540b734c0f28db97285e938c115da9c2ff0dc097dadabcb89ae55e875557d8e7

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMEditor/package.nw/index.html
Size

373B
MD5

507f273159739f405b7af77029c68545
SHA1

22c63f759b0b6dc9e74b3fba2c5e053172290d07
SHA256

7961fd930e541547480a747cc7af123e3a7630c974ef367be40b3b92348511bf
SHA512

f48c2263365ec70c5860ba3ceb830c6d012b3ce27f20c69ce85bc167e814bee49262d68104c738d5aa74d27e17b5134f1df93d4beb36a3ff3f898b536df89158

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3011dabe8596da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ece3e964dba744bbabbf264e88500100000000020000000000106600000001000020000000b1fd002dae3862db1812c477703fbfaccfeb249fd4f381aec8b396105a74c2a0000000000e80000000020000200000000a3e914b04925d2524957e9f08c33df0aaec4a0b7860e95216dc1032b6b67da09000000077fa67222af09a326f169a91b97bb199107c95ad872922696663de5fbd7318c02a7bdddb705a02e28cb5eb7dd92b6ef6ba1ad6b7b85e153344ad0bb1c545fea7e347bcd45da1ae2fa056e7cd37d88a07a70600a68e63a4b8155f3ff0165f2838fc0015867e4ab2c1e771f45412f1ee11368d3debce2219524bf2b82712d467292d11efa6f970e4050acc2a7e3b7d009840000000536c4b39431cf8e9d5b504419dc3cccd93236087766efd0b1730af4a0b27f6d5e02ee723bbda5033dbe31699e730352bbd11755c8ac93fb686c0fa5f344fa64e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420152251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA47C5B1-0278-11EF-932B-4E2C21FEB07B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ece3e964dba744bbabbf264e8850010000000002000000000010660000000100002000000030d8aac837ffd7b68c4d070c1fd5b8824f9b63c8a9ca80e4a81504050ba35fe8000000000e8000000002000020000000b6af0569df65a13dc6566c7b23e92e327c9a03aa37d3b755d60dba94022c4c77200000004669b4b4a9a752472b112225801a96b57af4e6bd9c6eff05a5daa0df4d6797694000000065283fb697356e389d8778e85af2003766d2959be0339a6f8d72a1e2d4b530f6a20a2763bde6126ccf7a279b7f196be87540bdb27474d20862d2646537a379dc	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1940	2352	iexplore.exe	28
PID 2352 wrote to memory of 1940	2352	iexplore.exe	28
PID 2352 wrote to memory of 1940	2352	iexplore.exe	28
PID 2352 wrote to memory of 1940	2352	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SMEditor\package.nw\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ab9e8122cc0206870e4271869281a3c5

SHA1
7f2ec5c0d36879efb9c810de67f3ee996360b592

SHA256
f39e2183e7f6c41f8e2d3b1b5c6aba75283609aee8638016c2f2b0838d6c6a1a

SHA512
64e111229152eb333a567d63a217848f28f56199216f4f5ec816f535af266d5d45dd72bafefe44bea6fc03e559dda36827e1e7c26bea7a00602a5c0941d37751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d58c0d0828bc3daa7ebb214281024ea1

SHA1
6b86bc5e2c2c08004e02d136ba398821512a610c

SHA256
8df8c797098ad8ee95014768c0cd08d31f82b88bff23fa6be0627d06e9b0c12f

SHA512
3e4de4c60cf01f54a5fa03090e1665e5be96ffa8316b089d85505d961501094c3a91f73996f29bf90fc26d89bac003dadf81b2006b96a8269bb42fb78a99931c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2293958a46f3f1fc6b6da066ced65215

SHA1
af70639774da076d087a8001690287a20a62c86d

SHA256
2f28c258fd38a8c0f2ea0e3ccf9b8fc56aa26cca06295bbee929cbeec76ebc5b

SHA512
c908e9c82e671911ce9cd02c68f58a190c6e01f7d7d721110951a70c9ea8aa62f9b205a3178750c12d6f6487208f5011b510dd80070614f888f7bef33dcafbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47b0ed38f0311ffb69b972fce4d774b3

SHA1
cb7994eeaa3a7f9558d665dfafca83f9d4188100

SHA256
0a89cdc8253b3b4f1579753f124f1795399454f6c16954f2becafa72da60eb9a

SHA512
89fe062d307df238cd80b06168b08f6b8ef1b7988fa310b76ef08d57216c927352a0e372323d18a089cbb9e87f6e1b067d516136f91dc808ae68c1ba2e6cf47e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
838199f2f321e748412319fdcafe9c63

SHA1
86b733f95b9d59088269ddf86d75254f56765287

SHA256
afc1246a3382d25237f967e53b6adfced6ab1b2dedb56638ac35740bb7043045

SHA512
f2bb2e4d55d5f323e80f4d0a0655331a6bc506eb1b8c03c9ea0f00e5fb0a1534dccd2916f82ba6d654732e0d68654439dbfc5402e81644bf6422a5ef85bd73b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e42d286dad73dbdf0dffe59e2ec41d1b

SHA1
051562e21a631a8639b94addcbb50c93dcdc39e7

SHA256
b648bd9170c9166853f202013600d8800f626d4a0e55b29b14d4f4135c4c8fe5

SHA512
e93b585a2aa52cb81d2177cdbe268620db9b9c47930dba226dc990cca9b2ec648f2876e25f6dd5b46c50264d672ae689f6f3a33927370114762a475b055b3c20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c753cb2a7a5b7b95307976bdbd70851

SHA1
263580a251729394cbb5ab11811688dbf8cd664b

SHA256
9a9c128de06f6d2605e9b67f94ea1161ff30b0dfd7fcc79a042f95f8be080942

SHA512
a2b4dba4900a47165bb85601b1e82ab0086beaef635c331a20909c42da16e2bfa96f9dd6e5e516d4d3849339fe392bfb2b62131cd4825d0a25c9044afbf6143d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4edb26cb51488a928a51bf5295c8b47

SHA1
233672e18b3aa137df46b39d431aaa8a211230a7

SHA256
a578595d7555f5f8133a436277a850a401e6e72286db97068c8b6fcabc44c15e

SHA512
88f02a9595a3b5bec444e15adc0848a5559c151a42c95bd514643fa5cbe5db86b71198d4a9380ed2ef8b46d6445ac139cc9912b7d69d40804d5cca472176043e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20c39736693a6acf689b847d96700e6

SHA1
52210b490cd815d3fe86daca5a81f294c92fe48f

SHA256
35dcb34b07c0994acf5e33df6d83e541e8ce9d61158c74c364eef04ca6fbf73e

SHA512
d71e2ec05a8d18588c0ed71cf57985d0c3f0ea2d266c623a61e8a9d973947d5b792cd4758981d498401b61c64a466573e8f2572a168e15d05f6156081cf5bf09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef211f4204f8d0695573f146d41073a9

SHA1
1e5d9fb37ad1287ed37d0f8a7086b9a958aeb19f

SHA256
cade62d5860e224dc5b53d33e75c83bd7571b759c9c1e18bc17c9416e550a1bf

SHA512
2fa24dcb1e093b65a1079b7c83558dc4babbd3a8363b98199cd3718b06e648361861c9620043bc84d3dc4e5ee2e3eb65065d6fced785b8b83b952e4697949d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04f7e807bbe4ae9e2c5596488d0cb4fd

SHA1
a0589380ebbf5e76b83e44525edd5f9a616538ea

SHA256
8b9c649656f927937794556066b9fb45924e5e0d7cd115b6a5917bc8917ff36e

SHA512
27159fe75b585ad4728692c1399e001e924f6ef672a9a195a3f716decad4aaa6b67de6d68be80793c83334532920ed3556be3c1e2225c89f3ba9e1467e0e7ea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b7940aa9fc94425af4f2dc68476d2e6

SHA1
1adbe96457b09ee18256ba2f76eb298588a83640

SHA256
a8bf11d864720dcbb3774ad58b63526364e5ad2bee377743f427593f55f3c8ee

SHA512
ba6676c61157816cbf58835a7a6c83ed6329f7446088fe957a75e1c6ca238e1f20171f6eb3e78d743ffbcb621fe4fa3a68bfaa074ff4bcff898c731e5ee516bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d8f95ce73787b44f33b4c048e26fcfa5

SHA1
452de8fb51c7c300732e41ddb92abd4847f878bc

SHA256
230526037d3e25074e46ea189cb03c2f5a73ac988df2892ed0409a856e553815

SHA512
225a8914181920575c42e1aaf166044f8e306d781497ac2568e02072be027c94f9a1d504e515c60ec95485aa49d44ed29e1ee99b7af1150e891df78a4be90c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit