38fc41fafe9ab395516d47f9f7a22c7cb7e8989aa3e88b265b8e07a151bb5dad

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

admin/FCKeditor/editor/dialog/fck_about.html
Size

4KB
MD5

eb710ef7e34e9b2abf84dc3ec7a0e9cf
SHA1

1cadd2aebf1fa7d9123fe97d66539416f960875a
SHA256

0abed0d8bb6df8639f87f6fe3b814d08d785848b371a503a6e9986ebe63d25df
SHA512

b0a7e19fbe0965e18e7f4f3d03acb3305ff784918f6bbd82756b4c993a1f0ab365a9a4d584b836f3bab968dad38d31643a6762ec7edb51a982cb8951972d17b7
SSDEEP

96:jVVyO2EjycXf8E4rJudiuRAGRRRv8TZJ2BjGlxv6cgdxONeH9sj7hQMcDFs:v3f89rJud1AkHENJ2VGlxv6cgdgNeH9y

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000000eef36a972a612fba7ff5dca1469ba56ce5b2ecc3353d607557ed443ac8f6713000000000e8000000002000020000000628d93e216e2dc85f615d37ae4f5e3977f2ab42110a635b4561f4f0805aa4ce990000000cf4b1866c7707d2e62a7a656aa82810ab025943ceb22a790f2480ab16ef4bfdaf73a5885eb9e5f5b04f0bf42fa555874f616f82c1d5dc3a3f8bb7cff3511765c415d292cbc847ae4375dfb85915ff8ab1488623d663edf13b17a379cd36c1601e80a112cf781cbce057269e6182142ac6103c1ed6065945b19cd9a9750216381457b8555003528d9123201cfcc070aa9400000001182569ae67637e13999577858cb84bf7e4205afb1e2cc59499129aef0ff9daf710b4f386f4788968593921b0e528b138bfba8f4490bd807bbdacac6f964d03f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419874575"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{640575C1-FFF2-11EE-9034-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000cb7a5cc98a54d8888753aa603875a8d8931aafb0570c594d5992b57368bc1de0000000000e8000000002000020000000f6299b1e212357c64a70d3f328817c02be2a336fefa222d9e98a8f4fcac0d052200000001bafc386d631c699b045b4960a0b51605c7a37515a9c5e71d9c28e1b238d6f3e400000004cb154ab43b1215acf88c99ee92f83ba69f5febf765bff2150e9fc397243ccee924f37f88f8cdb4bdf13f1e89660c1610ac8fc7631d00914efbe92f426126b69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00b8938ff93da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1260	iexplore.exe
1260	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2868	1260	iexplore.exe	28
PID 1260 wrote to memory of 2868	1260	iexplore.exe	28
PID 1260 wrote to memory of 2868	1260	iexplore.exe	28
PID 1260 wrote to memory of 2868	1260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\admin\FCKeditor\editor\dialog\fck_about.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1260 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f860d181e9e8644fb4e6ca6d1dbc09f9

SHA1
fa63751e731aa815091beabe55995d2405850b0c

SHA256
f47b79bbd3550f628b57c8a0e9b2ce45dbbaea52353e1484eb9d38cd3ed319b6

SHA512
6c5bce00c9f9374ca5d4f0655012f0372869ccbf74cfe2791761195bf5e1a3d8757cb877ff2f08cd2436f8a5bac80d1e154e1fb709a6767cdca74a49bb7ba79b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
640386ad7259cff6948830973883da0f

SHA1
9d17a3aaee043e65294c536aa2fbd98fbc636c5c

SHA256
17c7ffd6d4092739f279edba2aecc186b0121b5909d6fb95eab3fa1e6cdc0d87

SHA512
162577dfc11c2eb137cd97a32d20295d057941e0b045b7f2eefd6c0ba697d3526c42c9ea2a5831fff2c397f108b51b24ddf8eca6c303c3a49a7543df89f131b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1abc072930d8c2efd5a8339b2fe2797c

SHA1
6df94ba774a18eb78a0858dacc25bb41d8167cc8

SHA256
f5aaf1b88f42665fc313cf31cb6dce88e270e38fc4f3f7638f04427cc902fcfd

SHA512
6697c17706a9268501cd9dec9d75875feb221af5a535d40d9fa34da5f7adff86b59cc7dca8ff3c8a587d6fd0ca7be171d94288293cd9068b7aba02b8b67d7087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac73363826c62ff686286b6f019212bf

SHA1
bcf571ab7ce85353f03b83d1b30451d7c1b402c5

SHA256
acdcbc4038fa5276b66591123d0f40aac3a724ca2e4558da5be45e29fe09ed29

SHA512
da89157eec7df9fbeaa843a4a3e497abcb55e56addd7d19e8c23f1253b4e608242b1dc69c8f0f9a254978f853e5ceb598c9c82bf1a1195081a7d4392c19eca24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1360431e7e3b22a1e9accd29ac7acb87

SHA1
b1c199338ec145350c550a3b10ee41630582d9f4

SHA256
781b97ccdb1061bf77a701db3396e8fc62e814ccc684df9f8693c63acdb37e87

SHA512
db8879df8c47d46a40738daf7141a13267fce3829894a12c5870be366cceda457af06d5d8dc49c1de84e1c352e872575833cdcab43bf95bac3c7802c68cd63a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a46fb188bd1effbd2c9141a6b16daf0

SHA1
b5e952ecb72759f5c52a53aa6e244a933c3541d3

SHA256
8f887fe8f8e033c2c3819fbbe9ac9f7e4a550a531777cb05f9c856c83ef2d3d3

SHA512
d1bd772b8823668a2dcc05495fbcfc18c394583bf8e86e50dfbacc1425d32dd21803526aada1bce7f72351a9d181384170d113cddaf94bf034221b91a67a0c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1ac9ea2d31b4fe1918c72362590d8a7

SHA1
c57b01acd5998855d947f291ac8373f4cc9bfdd1

SHA256
59dd3d7cd4ce7a35751d87233a64321ca031d4232f1b2a0c0b3aa3d8940d110a

SHA512
d531dab923cf92ba3ba51b02edec7a5b4ce5364e934391ce70e215608afb2539ee3ba3f03ea68873dea95f277ea1f3e8d0c91b20ead2a6dd4a9705e79fc6068c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36e6896d35eada71269dc55392ad7453

SHA1
5c7181da0ec00a5828cae2f73d251090a14599b8

SHA256
b1f35cfe7036cc850c372c3047bc2b7422e29367a05bb33e33dc09e3602fd3f4

SHA512
2bacd7c91986976a16461b93402194535132aab4cbc85e4f3087a1b713a4cda8a34db6f565d371315dfc22d5c8f30f91b9809021baa359aabe09d02dedbb798f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4c3deeb1b96ee2955792e3bacab1269

SHA1
2e759c061273c27b075082ebf3f7330d9407724a

SHA256
486351c10bb5f62e6f4175e0cb45802fccab0347a91b05835ca322d486a510b0

SHA512
88c74cc741e7fec515729bf2668b3e251eac00738fbfc6bb5b3133469dd66fd276177269a2b6450809e9b74a9671898cad6effefd3809aaae6e08c77f0dc3dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d2d86ad3a9bc8388177c98aa923be5f

SHA1
269d8e2a72dbd91704000a352f899b163f408045

SHA256
37260252821cffa7bc468cf0486af37813b81b1e68a7c735a12f17d15860b271

SHA512
e209daa9150e0e230937d05ed38095d8eea91f0f547849a5202a801088bc61535a86259a6ab3dad39590ee2349dddd9b976bae12a1b92830b3df17fc9e231bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dfffa382ca9b79231ba479dab6a9ff6

SHA1
e87edb0d681a85d5aac32e30922ab5c0227d744d

SHA256
a3345b89cd004a37aeda5a59bbfef30378ed68282c2291bc99073cfd220744bb

SHA512
dd9941e9ca1a5edd08befaa74a20e8c5195bca7358e35127d1609aa0ba54779b64f336e14853cda9084f73ed88fbc43ae0ccf127f4d9a20e438f764ab914b086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcbcea9dbc9ca953c22558c068b09205

SHA1
4dfc1da0788c8034a7d74c9b6b5fc47f71a0f2c3

SHA256
5480566b0c2f999c6ae904ebf5fd5b1a8c674203921617f65f3a2b4e3aa4fdc8

SHA512
3c3009dde87734748fd658545ab53dadd94714eb2d80ea3b09913c6c23f60b13163927cde143fd34b7891f8e070a6be6ef153682e937b60ec93d0e0407f9c5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
795c7d09b8decddf42c8befd4fb8cb48

SHA1
5a01d31661dad2842d341f9d42a40f484a5a3155

SHA256
a086cb298d663fce4f054bf92ac8848ae5f516a59c4462393a450fb32b87c584

SHA512
39e015129b705804f7a77dd480dd641be772d4e04a9d76a2767b9206601341ffe5497f075289a2af7c518cc0cd847894ea23d20fb623a9d5e90d1e3c8913108b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab398A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3AE8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit