7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/index.html
Size

10KB
MD5

3f27095f6e322037cd527a92a693d834
SHA1

7a1e03fbccbb58ec2e869dcb6582382edbe64a42
SHA256

8867d565932136e251d8a3a89398e1c6087dea1b19b10318aa13fe9ad5c02f3a
SHA512

453b06b55e9845bfe49309c0dd8703ae50d4a5baac2e5811905b2d496318ca21452e5a9bb5616e4f25f97007c91a43f7381a52c438d76d20af5eebeb3ebaa57d
SSDEEP

96:xCQPURAfmk9/EcQDUjik567KkmdIPDqwXoJxfAx0B/ZQZVPyBYrJvkgW2hmQqUNZ:5PUC9/pwmlO

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000000855ac925aa8a31497f55cc519798ae4344a3b55a5208c961c26bf1e6f64e19a000000000e80000000020000200000000461c0947959a76b6d96eb7a87e907450d8f45af3b32a98583d632d6e248a2d490000000b8282716af11e6c9607a244a6044457fa61043d64911c25840b558517f7cb87fdf97ff9df4dc000777b977e8d4669044a6078efa8c1cf99ae26affd63ad590604d332f38a9d2cd3b8cdb7b9f39e7cacc872d54cef39e13cd808e2693e4a052f6c54454054afaede899caa72bd18d1e62ef698787f7add23343257fad5487a35a17a3730de64ba1488f89c8a00d87f3484000000049e223eb05a0cb8d908b4bbea3405078c9232b7c492f8192f3d263396674665924b2206a69f37b2539f353236379e87fc311ac88488e4a0d1a4454e6d0102851	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873170"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E18F211-FFEF-11EE-873B-52ADCDCA366E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000039cf937308f1020489358f9227edfedd1e55994c15f6929f72891152c2901216000000000e800000000200002000000032f02d63a187b2df4ae74ab9a37f2d0f23edd241b7e6dbbf819bae59082b2b62200000000340fd6855c99885935530602697d8627724cc30713e1c2f8652c990ebc693cc4000000032622fd9f1926db7eb150bfa2efef49217b91fd079e35999d48b42be4d013b45fd3338d368911c48df4c92ad23bf84fdaa784b17a3e91bc4b37b890f99cefcb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c6b6f2fb93da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28
PID 3016 wrote to memory of 2332	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\index.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
242f05bcf9306233b3149a5931e99c23

SHA1
324b636475b93319c2cdb9c24d1c17bacd4a0394

SHA256
74c494c85e0da10316bdb22d6f07f62a6466c775d5d160d7129433369de57516

SHA512
d9964ea3b33bcfc3a5be138b7fd39f4a053c52d793a24d36b8aa9b9a6f7fbfb755a14437a0a661e5ca1351060efdf75dc4993afe18c265b887ec425c941d2f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea055e31b821870c372bcb8c736d7030

SHA1
72b8722628812217dede4b212716198c350515dd

SHA256
6ba7c2506c84e9ec8126de3f0a4969612f724efd9a2a1af6f2c1614446bc6bed

SHA512
62ee7436c2533cb39fce45e4ff2dddf1a88af3f120e2388e7cb259582bc48515bc43f0f27acc4ccb0261e16ec033248ed09e51e1bb0e2cd241dba842133a9e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7ac74b117d7865c58d565e0409c3f62

SHA1
df0a24ae14eb5e94591381d4d02a1c121e28869e

SHA256
b99a80dbf74eb4825aa5c572e587bf087b6aa3980adc3e1176519df276750952

SHA512
5236e0574202654f00ccf1adf419b87ed9b30041f1da256d8f759365e94f3bff3f4de4b0926fa19150dc61d6d98d8fb0ce72324c967e33a6fd4738c05f82c1a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b181e533b618a1a7e622d3366e3b8e1d

SHA1
5eee95b79add24c895edfd69b803791fe0830a15

SHA256
3b326e3caef4cf8f27006d65855811c30ff803e764e8c9151a37a5f3722c1e08

SHA512
c54f6d0dd044a259996610a135d9439f9604698ddd4a9b823df8206c41041f848683103a4afe25e2e7bcf33835006e1a54a94d1e1ec540328613aafd2af84949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
741a33ce9cfdd1beb279ab92dea74ab0

SHA1
10cc41d3816f5dd02693c58f0d8c0c8c05ad4fff

SHA256
94f6f30983ff3b75592c562258115cffa587845c93ce039b35df7efb5045b96c

SHA512
7700019b35d5125fe188a5e2ad2deb7f6bf2930f6fd251559ccb631057c7002f9e1c99451262c362f78c8f9c9594c02709de00e732bd8228ee733a02340a75f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49814730ac3afea719508a3c13533227

SHA1
fb7762c6136b5c56e9cc42a3e206cc00a524b746

SHA256
f0d9d405fe65ae8bd090bcffa58b0c3c3292f69a5d8f9cb9967bd808c3be619e

SHA512
d913b3cf843563a6ec1cc140956e5bc2f36ad0891614a0237686d56d9e42ee3ee38562c84602fb0575df6f0657f32d6f4eae9663b7a9a753b7011fcf9559c746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8fd55aa8124b438c157c476c429e8d7

SHA1
0e7ef7598b16ed11b4a4846076e3210cbc80917a

SHA256
3a200d1445328e5952c5f46d62fc9bd705334fd94e71865b14c66df51de686a9

SHA512
71dec378fda4eaf7746665cda08bad18a5d23055535b20f57b58d4f445a7b64097c57948ba8bceda72a0facf0176fd867f8f320be57e1e82832b9886a1a1b1aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4318921ac76baabf12283198a68b946

SHA1
f973c5572065ca35b72593886a737b611994f503

SHA256
8aa8c3d96af55ab3fc5833245d4f914cc16153e2b320a3afaace31053d1239c1

SHA512
955ce11f5d79b7544ae711b6539aa87cb02ea9166064dbfe68a320911921d72d2fd76f3041674ffa8d3b889ed36d5369222766ac3dd39e7bc8a31275d0129f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78355aa40e6727398526810d119c5ecf

SHA1
d1044a6b3fb1a48672e73a49ea55cb7779b1f440

SHA256
61a74a465f4b4dfaee93ba757e2d3da928c6caeb58b51693d7c25cee0d12f637

SHA512
35cbe27a6ea73be2332bdc79e5a363505a4111aa50af120f3ea9eaa878b52614157b8434b21ce68d106bf2b103d44a24fd729a122ab56683c39cefd6778a0eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab409B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar439F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit