84672b8b596c138e020c1ef4a60dd865e429d6b7cd7d73cf62ffc2cd96fc4b73

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

libzstd.html
Size

291B
MD5

84f357142266cbb6f829d2a8e735252e
SHA1

5da3dc92048231e9d39e3c3e909b2f3e1e06034e
SHA256

84672b8b596c138e020c1ef4a60dd865e429d6b7cd7d73cf62ffc2cd96fc4b73
SHA512

7093b7504d803333a1f2fafdb9878968299c10ab2694036cdef23a3f522ff494185a701e15673cecac72117fb249b3186b34281b0976cfce8477c30012116244

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000006a09e05bbe3d2777f4a2d277dcc3e21fec8e84e4d5c8bc83231bee1b7965549d000000000e8000000002000020000000ee65f5a6fdc85a9f24af77870c783d6a750e19e38cb79b3e44a86567dc72f92a90000000bb0c497afeba7761ab12ced07d777487bccddee1306aefc2ce33814b576edbddccbe2a0a406410125e130b52f95c114086c31f7330af8934981325bb32a0dbb86154362049ffb1468550909d48c2a5f59c294068ae68cdf33fe372e72e811c3c719d286d21a9ec11dd40a8f2af66fc19cdf467408d54caf55cb2e1295803eb5c041385dd4c65c92c224de337549ef02040000000174db0308b9ba747b1a7688929e1464360f243b11256902ac62a49d33a9a87a0bdbf6055b8cb9f23dbf3a484801c1df49bea933e37fdee3fddacf4b398659ff0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d971d743acda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422542869"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02F04781-1837-11EF-A4C2-6AD47596CE83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b000000000200000000001066000000010000200000001b75fe63acd8b326f95b57df0aae6ca7388ca3dd4fb4c2ad2156ffe6eae5b897000000000e8000000002000020000000ae3cb40bf11128bff96443f8e402dbedc8999a7d9806e529236ccaf41c0325c620000000ea65be0c5fb8708d09d754ff82dff584132e1855ea502a348c7382397479ab4940000000931c937351167f1dd9e19edf67aac4f345be1f9bbb664795ca481932b671658065d3ab99686121ee61c4de8b10c81b6d5570aec43ff3e675081e491bb16a3b3e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1704	iexplore.exe
1704	iexplore.exe
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE
2168	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28
PID 1704 wrote to memory of 2168	1704	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\libzstd.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3262872cc951a095f39d3d8ad5b2be86

SHA1
02a921d61677f3e3f8dec422301882c434d77d73

SHA256
6b70dee12162f991a0ee2ec7fb00fc66ef7b3c62c33b040ba2d51d8b61a22164

SHA512
a8023b6cb87c41dd4f73da7e49f588ecabe72351db7b10faf553fdfa4c5f3f553a8e5e8015a60ad3d4968ea46d69bb65563ba68f9208365a53ab9f1c9b7d246b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f627f3ffa31d365ce5ca9bc16c0eb2

SHA1
80c2c86cda6fac68d0336306e6532a7b6f63f7a9

SHA256
8ac7b4859a9bb0b835cf238cd9be0049aa74eaefc0080419fbeec0d7be1afc4f

SHA512
ec49e267f05bf9825de310f2cde41df5f74c63c8c2802e865c04676b49886ddade7a1b6ca1ad20ab6f90ec88754984468ead71b1a5c78fd88346b9d07aef5f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6df70d7bb8504f257b46c2f5e8a54db

SHA1
0c3970e29c29a7bbe3c17b71a58d5b66e3e8b521

SHA256
d3c450a9d9d6ebb1ae65f26b7961691f5d09736823457ffa63e55845ba18b107

SHA512
94a0e7689e8091492cadd2040bd08f7d16412c4c8166ad18848bc45ddd6978acfad2ee0aa50c4a8f967bb13f18cb7e3edbd5311bce32b83d94785da79fca8e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810e6d73f91939d11bc594b1e7e7d546

SHA1
d0888c06f38ae1ef28c3276b2f45e2b97223713d

SHA256
72bcd13eccd8052717700e22ab79650fe4f4cc676823339b43e6907838a96d36

SHA512
ed7d578c5e8df48867eae56df48ebf452ed59749798041f4b22619537820fdcc92484db8725e5e5ccd57caf78c5853f75d5609e286657cf916b41e7fafc68a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a6f3f1b8e51d5e2e96be92dc78e143d

SHA1
868524625c37284b10cae96e6ebd0cf6d246ca4d

SHA256
93e873068a6cbc1015b8f38cfd5eedbac69b0b65cdc4b4a7a287f6660d9931ac

SHA512
069d663c17141058fcf0855add2560fb3e3fcee6262856c9d092cffa187e3056cb133519a493aa5285651e323db247faf9034d1c5a178b54497e8da3ca21d0d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26382858f1c5914196414ed2722968d0

SHA1
d191ece5bbe50694841043928555b272d12cdb72

SHA256
51bc0a1e73b2aa8204f3c8179a1bb6ebd85792e5eba6c119059123cfbeaf514a

SHA512
1b228a874757515d9539aca65869a530363642998d07ee181846db7404e58b82531c8b93b65b629262433435f41a51b6949b6671f783e75a1d2b5c79a9b8dfa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d755792d9a7276af2af0759865aa7658

SHA1
5ed8c7c500f3e413fb4c00974c53b94e1132f091

SHA256
7f48cbd24195e7532689d4c0f7f95a9dcb30fd1df9f4a77e7a8dca14ab3bd39f

SHA512
9a124162194108f65bcf93838bf9efa95c9f07311f1871c81705631908ec11f97a48156b7f80681945731bfc56b5b5dbb910158a37b70ee5f8af00aaf8f1c6c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7918012f0fba53c3b524f3d72c0764c

SHA1
6b5baecaed434f44908c64e9551e6b03b3fb2b5a

SHA256
04684548a4146fb5e727674d2ecee436a4fa6f6af439e652a9aed312934f6703

SHA512
de9f0bdd134ccad911da0a688452969b20f5056ae2f54499eb4d6328a51e7696dc6f5f12a9f9afffd3bb7229e2f31c8c875501ec28f36bff22ae9bd0004394ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
448113d396ecf68216672207280a70ec

SHA1
6e6c5497c9beaee7dbf13ad5f5fce996b50ebded

SHA256
c1ee4850d6cecff766b0e6e206bfc2d56f6d876466904578fadecaac86ce80dc

SHA512
bbc6bab1ab2b06757fa6f918998a3d3b296b94863d3f701181229b5fdc5eee7e421f2dc2c4f54662d13a3ab82eff61e339593da0c2c8edfa0ca2bbb95d7ba84a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5488591eb36d83b1a0050fdfbd450683

SHA1
7f673b104de6c603df4a35fd3cc78247e30a5544

SHA256
52f53826a7c9a5be8faed39cc52c2516c1aaefcb607c7d2bffb48f088f797d22

SHA512
fe1ff93d92045af368179f6bc3f5d73fbecf5d1d416d0d8ac8d1abf79588985dd5946b1d912e1ef07a41db24c1faefb7c73688d27ea7af0f77818e568691b38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30F3.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3163.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit