05d10c440d15ae58c7c48bf034be58ecd029600d4ef96293b0cef266b687ee75

Analysis

max time kernel
119s
max time network
137s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/05/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/progress.html
Size

20KB
MD5

359ae05967ebe29e7f7a3564f0fa3f53
SHA1

3c1a454e8f5445ec890c5c2c11fa9e24bbb8e4bc
SHA256

f2182497ffe118349d8a462cf0eef55f22798a17e91846b194b7298d860ae38b
SHA512

0b61dd5af6feef3e1361a9ddc32dfca2200af44507f8f4e2c0f73ebdcb79e690d1f7561d86bbcace1ba16c37f18d6d40670de2d3e16b88d710180665de51675f
SSDEEP

192:dXdqpDNDPkFHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ/Hab48JgJnc5w/93mJ8F:d8WNaM8UnbjPaeu1JE36+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76616881-193F-11EF-8859-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fd764b4cadda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ac729769f14de46b02ed75fc9456b8200000000020000000000106600000001000020000000d7d70e48f18d07d0cb55b69b569224c7eaf5cf9ae34cf7e7279070c6b3f3e3b4000000000e8000000002000020000000eccb2cbe20cd3f49150488a6d8dfac4a06dfe432d1f474e7b1b70cc6ddc5452720000000f51fb6c5b0a143733648dcc86bc1a7022c66c94789168389321025cffd4c52e84000000080e3f39927d3e89742e98849187a966c253ac6ac8f96bef2aea8fc07eb890b6ea7f064e2287ef112c86be71d2753b2b29cc972bf487b64f5a56400e1b452c837	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422656453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000ac729769f14de46b02ed75fc9456b82000000000200000000001066000000010000200000007fa5e0a2ab1d87cd11c9c6282c6d49de0ced8b8e1965740fc5d26d61c1341224000000000e8000000002000020000000ffbb79f3f445fbc1d3ef3942bdaebc15b7d1347827f4f457742f7c7eb8212ab49000000087308ac1a1fa1a7b7c37c4a3496dc626b9bd9cb81599e6dba8eae6920bf1ac99d6be339a87d35cc9ca9945b34c7f17c1ca5775fe11c6c37d0f2811a195b38826b10ec925fa8d750ad4f3e2d59ee8f7470e26881b62e297237a065e4934d29aa61b9ace23e6ac6ecd1aae63da67f64b4dd07c86957c6ad3498a5387756c31f6ef2e7f54e2006e4b1c20ed34da6ab02edf40000000a6b2bd139ed3fcfbbd6e520d528de7e2409ed61b08212d9575c453ce49a32127e0d0220580cae989585332bc845c53983c980439986cf9d9549803660ea2ca7a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2224	iexplore.exe
2224	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2812	2224	iexplore.exe	28
PID 2224 wrote to memory of 2812	2224	iexplore.exe	28
PID 2224 wrote to memory of 2812	2224	iexplore.exe	28
PID 2224 wrote to memory of 2812	2224	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\progress.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00a4dbd447ac583e73a179530b75aaf6

SHA1
7d2b6dd4bd2df0eae3ecd78f117824cd221a7e97

SHA256
4c6ccdac441e82b78dbe98000ddaa4ba62f86cffbf3dc535908ef19d4e7ed215

SHA512
e06f3ed6ace7b0af647529a415ba9dd9ac8a04de21cd986062193850c9ec7a22ee56304be69b7c1a052ae6060b24b165c9d70d893ace6b14e3da15c6bb3ff1a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f1d381aa07f794f185dd41e1e63f4a3

SHA1
ac32b6ae3085b5039e884f6ae2c66156e23b3e3d

SHA256
d7b918b25e2c2124110fd22e6a85d9440a0a0a8d4f0d6c5a6c816187148a19b3

SHA512
b5ca2b7fc3558b373b31fbf6c5939d802d0fc4ce4fbf35b933cc5cdc60c86d06343fd968e53eabc920ba57c1e76be7e99866be85106e38bac4c43ee6b8267395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91cc013830b99c8f17ca608f02893213

SHA1
f0b791fcfe80634754af9ea472f0a0e9daacb4a9

SHA256
e23ac1f742ca5bab1fc04ce1b537da15f56aa601afa7eb82913d8a97abe8656d

SHA512
93b5c3bed7b9b94c5422ec6f4c28d79a18ab79a3b23af07a390a82a5ba36d503fa72d6ba3acfeea3c3bd586b4357b2951182bbbf3dc8e9dc73fb4f8f5dd4d1a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e706b0656d81f549a3595c93a107f03d

SHA1
f3fb2d9101553b6c2ee48fd7eac8af9f76eee2ec

SHA256
8874d3e6eda6bcdb2640c3ac3a7cc829572352e59bc830f8bbdf1815b639a8b4

SHA512
ab8ae3da03004ddf25ee06f2136d2cade1fc551a3c1b2d133141d9834ec733d3c48c983156cba61492f7f0354a3fcfdfc37619ec4bb48493be4018d56ec95bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5193b8f02205c3db595e0a52c02d322

SHA1
dc4dd3dce16be4beca9053f1b85d630a379c5c58

SHA256
c154246bac5b49cdc93221e7deedbcca899e271b6383ab5d609236848ded9735

SHA512
37575cb3154fd7a7ad42b21571851a889771f46b4f09c4badd3d401d8e0e8e7411422866871995bda5138f11b683a9bbf29fda5ec8b2eccb75805df332dc6dad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a995614769e5ec16ce11d0de7ea5e73

SHA1
20d8bad7ea03ba73a82d3bc66600fb7da71cf975

SHA256
9033d6f3eb5f0825d23f3153c65668764842fb771b7a6ee993c3487a2a5f9229

SHA512
bcb008c2c62c3d748898ddd2d925144810ca3793aac947711f1e81f0ed91548d6d815c71b24a1612a17841b94f4d205aa223657b701f8c73460be811671d3933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a5fbb49b8da662421f6b7a83616584a

SHA1
78b810f58f524123d4aa32c54f1469f3291cea98

SHA256
007a42eaa1ce5fffec9e0c11da6730a6be6238b0311276aa11f5bae6a15de2c6

SHA512
5bad15e51fe256f13ed14eeb19c8f2a0466b9f0bc7debd6b7803b7657b15b159c38f165794cb0219c4524024d439172cac367df7cdf2c0301c2d705f051d32d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
400ac39c68ce346d8dac850122ca88c1

SHA1
c1a04892a979ec149e4e405fbbe74e1d16ced0be

SHA256
97204363ca2707eaeef33c099d687e040fbdeb53cd478ab1e118efb2119ba7c8

SHA512
c87d535b2a12bae0db6c2c95d14705b0bbf49b0757f56cfbda0edecb994de77ad2f8c8db607da4faef335c49fbf315e7bfba46501285917e7d4170aa55c8b6b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f25cea4c0a6dbb43aeda8395e0434cd7

SHA1
6c3739dcf9061962b6411136134fa960d44b8178

SHA256
862d80a8a2575467b572a076dd7d467e4677277d2d8d97449a2890d09433ca57

SHA512
d045bb75e907842dbd2786d230b9cb5dbe0bbc27081c1e5766360253c6d6f2de5ca3a522d5d5c2f606eb3622dc48aaa434b90275230bcb551f73974c20a028d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
469faa28ea25bc53048d5c3315f418be

SHA1
734715d97d6918c9c670dd80ee385369044c1cc6

SHA256
c72d3cb772f4c9da36fee93bcd982dc51759baf3c3c72c6ec8fd4a58b84161e2

SHA512
f31b3c61add52d536ea2038df0dcca99ec05fc89294c784cb690b467b292d9244f3e1661328de28a20c22a11838e4a7e6884615d8df478504e1210ff1e768630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b65f3b2aeb39342e3bef8fa1e43b6ca

SHA1
82254576393300d7b4822f1bf074a9bffcd8db2b

SHA256
235424deec1173f33a340d8920cedcded3d62168bfd38e0ef9c86cf6cacfb4c1

SHA512
b9471d9716eb53ad109fd7c9572f7a1d5211e283fb4079295a6bda5f725f5916f119da58aff540e415dec5c8fae085ed01043c4fd7525e2c057a94c065dc53ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4dbb9dfaa04bafad7d467027d14889f

SHA1
9a091da8feeb1a3aa972b9d3eec2e2180afedda4

SHA256
50a6e1ecec5aad8f6d52f38be409592fbd000b36c85685be0a68551050d2414a

SHA512
c08ff2fe6826bb5d79e70f85eec2715878892ff04f92aa58051ff73cff1f2a0b5b4b1fbeb3d9b8c55a4cca560e473e8b090631d79c12c24d9719012bc700fc8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51b39534d2b31540093d2149186c5907

SHA1
1f5658d4c50600616da6b9857079e4fdddf79f4c

SHA256
9b7fc0b7dedddc88118afe2ba9e2ca1dea47685de39dbe065243a19374225ed2

SHA512
c8ba68f7ad14234b3012a01df3c9d1806fdb94cb62e128ec02cb4496f48d201e7612df5c0ca9ddd1f5e335cdceeced9bd19070bdba25e1c15b3ee27db913fcc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41ac1bc0554b1acd6464c09ffcd441c5

SHA1
0004fbdc6521a2b23eefda62701da2b8cce426dc

SHA256
33a4ee938ebb8e09957b7350c446fc6455d692ddec825dc3a6f46c41383f7d6b

SHA512
ad1ac075bc502c5609d1ce730cfbc1bc5c550c29a40af380784a59f65ac854aa34ddce8e3c2a356a20aaeb2ee6c79cfdc330b3335da55b979e559f2acf0d4a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0DA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB278.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit