05d10c440d15ae58c7c48bf034be58ecd029600d4ef96293b0cef266b687ee75

Analysis

max time kernel
122s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/index.html
Size

20KB
MD5

c7b752acf6d1e10f3aca2c67b1ccf4d3
SHA1

ab793cb43e0c2b5af0fdcbf90d0d29d5d3e164f7
SHA256

69b9f99f6611f953d94984ac35bdaf9e9817f689e1e3614976bebe3465c613fc
SHA512

120addd79b7ade4f35b426c02631c8167d81080fde30a01b989453113f7547784e525d53bede41ede0c9b3caca8513060753ba51f75bf6936d32ee597d642576
SSDEEP

192:8sdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8D:+WNaM8UnbjPk89+mppHL

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000043e4bb20f97e95f88a51ea6dd54e5280dcd997767b4fff4f1e7c97ec7b4db707000000000e8000000002000020000000f829cec296471e368c2ae8a7ba42a6dc8e192621be20f026b1f928e4f3de669f20000000bd1c33cfd6ca61674715efb025b56a11dc58e4d696333cbb5f3e4f581c375d5f40000000d8ea058b0b61cb39d01cb03d709bff35f9bb1c17c8b2161fa5118da92d6245efdc2579b96b16100529259dbc62b3575047e89b843077d29bf02771fdb20f5e60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7309C971-193F-11EF-A57D-4637C9E50E53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000721212372195a5dafe4a9a2a1c664636062c501d7e6e01a08036d957ab7d28d7000000000e80000000020000200000007b9358f140129aeef49cd3076d0b2c17bea6764b9b96773619ced9817f88601e90000000a5086f0000aa63e012e8aff5d1f81cbc34524ab1802671e1532a1804bf3d192b7d08cec2b1f56c2e1ecce3026494a61464d42f403ce7849a7cb6769fc7943091dcee0ea59fba2156510c5410f260cb7999788e7152933f2ab3dae485391de0f430ccf80b23b11142bc1d4fa0d167e8dca20cf35645360b7903b3183bba89de460b3d724a5ca6c0bd5f8bf144e0208a0540000000bda6c86c7c069b05be0a57c2fd92e543a53c8fb586e628938692f30b4441d30369a90169ec1bf6b359c0fd92f8c2a0f284b693443da2d6449c21c3925959bfc2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e4c1474cadda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422656454"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1788	iexplore.exe
1788	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2140	1788	iexplore.exe	28
PID 1788 wrote to memory of 2140	1788	iexplore.exe	28
PID 1788 wrote to memory of 2140	1788	iexplore.exe	28
PID 1788 wrote to memory of 2140	1788	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
a0aca30845c70256390f243ac3dfbb90

SHA1
ce95d0ece9df2e88a74de320801ba3a0f4719909

SHA256
70f48f8d4126ef658931961d05e6c849710ef9d7e0b689aa6aafb11d467659c0

SHA512
bee7becc7e238de96d34ea97a1dabaa027fe521306c7ca34f91c841e98c6b628368f23fd7074b9e4b07d41a7625c7f2124e0fe596f5d749bb15d53202582de74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5fb188bcc29c62780e4b21e750f4f7f9

SHA1
a35a62a5f5360f4d4859233e450cb2ed4f5741d8

SHA256
b01cfc8972f1aaa7c73d71ebc38f02317e7e51d84aca099f20fc52a97c2a84cd

SHA512
12d9f8775bfa5e7c5fe41b50d38de3b112944629d175d01417bfab9a76ee779eba4fee741524d02286028498288998827fc353f7fab97269ee789c8ab172b8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c982d1abc69447063cd28f73c7f8cf46

SHA1
ca68fa7938e74d7cebb302a82660adef0c62d9bc

SHA256
9142b9966b84b473f151d8a5eb0abd84c9b93c81af9fbc340fd183978e9577ef

SHA512
678e0daf18538a684d62563834cb000562d6a0e4f4ffd8910048cea05537279b2522277c8e71c4df214a865ba4bbe1e93e9d5d081ca911898da73b92d0b5a7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e2233724ac021e699a22cbafaa499c03

SHA1
691fef32ac5339d1bfc01f73fe837243c840d879

SHA256
54de322d3333d438b86533358901b73700c6a60e90d564e898c60b217a2765a2

SHA512
320c3ceff727082b796b2a021aa8b2628546ac67dcd7b3363fc0b0aaa53414bdf5f49f1a6906e79937ae469643ceb1832aa1b514d125a46bd6b36f9e67b70e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc974bec9b7b19086a03405c0e9a0158

SHA1
14833e7fc3d0474f383437a88f13266ad5bff60e

SHA256
6866ad2543984dbd33724c3c90a18988c43b6ba2ed4b5edbb936565a6bb51da1

SHA512
f2bbed201da095918a571f167ff6d8a503383aa470d8253efd1ab8f186b8f8a7844e754430b9dd536f758ee3097d8e8d962fe2061c173bc5561a2e57be79bc3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b38d6a977d11beed842468699ccbc638

SHA1
1ed2781b16fe7974155f363348e589cd59544fab

SHA256
220bd28b2b69262824482b8b279463ea75c87e56fa39077664148e6bb9e17572

SHA512
7c457c419650265729dbd23c2a260540aa3cddff9928958ccf98c7fd9989687b3dcb5a4ec3e381e3ac7d138152c056dec7bd3f431bbfb89928098034010d819a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
27e73f5afc751802a1acfe8982dee6ca

SHA1
5374600a9b95813086eb0ae1f97586c9afa0e128

SHA256
879f81848abd4a7ba1fcfcbc582f6c07915a0ba75f860fcd0c3c6be6d4bb6c30

SHA512
164778caf8ef9e82e3eb3a080d77623d6db5a4dc2f4576682396eb065a47ccb6054f894052b50ea4bb45f5bd3ad6edd9af82b00491dac564853ed7ab38777565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32406bd4b9531c93617f67184d4cc2ab

SHA1
833be9e6e1cbb69a29e8f1c163aa187ba1571a4c

SHA256
0094762f5ed3933f1b3d10141e2ccb8d1a93ad76e6c38eca0dd296ad27c4e7b9

SHA512
97d931ca637f91322f16ffd8d6fc1fa5653046e414701563021980bc7a42357f3b730e1c89d0d54974888a6009573ac5ed7ec101cb1715509ac01287015d7c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab205E.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20DE.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit