7dded8f77fa2abd2d0654137c16b743bd0fef6be292cd0d95230dc49c167ac2b

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mtv2.4/视听在线Ver 2.4 清爽版/ad/about.htm
Size

2KB
MD5

286142d1e2c0a5f1e2767b73f98a5f97
SHA1

ef128a2825a05f99d5107045fd31c3e2fa46899a
SHA256

953e908d7c3740dc2a4c5ce9bb6a2f9ade42873bb8a41ed59a91eac77cb1813b
SHA512

ba4f4787a6115747c8ae7be3455bbe7e29ca23d4bf43251b0c8a8a8e5e4e99b7052662ebc08d18d082a223ccfbb7d4efe852bcc4776852a1db48471367790992

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000096a2c0bf01eaa1cbea935d848ef0b28f73e3a48f58dacfc29b51fd0285587ff5000000000e80000000020000200000006b2307a2624eef604adda0b06868282da1d12cdc2702821a71ac8d05b9bde55a90000000024c7a9f7beba555a474f53251c2a291c2e7a2f897fcf459958e0eed9d7817e09142db1bf099296291cff52f1893c7915a880c3833216074c18a74814337f09257f0a898d68f9d78a285147043aa563ed4a4c7faca4a34b2934ce9b735bcbeca95bc256a822d292f66ae79c661376682118e7a37922e9749078f49e925f839b415cbea7add2978d498256f0c50f8543d40000000cc6fa54e45b2f01839ea94013191cfde18c2cc8bd9798ac4524e99ba8ec3fad695495e4e4adfb08a56708017b2d49449f9e53f4a4c71773afc5f5a4b1c02502f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419873167"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701a8ff2fb93da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000004cbfb0d770655eab90533a7ad70ff50af31fdaec7a475d14be1f6183859912ba000000000e8000000002000020000000f1b75c543ea31b37f2fdf88781263e6960436a837bb50a76a68a4d9cf89671d4200000009f159d6d066cc2b5617c873de3b5031c8ea8d374f0b20be2c06c266bb5bec6ab40000000134c61062e9896b0eaa7452ab1326142d6e2ba0a6e6e1885d76350df19aa8cbd7c7185a57a5725cad13f4179dde2b225105bdcb75ce26d2bb83dbb6e8514d561	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DFEBB21-FFEF-11EE-91A4-56D57A935C49} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2624	2364	iexplore.exe	28
PID 2364 wrote to memory of 2624	2364	iexplore.exe	28
PID 2364 wrote to memory of 2624	2364	iexplore.exe	28
PID 2364 wrote to memory of 2624	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\mtv2.4\视听在线Ver 2.4 清爽版\ad\about.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e8dbfa775310df8a7d65d1f8a741b7

SHA1
d465846d3d93316cabeea8e23ff02b0b524ef9ff

SHA256
d4a18eacf7f886fe2a8b1f0dcabf9762f26fb19439f467614476f0911933c449

SHA512
51d594d93a1f108b58fc05e6832df76fd43234d03e8b0beba08af3ab8bc0c3f7c5f0eba9c354f0e9eeafbc8817b6007da9a0e813a96f5d79f0ad941302b18b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ec7751b4851092491efd0b3e1cc0615

SHA1
14784c728382cf0447742e7e12b12de06bf338c9

SHA256
f5639cf26eea0580ebe9c8249feacf97e17e7aa8740006d45e48f05cf16e117e

SHA512
fcb636aa28726855b337b3dfa7ece47a5ea64369f45c89746c051144c9cfe111d1092cc23541abaf02502290a04f2fe5c92666aab42e4791a561d6cacb26ad6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24fd4732a4ed8f162aa543582651e650

SHA1
18748cf04847b1f6a0718d4ca2771c1b7b00ee44

SHA256
076cbe33a4ed44b12ef73ee092b729cdf071188a3891be6c99be6c0199db31ca

SHA512
b90cda5ef49c2f79b2e398fc4eac54d67b36e086316241b2df21ff3af8c18a9245166a3cfd9d9db57b6352ddc8e89268820a8e2293261961355b3fdc3c12112f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5940e4fd2c9bba6c954553c2f38c8ac0

SHA1
a3ff268586a056bd5e894c9ce535cc2519e5c80e

SHA256
3fbc91d9c027dfad7240a3e93404c4cd53a2c9f80c1d5c7991a90830d117eb88

SHA512
98402a7bc6ea73b7139df30f462e6c4b298c72a80534485960c7a179208bcfb69caa1043b7d4ef43b308ca30b4f4dc6658f6891748036ddf3d0e197c1e9ab37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f22e42a80259276c9615c418fb65fd40

SHA1
31819847f81081e0461c51848fa1389c4b858555

SHA256
15d4aac72d6517cbd1011b90dd7a672deafda3455a7eddf3c139d56cffa0a066

SHA512
1bcceb024d4f7e87f4fae693ebf31945a36fbee1411390c645c3f69b48b74280c6de2c0c2efec3f01521b686c3ff200b5318b8d4c0b52086d1b9ee1c71b3b384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
590b22e44d6d55af9e8848c5c48efc0a

SHA1
eb4d5088c484ab4eb6d7a6f911a35407734863d5

SHA256
f8b6d4775e72de42b4227f3bbcc7d22ee85b018d1b25bf43584a1de63d45b77f

SHA512
f0ac533f15f1dedfd95388d30c7b269fbaa671fba4463eb60681fe83a940a51619a81ff2f9e32d4e378963f53a5c6b82c0d5afe4d409654d9ed0462726396ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a34571419e071db26df6c7330858f11

SHA1
de483d91077b2e666337d0e858dfd265a8917f7a

SHA256
2db7b2edf0c1701c0df19851a36f4531dde60e2981a5af5dac98bb8253afc209

SHA512
40847800e75787b0a3cad258a4e49b1497a42ecff137954204dafec594f7670958ef246d4d79ca2055848a2ecc814b95b26919070ef14aa5fb73a65f2b71dde8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2f08915735d7a829b5b99484db1d051

SHA1
f29e6e253f8709ea610b09be11a60268f43a0e1c

SHA256
326ca6e31c92ca0a9924869c80c8aeb463a67d479741f254f21efad0d4629748

SHA512
cafc587bc85daeb1a4cfd3d6dff7aa36fd19a8129669005cff60ca145cad942262498f08b2e53077497124cf725401d67cf77a7d2b94e61ca057180e9388a02c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B4F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D1A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit