Overview
overview
7Static
static
7virtualdub...up.exe
windows7-x64
1virtualdub...up.exe
windows10-2004-x64
1virtualdub...er.dll
windows7-x64
7virtualdub...er.dll
windows10-2004-x64
7virtualdub...rt.dll
windows7-x64
3virtualdub...rt.dll
windows10-2004-x64
3virtualdub...er.dll
windows7-x64
1virtualdub...er.dll
windows10-2004-x64
1virtualdub...er.dll
windows7-x64
7virtualdub...er.dll
windows10-2004-x64
7audio-filters.html
windows7-x64
1audio-filters.html
windows10-2004-x64
1capwarn.html
windows7-x64
1capwarn.html
windows10-2004-x64
1crash.html
windows7-x64
1crash.html
windows10-2004-x64
1d-audiocom...n.html
windows7-x64
1d-audiocom...n.html
windows10-2004-x64
1d-audiocon...n.html
windows7-x64
1d-audiocon...n.html
windows10-2004-x64
1d-audiofilters.html
windows7-x64
1d-audiofilters.html
windows10-2004-x64
1d-audioint...g.html
windows7-x64
1d-audioint...g.html
windows10-2004-x64
1d-audiovolume.html
windows7-x64
1d-audiovolume.html
windows10-2004-x64
1d-capturep...s.html
windows7-x64
1d-capturep...s.html
windows10-2004-x64
1d-captures...s.html
windows7-x64
1d-captures...s.html
windows10-2004-x64
1d-capturevumeter.html
windows7-x64
1d-capturevumeter.html
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 01:05
Behavioral task
behavioral1
Sample
virtualdubmod/AuxSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
virtualdubmod/AuxSetup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
virtualdubmod/AviSynthLexer.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
virtualdubmod/AviSynthLexer.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
virtualdubmod/PlugIns/Smart.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
virtualdubmod/PlugIns/Smart.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
virtualdubmod/PlugIns/Subtitler.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
virtualdubmod/PlugIns/Subtitler.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
virtualdubmod/SciLexer.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
virtualdubmod/SciLexer.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
audio-filters.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
audio-filters.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
capwarn.html
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
capwarn.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
crash.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
crash.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
d-audiocompression.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
d-audiocompression.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
d-audioconversion.html
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
d-audioconversion.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
d-audiofilters.html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
d-audiofilters.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
d-audiointerleaving.html
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
d-audiointerleaving.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
d-audiovolume.html
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
d-audiovolume.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
d-capturepreferences.html
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
d-capturepreferences.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
d-capturesettings.html
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
d-capturesettings.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
d-capturevumeter.html
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
d-capturevumeter.html
Resource
win10v2004-20240426-en
General
-
Target
d-audiocompression.html
-
Size
5KB
-
MD5
42fc7f1f3036a7815ef8d8fa845055a3
-
SHA1
85dc45d8ddf3a6d12bd20d0786a9072d5cb479ab
-
SHA256
163a954379462d8b11e3a74f3bbd1613aff2167eee6fde7c916f5dfd02683f42
-
SHA512
341de116d00e3b21e260881cc28ebcfd913c573a633472772997689b09c8859a7fe5b11ddd608a105ab8c61a58287c2ff8515b232cd49d1c5da67a9104616eb6
-
SSDEEP
96:WMQfVsRapCot2f5+r9j14F6mXJNFrhwy6JcQN9j14PLRMlSel9j14jHl9j1485G5:WHfia0ajCNxhyJcQjCTRUjCPjC8G5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423452244" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019e53adfa1b9504bb1feab5fe6eba1d900000000020000000000106600000001000020000000025dbf50472c4546f5f02218820f454941187535a47817ccb8dd7919e5366695000000000e80000000020000200000008d7d1a229ad9d7294fabe1bcdf698c93dd0a493a8dfcf5fc6e8e02613bc597b620000000b3777a17cac1874114b9c3ae5ac028bfa0683bba2246f12860c9f9e6cd1e54ff4000000079a8941ab1be9a1bc9ab5e10db0606bce8d0e5aaca2a7476807a98c526f1bbd48071b0f3499dfcb7dee8ae7a45bac8d61038ed5aaded942fcca58eca98dfedbd iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42FBB381-207C-11EF-9340-6EAD7206CC74} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000019e53adfa1b9504bb1feab5fe6eba1d9000000000200000000001066000000010000200000009c46347c22f90a50e0a1c62e061c1c19e2cf3bc26a6e84c7a0c162635e677255000000000e80000000020000200000008f71fd97a839d1076a308b9aacf12c9ed5c3266b64d2d084a0979316857c3d62900000008540fcf536eaced0cb4f174e7c494da7803d878004f11278f84d8c84b63cb38dd19fc07db399bba8d8544a28f668c8ecb48e59ceb492bc0e71e33537af29c27993bd9de1fd39dfc41acf7ed8957191ef7af29448b7f303f3165d6947e79c0bd7ceb2c9f161212759b2a4b276350f3338d865c256c19da8c7603d88b0cae7609b8b2478f6e617bfeae4332f7e5f9e6aba40000000ee89fb1d4f42f5eb2066be6d556f5294abbd9cfad630b90ecb58e7f47698283340cbbd936a22128d90401335271a46e73c5cfda62804f1fb5b550f9e8817c0fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10927c1789b4da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2880 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2880 iexplore.exe 2880 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3056 2880 iexplore.exe 28 PID 2880 wrote to memory of 3056 2880 iexplore.exe 28 PID 2880 wrote to memory of 3056 2880 iexplore.exe 28 PID 2880 wrote to memory of 3056 2880 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d-audiocompression.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ae7baa79f85dda9e1757b85fc2a32298
SHA1060a99b21a5cb1ca78d598da05230d110861086e
SHA2560ea878ae14a5ef11608c46e78a74f6350b937b07a5c30da7c1465a69888f1e1e
SHA5123141fb555d25d7d42fe4d26d65d4af167e40c83c474f8b78b2ccc555fe4eb6b32f07f60d223d1b7a50b79f39e0bc55ffa1b1f772f008045476623fc0a2b0c7c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5572235ee7ad75d9ebfa848c3ab7dfd4b
SHA140f016a0079ca7fb3ccbf8ae476070bae67507b3
SHA25691c0a9132317b6a060d39a1c2b3be503249550de1d5610c73d665f324939cb5a
SHA512ac5419974ab8fc8f6b1d829fd147560b992c3c565e2a99cf6f6a60d0a3b0994f15a6ae20f6860819395ea9d1051ac3bb6ca48aab16334c211824a6558f66325b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53207d70a3cff00a4da80403153b2eb98
SHA15185386eeb3fb91911cee07b7a0dcff79470ae39
SHA2567009efca82d5640f5b430b0034b8a189535260af141f01375c36233c9b799bdb
SHA512ddd1d4096801daec2fde605df9ed7d411bdc3bd7f8f8b59c54b54af5d0906ee979a7b5a81a0e58f9829747ca95cf380c76fbd54596857e8e99ded4eaebc72495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594b43a1a7532bfaffe5a013e65b1e4c3
SHA1e231c039781b57ee2b8620248b119b3349b94009
SHA256dc0bdcfe16e5188d209ef8b6f0eb3d6360a84574787886d1e5f475ae1862834e
SHA51247da6283e4395808404ef611d7af7eea8baf55af639da37e3bdf19e2c920ad6bb3088e0675616ef35323b003bbfaa235cbb51c5c10060642a627f47329734c87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a70cc076000f0b5315321abda1919ec5
SHA142491c66f51ba290bec00bf5061d1ef82b6d86a9
SHA25667ead3ced04bad72ec08b10d49620fbf55b50e1563b1210599ea1d4f6abede32
SHA512ab9b5c50a5f895f18d5b44229a83764e021469741f86bee9f26833862b53147771290d7b3f26ee706c254607d12418c262a59bedf84eaf41948619a4a249822b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9a1d91cc2999e8cf74f1cb8c6404424
SHA1cfcbe6b804342b1de9f1b9ece47efed13bfd41ad
SHA2560f74319c2eed02ced630378202760a8cb1add96d0e9e3adf39073802b26c157b
SHA5124799704fb6998ae3f17e4950670b63942272174154e8f7e1fb8da19df4ae649ce0bd91e87faba588a9097d8b6d6678fa6158f724d9221ea54ccbb53aa0994f15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c09f653e5ee775b72de9afbb45a0fb12
SHA1fa35b8e385c9ee3cb08a2d389e9b780cb6feb7ae
SHA25607fe53ea8ea8986b1a443eed68d96764f7b9e21bdd6297d4f8e438e2312defc1
SHA5126162e66672ccdc7fef0577aa9796668f784f726ef081eef3dde3403e5bf09214698459860f11c9fe526eb6dcc203d98797b11ee7ccac9036df81179e61434dc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55991b3adfcde7a5329738ae1c51e306b
SHA19de1b9f376ca9f980b4ade491f3f33a33b102930
SHA256c0bff63f79e34a8f61be40cd5d1a956e5c89074b52f39bf5530c66bcbb26e42c
SHA512889950ce81e858798fe03253239ea8a26dd906144bdd8ae8102690811b01234c6a101175e975ae221ad267a69a29f46e14dfc91fd90d2e00e815b5a561cdee95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524bbd4d076a2a4318b931e9de95620d9
SHA12f703ccb9ed5a066569518b26d9b02b8777023df
SHA2566abf81ea6e71ea5226ed0e0ec5f08a4a2db5cdf15ad838c10f1f27673c2998fa
SHA5126ae9a9094b4ac7563091cc92d4928ed62fee9b308d53e20761e7dada15cd4ccb36c845a82ad6d3b6946694eb31a5970a9e1b84ea76caf640a405be1fcaa9e557
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b