835a4ba84850cf50c58b958c271dea8433706f88112812e658239dedd2a9bbaf

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Abyssmedia.i-Sound.MP3.WMA.Recorder.Pro/下载说明.htm
Size

2KB
MD5

e31159167e6bf59f83538a79942a1ba4
SHA1

5f4627b3915344a2c2137b078c9d103dd9d03a41
SHA256

393449e0bc51cf913ec7c0ceb5af646c855ba7959b71c6321f448d98cf0b7f4b
SHA512

1096ca2d8d75f804538007ce02e239d71b90cae5e9cd0bbf241224a146aa4f3a444024a0557cf2b3bbedc424402bcfc89cec1c5908ee33822174e50f2ac16805

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB2F6CF1-0EBD-11EF-805B-F637117826CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000e87343fbf806960188411db32f0b4c328aa0b11b45ec74ed417733a12b35f8e4000000000e800000000200002000000065791d3a78d911051a3c8152a84978a1534950f2889e63ab7d2fc1788a194cf6900000009cd92ee13100cc0a7d3a51d3148ffc56310bc984d24390a9cc4a1e894dbe0a4522f8f7dfa3a831e2a29fd3311e80c21678a97e52bddba9fb0230b1461ac43b92f23fc26f052ffe167b8c7ee0fe03ea7e9d6956c523daab3bcc5735b72aa7589b031d131a6c708dd4426d8c8a4742bdcae791310993bfa776d2ddbec24f0a56a08d51cb1bee9e43dd8fff695793fb14334000000092592eabd6e40eeea4fa0d762b823667b857355c9548ebee5b28d29ff7148534aa70f4f4e90f179eeaf1f901fe415103b73365c35fddb0a83d3f0df5227580b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421501219"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905f1084caa2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000005bd9f4f1f63bdc9016c98d5d48c3a461dddf293f3bc535dfdc750c0d86b20671000000000e8000000002000020000000475dbc9b448f0c230e770c3ef46cf99f49407c115571b9b9772b5fdeadb5c2522000000015b2ce66abbbbc1af0e7e37f71db1fe35115cf9a38e8e95a341e73f694b4bfa840000000b95e7784cee829b1a77ec0bd86b5ec2372109317e8dd848d0d923915b22d4d573c09564e85210fdd2eeb4ddf1155494da54c8366838cfc16fc09af3fdfe62e0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1232	iexplore.exe
1232	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 2372	1232	iexplore.exe	28
PID 1232 wrote to memory of 2372	1232	iexplore.exe	28
PID 1232 wrote to memory of 2372	1232	iexplore.exe	28
PID 1232 wrote to memory of 2372	1232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Abyssmedia.i-Sound.MP3.WMA.Recorder.Pro\下载说明.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345f742eb8277bf311cc56ebd8a37bde

SHA1
967a8b77d83d4930c6eeb505ec603d1d29cffe91

SHA256
6cd4da120ce963ee2af2344f6763d6624ac2e35c0083245d4a20ab0472a57417

SHA512
68f6c1a5c0f76f02b44a1505f9ba13a77c56f9af9bee64523668cf9b3ff16bdf467d8154e085c55c16e130279c91a9fd9bbefb08d7c01ff84dbfe4cc6e517b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f1d72895d762aab3e91cb3b7c5e7b42

SHA1
fb2e1a81fc69ad8bc9b3b5c2662f70cffebf11fc

SHA256
2a0dfaae0eb0c936cefd65a3a567368b05ab37be8aba0391fbf2b3269b4436c5

SHA512
799b3c3558c1a20b8df213842656381252e2b2adbd9e6477439da9877bbbaaf724c1c2ee105fe4a866f04ddfd63479422e4d5be3a13fa0c63ceb144527297acb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
598f608fa028a3da8044ab78750516fe

SHA1
ce63e36e02c057fdcc1c79123c4df8ddd1228c0b

SHA256
dbb47b910764397cb6f7c5c267776ad9e5673db699f9db3557893521618b6e8d

SHA512
16c76a6111dd70fa08deee10462b816cec9535229446394e4f888a21a30ca3c2b869285796628ee2a16a575cd231f62afcd90540d87b5a93fb00bf4ec2eb0dd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbf2f118a3d42fe521ced1dfc6646ba5

SHA1
6a5453ec0ac1232d7edc9db2d69ec3ff94cad631

SHA256
586f15319b46bfff5983d88c60337ca937297aaed846e5687664a51db09fb705

SHA512
0dd9f651a695f30e385a508ba442a5848f0e0e4aa533e2c09bbb7f9d4280c2dc9513012d8d7d0025121498a824f0c38c144258370b8251815639430f1aef7035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5879e093c177e539d40b8e6f8a91c235

SHA1
b622df2426f3beccff1c9b62c7ab16dd23c99054

SHA256
e423f5ddd8b409e638f36439c858f0ecd6922357344a7b9fa6e4a7c84ae38c7d

SHA512
17baafe153526c1e50dcad2cc432ba64154b5f268eb68e52c0b140e87bff8e51888134228e3af199fcb611db1c97eb03e3f18ed726e754b37789194c7d21cd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eebeddbc58bf224f8aa64f290d06f69c

SHA1
838f1c15efdb1371f2ed319dfcd4839240264671

SHA256
4f40201c0309970063676a2f4c3d5e410c3d5a80f3ab08e3798677bc241300fb

SHA512
7d5b98773e43dacb004d76294eb038ef8412c2562ab85ff85fb060ac0bef1a2c4bfdac2b07bdf7f7486dac5f90958960b23e0a2c2ee093d8b0de92e8768b4c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64a6bfe7add24b5d6c85ab5d0f85378f

SHA1
ab0a92375ff1bb7aaf4161991a3058ff57247863

SHA256
b00985f56a6041dcfccbba3426345a5a2ce0fd8babd5c8b541a0c8cb101b98f0

SHA512
75e590be2f62fcb58d72eaf8a66ed872abca7a6408da2a5bf7b78de91ea2ca8d9fdcfb0c6e805a3108861eeb562f1daf01d18588fc1cebf6a8fbb3ad932306f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
356d5dafaa1e1e1fee6d10a0a2714541

SHA1
cd3aeaa59e0797f884c3a453abc786621ea1c5ed

SHA256
b09ee36aa5bd20dffff5c966d55df1d4016006ed90da8e404246b1badbe4f035

SHA512
4216f00f5e7caf45805c72f67dd4d2b54d811323a3e634a3e79acd4e188de5aa0f3f02cd0f97e72fb189ab1eb191dbb23026ca6b1cd79db0bc3a690eef684599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c6490e235f28be357154cfe37570919

SHA1
1aac6fe44cd6343993c6ccdc96c966dd4ba97950

SHA256
0e9289181ceeb29ba9afc90d4d413d2be5ee733073d146c58df95faa39373c80

SHA512
5df280402cd5f2172e75af6e74499dfd2ee70837f7a17d92fe0a8c4c725d446a2eff8966740297edc9c2497f3de98d9434ffc7896a7f5dcb9488ed8755bd26f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6116ad8412b9ab368284890b43fce4bd

SHA1
bfcc04b82b28d4c9c7fbde518b223e278643f5fa

SHA256
8b3b60576f0c69775a43bff9467ec5e1c8aa8bab9506f3cfe0f32cb392454458

SHA512
752c3f6b7ce15d5eea795ba56c8aa08010462af1f461390e5ca6cd08b0dbb9de23de86de710669b554ad1dbcf3360161b755f051dd67d0f123cc23477c5a82f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0707d8590f7d2b73e07ee1edd6e1855a

SHA1
17ab7b521ec5f72276c4a650019cdb33680d8158

SHA256
71727466b3fcce9c3a21074554fb6c08e31fe9bbc47422c1a424f36107d4d131

SHA512
098b70bb5ff88eca633759ecebab0cb81d330aaefdf8f227a5f9828b2ec5381f3fca762b48efbdd5177e1ffa4b64dd4204c88214ef91a6abc1ec6b671671358e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab29E1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2A42.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit