540b734c0f28db97285e938c115da9c2ff0dc097dadabcb89ae55e875557d8e7

Analysis

max time kernel
117s
max time network
157s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SMEditor/credits.html
Size

8.7MB
MD5

a89a9160a086d9107f68bd94d867459b
SHA1

60559bd1d605f5618a2678f77f49e77b82fea530
SHA256

d6444df5c17e30a64281243da629f07e44ca84b41ec2dd5b153199f6302b29a7
SHA512

94e8b98bf8291803a712cc4c7ba39d548f90f2914842a5ecc60721c77f3208e434dc8a9d651ed5a3ede185b53830664f8d91bde58f2811129e9eb8e5173190fb
SSDEEP

24576:sZS6wm635kOWSo8R8dwVemfl6S686n6x600HTw7p9V:syff5

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000cbe93c3df945478d245d8ff58a7c0b00000000020000000000106600000001000020000000847c0f024d54326ca08a54e58f835569aaf4dacedb53f9897871d468ad8b7c41000000000e8000000002000020000000ddba4a7b675c245ef49568b970977180943ce8f8736fcd8f094ac71eb73d16e1200000000c90f5ea9d17de3e5a47c54f1e28390f1f096a339b3031ccfc3c3d6494dfa289400000004e9a0d8f35f82ad06af04b1682b5693121762d96505c7ab514a273ccb0059be63c44459f64e72faab812871a3009949656622575b1b36297a8617477da05c21e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420152270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000000cbe93c3df945478d245d8ff58a7c0b00000000020000000000106600000001000020000000f660457f5f9026701b2610add803b9ec822f420b78233661571cd01a2b428de5000000000e80000000020000200000003603d9fcc8d4d54f4585d6b341586856b84baf6226ef116ffaba85c0432a0afb90000000baee8959cd930043d0d515ab99001c3b18f6fab26417d4d855c30b7d46f720329f42a208af2c1929654f7f3e573710d98703c8442036613f11b8e4a2cae7f72d1adc3db347e14c9c82a3630d5aa51c907515ed205e0f975ab84eef51283f4e71374127aca050fa76ce6155621a0602b2256d8369fbbd7ff72d4e0a03aa5f3c6aa5a001611e15dfd40e86d43f5cae61184000000066c992675076af676fea79021de14ff1b4934e30809992ca0c41d91b821a30f6ba084dba27f46779d4dfebdd0e483cb795f3a976619d339c7313dbf68d50d782	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB44BB81-0278-11EF-9066-F6F8CE09FCD4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80925cc08596da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28
PID 2368 wrote to memory of 1860	2368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SMEditor\credits.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
504da92c127d92c472992ded61c29a26

SHA1
0ed68fc8a948208db9754bff14c45515c9e2ddf6

SHA256
2a9c4a028902cffc6fb2a0c27c7e4a5eeaa99605f00106b9ae3fe2680a7686b8

SHA512
95cd6fd42cf7a64dd70f3c82ca13b52ebb8a386d03354fcbf5dd3db1ff24e1c26a353f0f4460442e89e957c40c897664e3ca3587e222e4ccc9706ed7bfde1a63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5344df5047e59c736eae0dbc82a8a1cb

SHA1
958b779011a848c44cce7cc50f2d5ffaca92e3dd

SHA256
c55357ef112948a73261b172f13bc17aeae37f1ee82c4ff81c5f8c201bae9c31

SHA512
714b6249efbc637099e4c2be6bbf0650a902f9c6f374d2e70811b11e0c7549f5fe07802842ca720adf636b1a41dd6589f13f57817b735aa9f5ea0e00bbea0a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
996b4d44ff8f34f51b2f99c0042b25c4

SHA1
4bf8495a6bc5022982c90f550251b802a27630e5

SHA256
7da3014249026dc36a57d4e01c53b161bc0d3803d5ab93b3b867895ac8b2529e

SHA512
2a33676bffe99aba9c3d8bb3e873e5342bad3e71b64e8299961a16949112c327a245b9f2597cfbceb52fb942a9410638e552e0f115571e048f1e24a7f92c92ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eadda020aad628412642b9be4d08587f

SHA1
4d1486f078dde8bd07c300127d1bd2bce12be3c7

SHA256
bf88474e9538d8dd096861364bfeff22523d376d3620051a6a6a7897894ef1be

SHA512
084c3103f2e5b4425d637e6e0197b69cf324570abbfdc9b936b224b61fcb8138a5748fc675a05d540bc9f78dabeedcbadc4502ee46b0774993fef3237f5704d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af9ba740eb26e67ee2800fef3f56e026

SHA1
811177a9b9444d696120a08523ec54d42a40b4e8

SHA256
cbb3958709c0a867e69d43456876545dac76f788afb6653232e9dfc7d5259310

SHA512
148c5ab3224e89a083b96096cf1455bb4b81e5e88e51d66481e66e6ce6a5019950a080542c639d7cda898ac1e13ab052abc9170ac95efd4f6953a3446ebde5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9212c5413952f4cec7939a6d5c8cb1d7

SHA1
63955b250c31931e4d1b01a5576a2dda9b2064b2

SHA256
31ceb6785ecf03a869272268544fe2e37a8886fa1260bf64c76185ea75fb3a2c

SHA512
75ba09332f7fc2f6e1ebaee41f73da6fd81aa926baad0c0b0a237965d130e09ef3d7a639a3bb590c54f786d4904401df24d5b5c7231a3b13cc733cf7cdd56cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b07930a5ff67c13880b29dd24ea857ff

SHA1
efd90559378e53630df11041c3e83476146f885e

SHA256
33f95d787ee45546a73b558ce75f878849171aff2b4fe4953b0e76ba0036c6ae

SHA512
85bb9e8e5045016b9c9c823ed8a8be44bd52937927ed543be09d05e7ceafecb383aa71458fafa2eb6e4df05a1fad2dd48a09d5040fcb3e0e3d6736e22585afc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bf288abdea1fb4abf2f309d1a8c343a

SHA1
902b359028860d7e1e81f9639763518555487a04

SHA256
b57a4ffb916359b65da50e251947394621efa60d09aa040de97b2aaceebc7293

SHA512
45609e57275acf96c918bad94273bae8f679a5d39109f5d8bc1b63ac6c52dd12170dcf785a1e81c75074f11acea44aa9c90aec49f8748b9ed098ae7fe42ec106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7d7409e02c7337229651739d3d99c3ba

SHA1
4cdc1af75435be3fb2056650990eb8401a3b2a1c

SHA256
5f1ec19b149f7f3027ccab52584d7a665f492d8fb0c9d6e39bfcbb91f2191e3a

SHA512
2532f0862ffe3e62da09d332b0254426af2d04513a9e620121e9e380dd62b3276f9bccea33dab344351e496aaf16aca3b96fefe34a88fb771ea92a33240cc870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AF2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit