7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/help.htm
Size

4KB
MD5

04d058a5f48f4d2eeeadab399fa6736a
SHA1

0f8f94674053acffc8ce40423aa1fb7ea5da2d27
SHA256

6392070a597671252a125f9135b05daea3f7b6d5ed663b26d30a9e71a1b98eaf
SHA512

29bf2569fbf38ed7ac0142e84222d22ae69ae28779fe519e5288536876da180c15fc76491d46b9a7ca8998f51d9fe16fc37d31d8ac25322d324869521c69e0e9
SSDEEP

96:5Xwn+PZiJx5xWx5x1xbx9xLThbJ8FoLdw1SlTIhgGkfr3u7Nc2Vk:5A+BislbTJ84+7nk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D5F9CC1-FFEF-11EE-BECC-D2EFD46A7D0E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873172"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b7f0f1fb93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000001a9a5e94e9d233e914a48d32a797426463592bed2a25446016b406b8a9be8f84000000000e8000000002000020000000a84430b5fa7ba8a468e2cb12fdce5e73a4edec84f9f5395686227d0d94622aee20000000fa08ae440231afe3223268b0cc3bb2368e127f49471324fd416851fe4fcfd4e940000000e59beff290a748d070b9dcd85780e7d314931d24e7cce3a2c13d6784ffad182472f67a4db951b02e469c8708d71dc273296b3b692e44bd98ca53d3b99d2e3418	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000063afc9559c37550ad70c2a939b94ab84f0ce2fd58dd3e9da13443c1987837daf000000000e80000000020000200000005f0be01e28b11b151512db17d97b60a5370e3ca05c51930942e05978fa4b4fb390000000a256f89d08622aeb4963f3ecc00b58371e713911790242abfba47be59da7a3394c0417780e8dadac1a491295d132aab1e858f5411222e53e2a938872d1d3f2b059664ebdd5792fc9c4e1eea683ac3bed15f87199658d2dbdf00a9104e5ecd61ab856974b1af2aa75c1253ef61de7b17fa82e00cff71e44a259ddd8ab90c67adf494c0c2fbe96811e4c2ce673b64415ed40000000cd573762c9e480443836cd3e95367acd71a576b51cb026b7c25ccf93bf077a99b519a2d58230ce59ba963b616b218f084b4929cccec89d31baa4ab69fd9bbbc2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2148	2928	iexplore.exe	28
PID 2928 wrote to memory of 2148	2928	iexplore.exe	28
PID 2928 wrote to memory of 2148	2928	iexplore.exe	28
PID 2928 wrote to memory of 2148	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\help.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80e79061f9b6b0ca3bc5502872549622

SHA1
f9fb301b3b5ea3375024498103c5121389fc5715

SHA256
4fe5e194994e5144d06b15b9ed3088ebff09ed3f1ca7359ad1953ad56b5cad8b

SHA512
89214f3c84a21f122fbd1dd8287cc8954af055c2db49cf28b9429b1a80b7c3a02616a71a7ed6966df9606e42ac778dcc33b5ad0f17aafc0afb23401e443c5cd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04045e5e74786c9d65b4b11857470a54

SHA1
bca3b806adc6b88e2cde99af9790a42bc5eb12d2

SHA256
cc6aa7ecf7e175b6702d860b39a9881a475ffc09be80e0c8f01ea1e5ae6bdf91

SHA512
1c3ba549e4a71198164c4673007e67226a1a3e75593e20be33276476aedfa5abe3d1fe1b9834ae9b160359d2fec9ea9fa57cb3f5ceafd9bac98520b82e87aadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41f1063693fa65f95e5e1c985929ac2

SHA1
cadc6e9b75e655abf4629012a4fd01faf881997c

SHA256
08be5b6ba1237005f0af120c9e585f6f9665cb960919d431495ac8a253a6d1c3

SHA512
7e5f0a60a5f11abf9fa25843efc23119956d86ed54d49f8c9792f4bc40856490195101820f0a77c4b65cb05e66ffb38fb0a850ad52119d36395576ab4f98304d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e629f5d2c5602fdaa5e43c2aae77377e

SHA1
48c1c16f3ac897fbcb007887e09ec287a1666eac

SHA256
0b7216f242fde3ddd1680221198fbb25fec47695036b682db449e17e82c4dd77

SHA512
34bb7d48d17cae192e3e48078c8548ce4ca81d9fc80377f783c293330891a3fabae65e7aa2e3cddc87b7cfcc669c2aa1c3a35f3c8826f7f9e90c07db9cb4e26b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cecda6e5606055e515887b6fdeeb5c2

SHA1
efb4176fa8630eba0838a97db2ae2d573e0b313d

SHA256
684fd34947e42346ee6f1638e1943575781890fc75d942812ae0942b086628e7

SHA512
f10427f52174344b73e2eb030bda5959ae206a56524bcbfe7dcf69f209fe60b5aeeaf045664d39719a4255a75b5249df12d8759cd13264ce20d5c650b5fef414

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8c701bd863efbd9acea186ed82c0838

SHA1
3c8b2301281b2e3aec5f2c0fc08c774ee9fd5591

SHA256
1fedd2239c6b164373421231963a77af28ee1ad84fb19d47e7cac556ee53423d

SHA512
8195f0089131b66e1bd1f721743a1dde74aa10241befc3c6401d0808f4af90400451c77df1c55498017e002d179d0b1feb74cf0cba3b638e6ccd81beb9c1adfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c60fe2c547825ad27cfc008eb9ccbd64

SHA1
0faed07c18bddd9996efa43b2463b70a4e0ada0b

SHA256
48a931ba5fc35e8e9276fab4f1847aa0a61024776f3d11ab0a29e6011712995b

SHA512
9adb5d0cf939895d35e056576670ba071a0588b6b1bfc18df00242f69759bcbf5c328aa29d7e55c77e40a122919b18ac3fcd847adab18af7bfc5fee5f7426538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d01f50a15fde0d898c63c6b392e5bce

SHA1
296d2c69f370d63201db9a4766733a7766875822

SHA256
a351b10f1a29a4265f0d9f13dfd1797a3bb4fd40253c18b5684520ad0a85fcad

SHA512
06373eca5d0694dd6cc6896c689687d7f1cfee2f5390d258d5fedcdfe414f23fe8e56e59deae09ffd62d5027dc74eeb5dd958ea44308c93146f4638aa544a417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bafbbc87373c0a70aef36f516c22b04

SHA1
e9b943d3c0bbf25525e374db7873c2fa410739fe

SHA256
32c3113067cbb9943de7290467a9ac60e853f94845087d34178689b16c474c9c

SHA512
a471525eed25876b617e12c319b09c6a1f8b6b3f19e60326f84dfd937c8b5b90a29da8ab799aa56cce28c8c5b9269ae46cde311246bd314025cfcdb25eec99a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1518faf24e02481b3fc43c1178130ae3

SHA1
b6f9282fc7ea0e54442a666c6be76168d5aa8cba

SHA256
48bbd4cdef145337030d5276f079a2cb12d4538121a41615778e538b57bd5efd

SHA512
b18fdc2db29545f003509e49e75945d4ab697a2f923a7723394ca1ce7a72f33e380c6647e74f356aaca67a61517fac87ad7677c96fc9f9808cd81251d4cecdf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
570c21b7f9c47042cb371f4f3ea3e7b6

SHA1
42ef9e134be1be010b9c267515eced60d4749986

SHA256
4d7d77d4347dd8e17253797051bb98782ca138f4636d4e2ce088e5dd7ce7a783

SHA512
f08e59457c8e847986d214d6fc9d429d2166f9ef53f58b81a20c5fabf455383f365fa4316500204a8473b243ca1f06a7a4e6c5e12881e092b40a2acf78f69533

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28C8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2AE2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit