7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
117s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/link.htm
Size

3KB
MD5

b32c34fc07626e8fd9707452b0e08904
SHA1

ecde5624277b21baa4ebf5b803afd82773f0af63
SHA256

30af88b1611c6c0b36fa4e4f6aaaf44f8bf5597c025e17b505964ca20d0990e8
SHA512

8383b53550342dfee898f8fc6b3ba183dcfd18e0e04554a3b6b1a5ff41dbd5c0966601e4728bfd4a75e22856279d368fd29283fc65418199d57afee8c3da90ea

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21FF2521-FFEF-11EE-9667-569FD5A164C1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000011aeaf948114f0f0f4aaa56450963c69e064f3acea0a8fccf271cd906b9023a0000000000e80000000020000200000005614d09897a2de8d22e2db1fa7f492d8059d6c6822748589b388ddfe1a3c902c20000000242c279943185b682eb0f8bdc19d732680f3b19efc957a0117bcfd241321af8a4000000027b23520ebb520cc27983c8ab851f890f9e16963c23f6f6494842fbf1fe6f9391a6de2d68b978457f6c3c66e678fc9cea53da1e0750fcdc2375277620a3d99e4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d0def7fb93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000525cf6adc3d13ec91659ce54c2c125a19d57c006e1b0488a711209a01b0bd93c000000000e800000000200002000000013e830ca30be0e083c793681fa992ac11b837b881dc1e92dcd94c95aa420908c90000000e748af4ec733c91de10420bbb0052181d40fc0c8f90980076b367de5d8c103152e48339cd63d847c6f80fac66d562d271e7014393438048096c541f0c101d9e3ff60a9614f631785f5d243785f7913893473b496dd34335ac68259e41341eab53a11e70f04ed88ca1eec5c35bcb5df8b2b2d35c7453e541b8e2aedc89ac55957f685269783780cdd9d37376bfa66681e400000005a284dc9ed5c145fad416a7170314371f8b6eeefcc5e6a50fc6ead3f2187cc3eac9dbe6be252329e97848b5425701e0f0cdd2aff4601fc179d22c0a044f54e5e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1624	iexplore.exe
1624	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2932	1624	iexplore.exe	28
PID 1624 wrote to memory of 2932	1624	iexplore.exe	28
PID 1624 wrote to memory of 2932	1624	iexplore.exe	28
PID 1624 wrote to memory of 2932	1624	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\link.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0167b37ed73380b008d782d37a0cd84

SHA1
d9992cdfb6ca05b3834d7eec24203afb4ec3eace

SHA256
b08d2b8a2e4586ecb000fc7d99412c76744111511b3a14d08992cb652ab7aa90

SHA512
cd11e08d20fef271b5b0f42c62063fb31c697c4fa708b06d67bb89a3f0c137e5d28853f7b51fb9554479edf8c9a80e056d149fca9b06720d23aa671396adaba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6794e0094476bb3f5123c40a6903487

SHA1
4e6b2bd3d18385659f649e770a74f96fdc52b010

SHA256
b79359d4da497221610750b1dbc0139248363da77ddfa19ccb19d14947da5c7a

SHA512
dc8b098e69ce31bcd5669d02ae44b2a36d199bc89a81f0c1c9c2e6a9a970ffcb8ad7e6e0c9e1fa15afccb09b729963f93881f3ac1b872e529d114f72dfb4fae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5fb7a294907c8f0ac5da0fddbd76d2d

SHA1
25292c93af89c039183a426aa1689abbf920931f

SHA256
cfa0c43b5d541c5fdd48bbae74500cb092d248139634ce691724a34e0fd26520

SHA512
d197df86d14f44699d13d8fc47eb2a5aeed816e93a544d125d7488d9ca2ebdcac65ef5ad67ea6189c253ff2daf8b6bed07812c9d902dda0a36746ba992166ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50d2df5a8fc5458f41c5baa0d79c81ea

SHA1
1148996f51a6b5f8893fa0c3f128679d27d457a2

SHA256
b0dd43926cc6a5d066cd5a4cba2408653418d8b400c3bbd5fe02d1ffb1de349e

SHA512
bc2380a1d677185fd57f5021c0811ca226d00fed71e06e74e0f69464ad7257e8a22a1aa1a3b5bd003b953197cd664b0e9e39574f64cc147b6dcaee2b981d2778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c3e713bd60a3574c0649e35487065f6f

SHA1
f563accc484672c0cbefca21c5e687ef291eb13d

SHA256
c4d0aba9c79232b40cc05b16a1ce37174a1e0f3b5b3a009d136c82a19975c186

SHA512
6e139f202cbeea887338ab128573bdbc87d52fbe8662b57b3aad432a4e7a2b2626c01fe55359146e3bfdf81fb0d4a48ef00528c43019348956f04a05ebb61bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c2776190fcb855510de6b9eae2bbd01

SHA1
7137b757d691edfccd20e925e185d7bb4ad4a70c

SHA256
c1f1107fe890fdce0e4bd6c7f8a20d1e6bfa124b30d46b6bcaf56610a80b9012

SHA512
6fa06b2f24df275ba465bec4e302148b538f095e765028950e073fdaa3ea694e530ae8c3ecb41d7d8d5de2ef83b7ef0579d8139e9a8755190fc60a2dbd73515b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63fd24bc3fd1c8ec2a2b78197a99d7cd

SHA1
a1cb669820705e972817a44b961182f0c69c3248

SHA256
1897bca3b22d6c3c90ba9eb00a7e6d3a541a550545a0452237d4d413d0601ffe

SHA512
f99408a3665975ab0bc865e42489c1fd29587bfbb5d259cc27960fcfb5fc480760a443acbe92d548c7bad7cbb1597d24877ad44491ab74213b7a02b443e6eb5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a3b944b4076723f0ca5f6f60c5ca65

SHA1
2cd5d2277a1c46ac6a632a159a21860ec08b932f

SHA256
7397138c29705eeb34b2bd397888817c96d22175a1c38bc3751a277b964a28a9

SHA512
9eb823070ae4c5b7ecf9342eb1b1451da7eecc21427e02fdcf295e95d81ee893a1cb3ab8c6255a7c966d161c127d4552ca26bc8587f247455964748c0316bc8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b77b8c1227d7c4202cbe014af9b76f3

SHA1
53232dca044c57189efef016a999306e984a6c93

SHA256
d45d9db060c4e971d36f0bef8f7b9ea1c544034059b75585278878113c0033f5

SHA512
c8fcb12d3f82d738031b67a5600cfbe6d71d2a43710863352ecc1ef673fe9a697590887c59461a5b420308009eb6e972b3bc4c3b9642404dcee8e07d2cef0123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5139e94de3e4477f46512563d9d39c5c

SHA1
f3efdd025611352ae710d14144b67b29e5da822b

SHA256
c1de66be3eb5d0e7907059e60139748ed7e2effa6dafb8e39f6a3f9e9fa84055

SHA512
adc824dfc3191b42d3ca4ad96b62d43e603d94f6a0b77868da69d7d3ee6faa87f9ac69e886549b63228f442bf256608dbecb1e2b7b6b54f8f2bdd35a4b2a3fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5fe0bf02827107b826b6fc7bb377768

SHA1
be88ec77f33b07e12efebb255c136d0a083ecff1

SHA256
7a011e2f2d91903c1d31052860b7318deb8c6a1af66acf5f35026b75855426d6

SHA512
9afc4bebbf9845ab73735ec4c82fc2a575aa141b2cbe4f8e978ad263927e64511c62f205fcf7ab44ab659e02b5609888f0333bd10767b6b457aa297c98ba16a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d44a9916063a94be8b82d9094152c2c0

SHA1
b4a890ff227d7b96f07774511cbbbcafdee5bd6c

SHA256
6f515d42253cc822331f384757ea42e33158a215ec82c5f4085bd6c15c607dce

SHA512
bafb2bf8b84cf4c4f7350904c065a130ebd5f2b636ed2fedc12b0ab86144a0a10871db002159d6a3ab1bb976b9dcf9ca905aa85dc46b88ff6c540538e5526cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b542a29fe2d5ac14402913b9bc01309

SHA1
76d8cf500daf563d908d834a808082b8e05f5cd4

SHA256
9c8d749aa5f21789952641b0818aa9e7c4ee60d6729cf06bce68d437793a2634

SHA512
c1ed89f719b3dc69098f1c0dfc86056479a9441175565f5d68105c89317ccac6768287d772e6bf2c07d32edee61007d0bbada89d6fa2176fa0868c112564d983

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0E0.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit