66a8fef778ceb09b6dbc394708b9c16392b445a972c4166c514a54e0cfbfb798

Analysis

max time kernel
139s
max time network
139s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sitepub_beta_1.0/admin/tpl_zh_cn_UTF-8/article.dlist.html
Size

5KB
MD5

9de667d039115e0a4c9330c93f88721c
SHA1

9d77229f537f7499f526b37ce8e1fcccf2191b90
SHA256

7d55e67dbee83c8ded2f7b4d2dd3adfb1b122b06a5283fed6cadac71c9b8d3e8
SHA512

054c6780ea6f1c54ee3ca0d33ecaa5a624e8237f6053d5098aa4bb0a1f44417979ffadd7e79b50ee9964cb30c6fbcde57f4d144278a3ec8d7985bbacf383d727
SSDEEP

96:xsOXoOBjkmU041mddmi/bcU6njmYzgLiWli/PqXPshoV22tCocoQ:eOX1umt418bHkQ4CkuV2KCWQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000083a894d53ab01636aa8b955f45865bf2366d70e84a0d093e73322ce7d0e967c0000000000e8000000002000020000000fe1fcfcbec1747c1f36be52d5a98230aecc7d55e630794abd0f20074b2106f4b9000000014bddef6c4bd005793edb45084470c3d2ec34644fd7acb1085728907047494b56fe1c7517dc775f8433584de106f7fc5ee95cc81655006c49eed6d78b2ec0ec2afe0904a141b036bddbb2a37ce966090fdce23269412364d3cc601ca528255198413f85b252a5f76906b84e69ca89b3e18386aa3978d41111d8fa5f361c0b9c521837f851cc309a655631e4274b7362f400000000affc9b58e07fba7a6ded11ae5d81b6aba3143aa5854a645f7ad74de550cb93ae441d203be645c733e1e8fed425959abbb304fd3cef4469e9c1b34d36d25701b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0846d3ac6c2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000027e0a1fa57c7926a1266fd831babde349ffa797dccceebef7c8df50edf7d633000000000e80000000020000200000006de22b44c611b72eaed3458be6a4f80dabec56963ddaaa19b6841ab5152a5f8020000000e0d6ab03fe94291438c93d9e65110444d313c78832791b96a81c5013fa3a572c4000000085b7324ae3ca7c81233872684849e7d20e8f35c7c7397ed04f2ce37fe9b4a11e94fdbf00c9a043b8289ec1bd0581ba020e1f546fa7aec07664e8549bb7d6d527	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425017793"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6353B381-2EB9-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2908	1672	iexplore.exe	28
PID 1672 wrote to memory of 2908	1672	iexplore.exe	28
PID 1672 wrote to memory of 2908	1672	iexplore.exe	28
PID 1672 wrote to memory of 2908	1672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sitepub_beta_1.0\admin\tpl_zh_cn_UTF-8\article.dlist.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ffc8c5cc5a33590c6a4025afd7633cc

SHA1
57b9990bba90ec69d719c70aa2a3f41abbc76d26

SHA256
1ea7cd3f294e5ab3234ed3921f93e77518b5aece25e1e555d1111207de5c98be

SHA512
80a24b00f67fd6e1ab92bfe36bddf9e6a0b5819fd27dfd8c1b74ab627b585a935d3e8bb8cf01451d01daace0f5c677c8b4074c350a9b5c5555087891f4ebb6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
424ea13c91d11dc33fcf82fe75677fe4

SHA1
f545c1266986e24a4a8121d1d4b6ab73f7d91c54

SHA256
7178b47166c1b5e37600b11add31de62dc2bb146c93e6f9fb8498302c80f4430

SHA512
8ea1c0e1228278a8a0f0381212f850fed9490572dcd97f5e73d54ed0a72651354155f628891026cac7ac3ca73848cf35b6350d39966db3392575b17aa20c0261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c5a480ce16e1cb16b59a42d4a1ba371

SHA1
6a909947e23c33539aabb6a428abb5e41f5fb570

SHA256
adf49f2a6c66fd9a048e40f5bd4a088bd70c5203ca587f1f7c4af5c2ade137dc

SHA512
6ca0a1c71a7e3cb48626b89ec2bb5cb2da6177368a5803907a1c25d2785014b6aaa24aa5d6b516214d8e80d9262ebf52a0fff1f77b2643ea1b9947f5e71f80a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2bfbe9c5c139f95097e112274197fb9

SHA1
9f8de115d94f96cf7e94cae07cac465f1131abc5

SHA256
773fad5545f570f857c4694b87691fec3c23c88291b6f736491a188abeb29c13

SHA512
0395e9040de7b9b0092bf4800fca0b2b69832d261a01a179b50de17e005e2b36a02213eba8df8c63c06e946be47567510ae0a99520c7465a5197c2872f75206f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4059de4cb3628bb3df8d55d74a2e2b7

SHA1
6096bf8209a228d3f5892b094276bc579dab241a

SHA256
bea54a9fed2a416ddec9e3d09dc485cd475c63da04eb839b6d7d5035981cc679

SHA512
e911ebfdf9c3ddeba4ea0825e95f71da5a6d98e8078c17d8e95fcf6782c7ba2ca85870c925b3f7fd92371641090ada585b0fc1bdce56a740f5ef588202d68c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e75f5cbdfe92e89ed293ec53d2365767

SHA1
39015688ec09c2d4f54c0b5d104b4d0609ca459f

SHA256
b5df758e20d3a7d92ba712daa8eb300f985b5f888c321db6a198aa0f76ee9bd3

SHA512
a9da152da5bddb76d93d4be45b754ef1a67844a2be5a46fd36fd720188365efeee4fc0c3a6801910dce7e44d43d6924a7727e0a2b34ae47ec7322b125d784975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66c7de7d641c386925e146c991a37643

SHA1
2d006e961e00ee36d641e6fa4b3bee29a51b0c99

SHA256
39df0e2d8ab83e52dc5d49477961d6cb66338bd06d91c2ef883c420422e9b7d7

SHA512
f4e56f6676ae41a1deb377ce9d5dbe6ddde77305c4147a971e8595b3a9fb2ff68a7c5bb2c3db0bba4bd035adfe74315c637f8d6131da37b96f4d7315b43fa8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffad90fb229a630036d6b5b58d839034

SHA1
d876a58b86203964693ef18003e639ad5426fada

SHA256
f958de50b1bf11c9bf0fd370852908cab54dea6edfd8fefb52b9880fc0ea9976

SHA512
d4107d9b11e49307f40d036f5e25856e1b556a67d63ef6daff210a71fce685897844bc96fa52d76b70462f6897adf438e9da5b19ec8775d991cc60414e1ce17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9144167831d0fca38d71079e014548a

SHA1
ad78e4e9716f965e24d1bcfe01ab75d0016a09fe

SHA256
4f8fb853f4b5f041beec133b4b2bd890f612f327dd5bc6084c04c8ea1b571516

SHA512
37a30d49356ffa5de57fa2419765a89ec7241a166bf042a5d90015c7aed2a4a5cb197fce631a2e0d5171b4b21bac46526e22284e9182b8604e0f717a708f8096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09685520cf5d37be4a35a58a4e45e1d7

SHA1
8c20f041a8238ab75a17af74783900fbafadd385

SHA256
642096a945a8381320562333a067dc1568c150d26b91b53e5e26ce263e047b3e

SHA512
246a508a7a0b788f2c480d4e0060c5c0b8f9ed4705a1a8d6bc4a424a8261384b74b461a953bce4bacb06e81fbfc4eb67fdcd7da4d896eb115ff27f90020a6fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86917b4fd3e2ccd68d7addde65cd8bc6

SHA1
d48a38bb5887a85c5f7ccf63d31e66022682916e

SHA256
68bd09ac54dfab6d0d347537a0ef0563633ec3a2692022e08ff4c9b483257026

SHA512
b7ccfe91003b8b731e9b13ade2739bb87faf10a19a0358e833f6c196b55310618019237eaaf477390935bfb25b39ed58efa4b9d346cc22936b722270bace3ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c9e86567fa436564600eeabad47a742

SHA1
1548bd693002766e2955eebac4ddecd9bc0a6cf2

SHA256
20fe911fc2719e15da3666d82ba9885e9c6b6dec6ec88fb976310e348aae1d40

SHA512
3ca20eefd9c0104f4f033389c55aa6de257308f983e826556c1f4d0dadda512afed871a727d6be5c4202e5c6458330b010927967ad79f81c666a24bad0bf8bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a859f47551391b6e1aa2fda7524a3d4

SHA1
b61888bdfd9555f7de70a50c33ce13bf11544f7f

SHA256
7e55ecb208186016aa3899bb0016752d07b98a20599b5b71511dd713ac9d160a

SHA512
f5356f12a5e1f1f9efe66435c2eff73f5a833ed8077614e83e7db4ecbe846c9e3357dbecd519a0db5e8582ea5f3f080d2358fa4ad06eb480b17f89c1cb36b8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b92b36a9cee396bfacffe3d8bd3e60c0

SHA1
b2f2810be19f7e93d11e24d84c8d828e853c68c5

SHA256
f6f20b572dd5a52683c348178a510178aeca2d9cc9a9c40dbcf2e75702e25a80

SHA512
71b0f535c85c3e5aa18744fde40ada0771613cc76aa11cae22050afa4e479752c226df1654ef6046aee0063189b29a2f4f382dd9bf37f30a271a86d6dea46b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4e22d9b41d49cafb745c8360a278af

SHA1
bf14d75715f7e7a12071ba59c70bb6451f19d041

SHA256
bd801786b070c2944232765fecec3d283ede001da7240a1b4b41a407a8838ef8

SHA512
aa9c7e5708947e20a3f240245ccebf566ffc89c1c12006a14507f65c640198e0c3be269b31f1ea39b163cf2d97a3781de959d09061ddf05b5802efd472c5be71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92ee3541e86a376e98e0ec628f0fb507

SHA1
2d961bf0f6c2ecdb94e9da16d66ac9aee9aed58e

SHA256
83f0f3007f18ceb3c821124b3661ea176c44288ee109be4dfc28e5e3a0d48dfd

SHA512
785ec97f0053fccf4f97de19584330d0452290a4b48304ff1b14f3531ae318d38d305bbbca66d091db6f0706a54db08cb2d98fa073b4f93e13b32e06e7b33622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db0b3dfc67d8544cc5e5db47371c18f3

SHA1
292afd05e6e9df6b27d6bf1cd145e676e2a361cb

SHA256
29d2fa269427bf523ca8d4f148b51a49e6ae38d6634a6eecf066c3a9609f696d

SHA512
7f0f592691cb7f7ea8e8e13e0afbcf84b032f63763de5031e20d535634e6d0ef087c16f553cea4fd7094e8214e406910ae48efb111389882e2832802b9d3a193

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab98A8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99F5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit