7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/soft.htm
Size

5KB
MD5

67f707ba4c70286bda5d98ef9db190b0
SHA1

77b0a6b2b847754da312ca69658bad78ed9eff47
SHA256

57bf6986f564bda6d24cad9bf0f864ceb262261e2eea6201016469c9740d0879
SHA512

515efd5b7a5b560c6ae0848374bd25e49cc64e38d3af569ee02010026f4d190c34969304ed37b777c8dcdcf72a1171220af52506a07b8bf7ce164b06a7afd712
SSDEEP

96:5Xwn+PZiJx5x5xwKxpxbx9xL0PZiPg/gich6Ocz0OfuPZiuqgc3MZXHJKNDvpsk:5A+Bib0BihBiu4MBsZvpsk

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04283f7fb93da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000ba79421e4e63216131de643d6183a2513e32a027bf1eefeeada382a87bb3090000000000e80000000020000200000007f052ddd02bfdaa4803d4c4a988c1299e99fe2d35347098deb336723bfcd48c190000000418262198ddf6a5b18a871c1c5113783c2328c6fe5dee2ed12aea13a7b30e550dd0f66425d51eefcf2ca0ea3c7735f006cc13672e7863a1552550ef91e72b4c0b32a9724de0473d68f6ceeef7a09ea26831dbe06f18d169676edc56f180a121eeee9eee1e8c77fe22abf3d4762e14b4464ce752cfa903c7dc0e66578e6ce680549edb27b312d0380796b83861c9f2586400000000a5beb035d567230218788701d966c1f4593473155b59101d11c11cac6ff854ff40695a0aff55eb68b23de47e1f03a5c50ffba1e7031d6f8808d943baa16b45b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21A5CA21-FFEF-11EE-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000047915fc3fd7b300594f1ee9654aef9101159f1cf94c0603a035a5afa90cfecb1000000000e800000000200002000000096b1ac05eb17ad9dd98ca81c3e0a6035afc9c57c75bd7bea2c644b2e7a6e9f2120000000e9e966fd7118ff47adeb6e0c6db1cca013c80e4a84690cbd181d3e8b66b5511c40000000acb19654a1e1bb76c525cda97bbc7a4cb66bb07f1d7b8f0afcfff8649b79db22516d283a42a07b9bfe071ec03237937221ee2da9fff986d044716cf552304b84	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873176"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2700	2604	iexplore.exe	28
PID 2604 wrote to memory of 2700	2604	iexplore.exe	28
PID 2604 wrote to memory of 2700	2604	iexplore.exe	28
PID 2604 wrote to memory of 2700	2604	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\soft.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb607e307ca00ae95cca757f5ada05d3

SHA1
2cb6d092df80265edb091db12d38cdb6aa478411

SHA256
e4e8e37958ef216349c484ca91d013ca0b0a4cd41ad5de59ce8838e73e2263f3

SHA512
fa30f2fd32ce0fcfad7ae2d3e01ef0ca3b708bbfe7666e595a87e918dd46865417d0989c091c45da91220d362a554b3b1fadd3ba9f424c73183cc9e0ef375c48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0437dcf1416d8e28d9a53d20a6a7512

SHA1
35874f5da84ec11feb82aa171ed3f7c7c8191b90

SHA256
d1938cb64c438b0c4e992762268449a1dc2ad519cfdc86576ec6487ccff86d29

SHA512
d9c9404db48c8e1ddd7950e2b5da6237355b0e9222c9c97aedc896e39e197ec2f8a49d8124ad273e84eb1750ef04dc90383574ac5aa733f8935e3db34a1b0fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56629b5cbcb2864720a96afc14b3ad16

SHA1
1b595686b9488dd7287718d167f895d71a1cd052

SHA256
30f0765980edd5426a449644a3e21dffcd6650abaf40e2cf0453d6ab7e7a640a

SHA512
17d92b7b20dec2d79371e320d84c665ff721764ad2d9008fe73ac36d9deaa2eb3f1a3351259b0938e760dce904723d7cfab868ed4fb4c0a2c22cb60e46207095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b83c0e429a0ad3fb07d1e8edc9f74da

SHA1
9eab9697b321d72d5f62f01f47e7965f7233ab8e

SHA256
89cc9fe94d1646dfc933808146d4ce2f7a15f1ccc85c30c0c864f440df547e1f

SHA512
52f36b7ceb77a2ec7e85155fe28a50a1c2f14ea02e7acbef3b507dba6302690492eaaa48510914a65d6287c9eb81e4bf74a858fc60a61ccd4caa18a49a69f41f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94cb97f0fe46fde95cb12f346ec02c4c

SHA1
50823c1374aa8e1fa9a6c7c7e826a212e670092b

SHA256
7b84d0978343917f0bbef1c184b161931357664c580072981b3bc25bdbc6ead7

SHA512
3109216c6ea9474559a427b43a9e3fc2943eeca15972e4a3ef4651f1cea74b49e5c453d734dc15e61a0546c2a7738826aafa19a1a1d99f7ac431d7dc0fdd53c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71e64a970c5d3952b77e877b551f482e

SHA1
9a7644b2cf80be00bb2650e621074ca9acb012d3

SHA256
244edad7afab00eefd5472a0ad0ab26a7ef1e300659f8ae998a82ca555338277

SHA512
6b8562a9e3bb52f1089ad4eda7308993807555b41f2b7508ad32cf2a8ab16e8a17145c9aac8d32a9e39eb5337efc10cdb9b85b093e5bf9a19f23257bc2b90143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c73cb0610cf9a67149fb2145cea7e530

SHA1
618027e8113341593256676bbd5f225a9938282c

SHA256
d68a13d38940b4ce070b82fb4d2bea42d42168a9ace95403fad250453c0972da

SHA512
406d723b48dc03719a962c99f3d9f8ed3520b8aaee01aa0856727b9d9a48a6ca384bf1c4e5536cd10e0f1eebd6824e73b6dceb5c2dd844b7119f7dcb6f64bd83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc5e52da2b0ab204ebb05e9c9906c60c

SHA1
2f49d38db77ebbbe14422dc05806426d342a1da8

SHA256
dd6ba8d5b0036475d9a0e67fc700935f3517a4a1f2c447eba86bf6c6cacaaed4

SHA512
120166c2947ba20b5329702c38008374d0e35f5075d9ead8f03e647eb8e3671eff415a8eca0d3d851fde4ebcc5eb7d17b511256364c29bb77d0e7bef2d4d886d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60a6faf39d5012cd6f73c0fb35f35e69

SHA1
70368084e2ebca09b8ae87fec0bb8655091b3a23

SHA256
a1bd2df190e1f2a99b815d00a77ffe06d383f174d0f09fa0c2b7b83036b2ed50

SHA512
51cdf11401faf51157f4036c3720f16274269ee1be836bc40827f78ed09f05c069fc06559fa9dfa30d330b8a4be250bc12bb73ed94c2a8262c9779da1cc07643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5acea1ce102026dbb559a561d65b7c7

SHA1
196b9dbdf4edf0ab5e0fb4c375d4413a50681a9e

SHA256
140d5ac150d8f6c744423b226a9c14f346cd8794f9a332fbbd2daa9499fa9644

SHA512
56270b51000ecaba56bf7b13b08d9156034ec7d1406f3245ab78dfd010a674f67a118aaa63caeca1bfb564c3aa254121fde17fae1bd8e7c081ca1bd5c25c84a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43fb08e9ddce3bf6f44b3e8aa25d85fb

SHA1
4f994fb855ed069818968249a924569a039fe8de

SHA256
3b6cc02304eac2a7c49848072491cb246037c02e54aaaa53e48918328c338612

SHA512
355798eebd3b17cac34d0a8bfc430b014ad7b478df2522f87df6841a314d43b52f102278677508be0a1e452450f2b44ffa0b80ad8c629bf035fc35a1f659376f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fa304b753be6dfff9c3a42ccce06b54

SHA1
7dee7e0ff3c8c732b4bdb37425b61ba7b8bd97dd

SHA256
25f7002a444d45139c34d316f022e8fa833315460e574059d7db5b0d4aaf2717

SHA512
c0313d5e9718ed15c3d88311946de6321764b1255e6aa3f7087d21aefed90bc6144383ac636308c105bc22efc620f77875ae2ea6a6549e99aefb912314e4b7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bcfecdda73abfdba564274c62dc69f3

SHA1
77139057114e2851f0f05215e857ce9e4e1f1747

SHA256
07a93d5a00b0dc344d49f3d22327d3af5252b06c42bda1d1c1dcb98dbe12b630

SHA512
4d6431e96db9a525c7d68c6c23ede4d1f170e949e2412c199ef310d54e5897f83c155be49a66bc43be1a160b0925f01ca0258d6955419f8fb85e057c8955a31c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9f56ed2c7fe78feefb8db3e5b5fc568

SHA1
9b3fb7f9d0cc08bb0706467c544a81483d2ef89f

SHA256
d7ca54187b23859e685ff0d5c5c3c231d7a284b1975f99c35725561967c6eedd

SHA512
71bb726d556f45b6213a8b1568bc362960a10038617d32706bb26dfe1de011f49ef2cf8cbbd74e8c4f599c393ce43004e8bdc3eed24f8f234b2444cc318efe0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBEBF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFEF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit