875d810edf34d3015dcfea1676cbc0a4b5dd37a8fe0254742436f4319f632a1a

Analysis

max time kernel
139s
max time network
129s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

jpflash10/admin/admin.html
Size

395B
MD5

d232837e7a90a3bc7219162a421eb249
SHA1

af125ea7bcbcef5e779c4ad11d61b85b70e1adf3
SHA256

ba379613dd1eef973ab2ecc831823fa1f263b2742d69b4fa8c3eea64ff25da64
SHA512

5fc6ff40daebe8a1cb2e6ab37441085ceb6f84a57fb062cc2e3f3f3ccd0cdc0766666b47cd811def5f071f1591848352e77e4521bd19b3bc2d41b470676427c0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425013056"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CA22C71-2EAE-11EF-B6D8-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE
1332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1332	2232	iexplore.exe	28
PID 2232 wrote to memory of 1332	2232	iexplore.exe	28
PID 2232 wrote to memory of 1332	2232	iexplore.exe	28
PID 2232 wrote to memory of 1332	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jpflash10\admin\admin.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
68d48e33a22d1772b3264c51dac7c0f5

SHA1
c2bbe9fe0ad35fab8b3216ea801d77b5b03b3122

SHA256
de3f6448d7720996563f3f05f7e622490e524b55e7d5dceb6b162f2df3980c0b

SHA512
70adb9d405ef1b322122be62e6d06cb6662a07b1013eec6a39b373e9bf13a86dd32acf496ffe8cad4a3cda7906b69bee2051ba54d66defc2c04082fbf9ffd495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f0c63648c96bf62573edef9712d71ee

SHA1
3fcbd91fa961fc17556e6cb55c8cbfbb24c08660

SHA256
85571083f9fb0b558a72845cc6d9b3a883b09b328650c4cdc38a3ed87ba3c4eb

SHA512
7ed70d215c0179fbf0f91f6caf02f5c0eea6da01e138ed664733af3e96e3252f47dd01b8be1ccc2035848e91382b6f98f74e3b91176eef6eb15bda395e6fe791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa17cafa9182dd16973d2b7bac59c81

SHA1
15cbc9ea4abc5dbf8f9b961a25ee3b2ed77f99ff

SHA256
51281cceae33cd0be5627275d52c4caac1fe268455bb7de3cf15acc04262e05e

SHA512
1cf830707e8f9e22aae967b4a01dc54927f63862704315ac9ee00beab16432b0426694be06e59097773c3615d098e2fdbbf8de3ccd55e605ac2bf51cb9652219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90640cb784fa6fabf2429ce09639cf1f

SHA1
0e1285ac90a8beb53310f1e7924676b85580b22d

SHA256
4ee77d6d6e503f3b67e62ee6d18a76c793bdb95bd51815eb268ebb422ad4e458

SHA512
9b9c790236275a395e1b1e93e9d294dd18c6ca0b32b87fb456f48033b4b88b44debb58d58d68cc9cac9a830a3b06575b87f028d13cdd9605732072e22984e79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdc18eff2a32071322dbd5ecea687552

SHA1
45af1658a01104daa5f797532a7ef80838c406a6

SHA256
7e594a69b13c04d755093faa53951a040ae438f382f4db09398bfaed80246912

SHA512
0b7d5a907759615d4cf3a4f364ebfe50793013da5a7284c73bebd86f71e63cecd37bb39489f448477f5908fe7f79de13d1f19aea87d2519c1f5f1c406afa5cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115c36c80ed7e56ed13e1f1f261c5abe

SHA1
b8d1f83604ab8ba6ee360ac9ab21647627ea89a6

SHA256
337e6f4b6fa7d900a70fe6b978b4c2f482168cd633225e38de52ad0cfcc12ee0

SHA512
bcf730690e942e3dcc04a9c8dc7f9f488e249b5df8e1e4006e017f1ab06ea9ddf129074dc63a66ae0fc2f51f96f569dba950f7ef881c7df9d5845cc83c345779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5017cd50c92978a56b17b30db4ab9b16

SHA1
bdffe159d69dde97d9d310ac9b416b6f12648942

SHA256
5cc3955def4e6360b49ccd03192015ad81b0b6c82cf3c93d3b1b8d8cd3b27dd3

SHA512
fc14b34818d0c149e3c674e322caf3f981a9432d54c130af7340c5705713ed5825855bedd9944bf81b5c6c94eec97b77b967814faa6dc996b5883149e461333a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17bc7c91571f5d185083baaff80231b6

SHA1
16075c28c0abdfefab54fe611f87ffcf0d7dece3

SHA256
ba4193e1efca1127f1f5425377f0e2aef179496b380f46357feb07264dcb32b9

SHA512
fa8be6f5d2cd5239a14393ee479d106f26f89e19e19f1f6ae3fafef33e45000f039843481d907af9f72263573911fa00dd16c09c97858264f5d7653585f58434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c99ac267936218ec8861ec4596334f30

SHA1
e076d00bc799375660835dafa70828248ce2a92f

SHA256
a87590a42cbe2f3c67f08b46f822b8d13a119b48da98e04c79d4df2102c02334

SHA512
88fd09281394939fbcd8368807f7e8c4791430e4503b45bbee423cfc85cc830776616782c289cdedc5205f21d09378d1ebcfff87af7f206436421a5ee12debeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a40f5210a90d73979d85562d6e76977

SHA1
53eaa456927fd69c39bae12093cdad8e45c3376e

SHA256
d6566aafef3022837599d983b2f28f98952c07ac45067fe31a5a6ef8c8530544

SHA512
7ebf60706a101ef0ea40ed5010d9cd6339bd89c16ddce549b4eb7fa737c7e555aa23f41abbe2d91e7405dcc2d8e90851bb516847c3dee836c8267dbec89ebfac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
236b67f1ffd936a66201066d3ceeec21

SHA1
088857a93892b504b4da5326504cf0889732858d

SHA256
d0d4869bc206b0f12650f6b77abdf10adeaa2a60cc693e3ca587c6c711e68468

SHA512
10546a5a5fe3cf8157b054985c88bc2a5b59601fc3d1b8f12191b3ea5263394b77d436c4bdb8d3be23b63f27db3b9181b19268e8cf5e7649404e7500333e82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
667d5117d5ae26dfdbb0f22858a637ec

SHA1
bec175db6ea006c47219f49662aefb965f9e2c98

SHA256
143abdc2ba3691c924510fdf003110e14d351dab9b1e94c9ab07132285dc137d

SHA512
6885985631e50066c54ca757ffefbe77f124264c3e7520db46119f872e28432d985cd5f2a9c65b9c56c4fdf314259b6727ef20b2f5b1cc47b73433dd32652d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b3f6dae608d45b9fb7df3dcd8bf6310

SHA1
3c041409b27a2775b5dec15dc177302024b6ec73

SHA256
931e5864f59e81381cebb9baad51cef2ea8237a9b7a057b5ff208c80cb97e01e

SHA512
bed551996eca252e69c05ddab34ca6b4b5f39c4ce478649a500f27836190c2c0249474e2bfcb1bf28136a57ec75986f4311bb88329c68efdb315fb8b4ff531f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G17BROQF\sj[1].js

Filesize
14KB

MD5
36bb39baf409262c96707d8369a862fd

SHA1
650a3fa143a5ddd5914e6580928d68b7a9d199f7

SHA256
98d96930369784a03b4d35005e144739ba9fe1becaf47bffac0ccaa31d9c2d72

SHA512
e4f37abcc3cc818337c5bebaaaff261f5b1991410c03bc7c8d8f8c6912223e318c8043b349dfec4bd5a7b124e03001b6d1c7118f847c4096a9499af58437e6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\jquery.min[1].js

Filesize
737B

MD5
6123cfcace33138a14e6cbeac7379b37

SHA1
320478b567625e2f7b58544028aec7746c20a357

SHA256
406152780ea0c6da24766f3e632e3f7934577b2633891fd20d84b68e07d2366d

SHA512
4acf9f9c9018c6801067558463e488b94e40cbd65a06a52b3caefd41f53660786b475b24b55452fb1941f593b88d377f0d3ee212c756f23b74e6004236d6bbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab229F.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2352.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit