38fc41fafe9ab395516d47f9f7a22c7cb7e8989aa3e88b265b8e07a151bb5dad

Analysis

max time kernel
119s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

admin/FCKeditor/editor/dialog/fck_checkbox.html
Size

2KB
MD5

d496897f3fc868e6924afea55a347e7b
SHA1

e5189f28cc61c5d578fd91acc839c524123c6f07
SHA256

105a814bbf572da4b90579c7a69cd47f54ddfa0fe3a59ff027a23e6b530de5e0
SHA512

5fcc63730ee07229f12729a52cd1852b6ba778d97cd202a15d24429651d084737de6a761bf7c44781880d29ffa66ec36b7ad3f4f325f4609b5ab3a5609f03570

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{642580E1-FFF2-11EE-A5A1-E299A69EE862} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419874570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000fcef2801fbe6d9ef54dcf8af008ad640c67d4eab9c3501639d199202b2bb91d4000000000e8000000002000020000000797dccbd0653e62f798baf5c2ab4a915775367235830b6dbd6f5e469cb439e2290000000473e976938f44fa098878c626bc77fe1f9bde37f6c4802ccc2b725e5b6d93f8de70cd652a018032dc838cdf1e6f6032f2250fd856c750ac6319497b48c6509161f67c7f80a86c9121046280e1a815fbe06ac72af957e3828f313af9d9f4e68ea01539d02b869e606a136667009484e9e15bb07d2636a18e80a0c52cd4ca214cfda9381a4906b53b70f7c4b855096abea40000000a06a496e6e87395fccc1224c70e170319ca994e064fdd9d457ab9a35a91aaa89d4a81b43d9899b64c76e7dc5f3d0981846b80f02fae691f9ec8056d605e6376c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000042061913e192884b86834b91b05ca1aeb56845ad0dc7592bcae32d5dfc42e3ca000000000e80000000020000200000000077e0fadd34360adcca1320618ff5a804a9efdd23eb40c8c91eac834337cf2320000000e970c6d843f45b0be5cdc24ff92901c64fa899d4bfb19dee45ba145668a06c844000000032385df98ec87144cc4ed33568f8554976701072760057db5461b69652379500587988083f7c2f46538b7b102eeb8deffcc12f4c8f83d01bd87293fca7e47da0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05ba438ff93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1652	iexplore.exe
1652	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 2740	1652	iexplore.exe	28
PID 1652 wrote to memory of 2740	1652	iexplore.exe	28
PID 1652 wrote to memory of 2740	1652	iexplore.exe	28
PID 1652 wrote to memory of 2740	1652	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\admin\FCKeditor\editor\dialog\fck_checkbox.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8895ac8f7841e8bd820826b2caad87b

SHA1
542a1cbda6aae5ece9ccdc5d2055a06c83b0d44e

SHA256
55b8edf4d2a1a39deaaf482fa9efdd2f781b200fd35cbdbed382d01c88149ffb

SHA512
d3d71ace81b97d9dc9890b7a21be7ea4273d556f3e43d48091925005c9a0898b426d9cd47d338f37b62ab1a8bc51fc95e8932b21f001dbb0b9c1ab77a61f290b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c5cb50ccac4d1e2054ce6f095cefc38

SHA1
cb0da891fe1149b18ae2f0b04bc5051ea8b24b93

SHA256
c36443b9685bc9887c3e4ba7b0597ae95e9faaeee56377d85b4afb87758af5ce

SHA512
a7b90a378a8d22a892544c120c8a3c4e61f09243c54e238a8633cb4e6c1118612ab3982fdb8276668222b99a36ad2833d2de839d7d70c11d646595f5a4112c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ccad97ec6b461e440ebdd41096440f4

SHA1
951fe9127c9790241fd9810e5dc16c6e3ba234ab

SHA256
c18622c494a42fe04674d3b9048f2d56698df8cc71fa574042083da029472462

SHA512
b72b03a4eb068896c928e42903b2c5256b59f5f77a4c8db6905ef9b5f97107d2864f6e986df1332a784a836da070b658a7a9653a2d0664129b8c52f5b3d621c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cb991e6b57ad2c2756b7224bacf0884

SHA1
300a9efe7c28a00e23d70282f9968b631fbaa0d9

SHA256
eeb173a0c1ba288019acb8ccfa9818fb84cfae03a98506b83d3459d72b48060b

SHA512
ba697a2a74e3279f6003bc56ac158e14713b45c8483b471e8020d319bfcfb2ae3bed61c074b6531c3f4483bdcec3cea71a899711a9b10d73865433dac23bb0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58da3e32c41c0ec908386ef833843fbe

SHA1
ff890046f9d57a06e39707d102e06ae547d460be

SHA256
34f40886b1eada6e9d3085966472d34522796ef2f3814c7469b0e633a6d5a905

SHA512
5f972484027d8b49ad31e1dc8b4b792756c6167b135c4f4dae80191a05a193739a4d8a8740868ad9a312261cfa8acad86f3876642755872f48a0682df8a40fd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2879f53a3053998637d22d746bb0bf8

SHA1
43a4bedd896bf5174e6bb492f515a723bb319e05

SHA256
2999793fe992d46105330df9d025636f469749bccdf401a7f36f6dde420d54a8

SHA512
354f8b85b601fa9b1a66acf6fec9789de7b0cf8b2037830af11aa6e5c2c0f6749763f6d974ead73811fca89f007ddcb38f8846f01df1cb2708a579d9f2a84e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b14bc856a4f329d9d47e2bba1de53f7

SHA1
512b1cff74c1825fd096ad881f721487b8672125

SHA256
ba77584e9bb4433f6a5d769024fce2479f73550a1dec62af7e96ddff7ce3aa8d

SHA512
0bdd1f960bdd8e3f32ff41c1821e17377fdcdd371a844896dc93844ab8fa8271ecd7a73dac3c569d977f511f744fcc6fca2f7472778cdf051db2485a9d7e4243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccdf9c527ee12fc0e315cce5d6c192f5

SHA1
bc6d67c9f32eaf89ff8a8ca5f93a3491be8a6295

SHA256
40212f291b76081e90f4ea46a1e855abfa27049ad4f6d33fe479600143dcb5c7

SHA512
43eb08b5f73efa6513074cc4e204ff59b8e69f8ca80e997ffd09736d2a43b7c94819fe32c6b3a39f62cdf8edfb1ee9aacdbe6c51e7e5e6d11923a8847cb82acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9371d205497ba64074eca0ead9f53f42

SHA1
b64df846d57077f48b9e7bdfd58b0108cd0bc0c4

SHA256
541633fd9d9ec1a8e3016741aeed540ef310e8758707b1d6a03afcfc035a7a2f

SHA512
b6e7dee4e37407d87a6aae03219d664d9f67a9614113ab63ca2e97aa0e3e70040bc832d75bc972306758ab30ea697509401faab6d7e705926cab88c002854e78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cdfee4d877665c353d112bd37d3de97

SHA1
f076f790947e62ce48f814a706bc9cc5859c7a96

SHA256
128860531be7b3e5f9330a557faf91d07e5b2b2bd5d59fdc21a95b86ac8bbd37

SHA512
efc83fa3c0c743f5ac48ad0744bc7b1a43dbab57055f2482d177f1cdcbffac3609e26387da879a76699f6f808296810cbe842e0f0a4c9b93d223c33053a3cc4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A7D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CF4.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit