA512
8463c808c965858f7885944cd7bd5656c17bdeebd8bb4b840b734b66e79bde75c549be615b3647d4e456944e6ce082b44b1573fbe5d04c956d59648c72da10e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c534fadd4abde116177f356c80d6c968

SHA1
4a4668ab691f7595fa51ac32c7ef8b1196a95f0c

SHA256
bc58be4b2f5950a638e416021dcdd72895cf19cb0a08ccd59f6b10219f0b9ee5

SHA512
337c9bab5edea9244c050fe0536c49527e6eae84a8607a16afe66116990d28f9740df2624928bb9ad0ff02d12db3cf5e74f1f0c78bc2e8f876f75cc078248770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27a443a5a270ad53855f32ab79a2be11

SHA1
46491066dab2dd554fdb48be0fe7ee2abc03fdee

SHA256
dff71e6d6beed84245a8ac37101b8b516085d5fdc0b77bc8bc95e6fd0d15ba24

SHA512
db47d50ebc34d2870b73d8c03fe4e690fd4cb45741e0d05172998d27599365060144e0c43087fec1881ac3acaf57ebbd7608697d2a7928a0de2489983ba420c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b986dfb42e0307364bdca52d027422

SHA1
8912c575b9ef9cb97419a63cf03b3ba0026cbf1a

SHA256
68bf745f8d6e5c9da4950c717bfe843f4eb06db8f7e0a8bd6b222207dcfacdc2

SHA512
fbc96747ac7ec5254612ba4bfb6bab6d9bf98e49980401e4c4110d5a8d10abb49eb6620e4eb2763b2a5d0d91015fcf67450f5b3f68c5753cba035655e4312378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b95787d3310cc7cd70a70ceea8205322

SHA1
a291f0c7624e6a9c15899269d57123f4e187b353

SHA256
6770ad5152a0866869aab0dd7d9d61cd6a8ec17c8a1d66d1356c8195daafbd13

SHA512
cefea8418101ffebff4c192bbc2ac930c13dcda893045fc877895e39fac1d0445650c0440a372dc0d3298b9b886be875fbca96d59fd885f2f7148b7cd0eca269

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2DE7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3010.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit