474fd9fe6c656f49d4dcc9c304b4b076de5076e48f73017ab1336d4a727c6186

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/IntegratedOffer-Truste.html
Size

9KB
MD5

5951e0e6dce014feb870dbd45ffd301b
SHA1

f34ef36abf7004a8646e5e7e468ff21cab5730bc
SHA256

38cc5d151c99170fea208df9e9184c67e31486788e44194e01234f98948247e8
SHA512

0a37624751e09cc25f924e622f53f1e32624669045ad20d43f592a660e878f5b8cf42c400371f99ef2dda069152873439db7dbf3ef20881afa08ec241b0a39fd
SSDEEP

96:dsEkV5dynO/34r5kGk1wqJqQ149JOnQlVewEe399xkEEl93s5SzZCBskp:v65InW34kGka874OqnHrxbEl93fMBN

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C9D24D1-413C-11EF-8420-FA57F1690589} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000004e18cdd289aaae121515d9c73558b0ee46d51210e75fbc76b74bb450d1d0871d000000000e8000000002000020000000f7c3f92c7ec1e9a34cf632f87b043b250443c9f9adf58cb0cdbe4eecf77e69d7200000009e68c4c67a71fcfd3e5f9b0a74f2ded02c418283c14f3b2312243629bf8a70924000000053c895d349950878f317ce41e98b4e90e1fa1d9ddb929e0bf471c3d9c0a14f8877e1ed7b36ec8e4eaaf6166e69a1a69a0724000bef74f0bf17233b272adb0ba9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000a3aad8dffbcd126bd8fe057efadd01247de826235eca12490e81703cdc9774e4000000000e80000000020000200000007d73823884b8a731aad6b0bb0a03bee85a8e5c07c0b0f4e1bfb6dcbac41ed9a7900000005918f0b32444cebfe97257458208311f78e24c31dbbc8b451605fbfdc57999a1d532bbc2d39583ccdbbedf457eec32b3b0b27f8436468e001191b67fd3454955802ea1489efea0acc5c59bd898e3e8d0b4ab4a05703a78e351c60a5985f4b9caff95f99d91883a224c6143989ff02475271a0751d3e237370b0848e2cc8ad72c8cfa4b14f49931fbf028366975d0e38b400000006706f2f3260c0316e4316431fd9ffe1e2d050cdbc2cc89909795346b8f1b9a297f1a1d15594bfd16c61923cba0bd4f157eaee376aa1942cd69a1375510ec94e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a6260149d5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427053085"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE
1760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 1760	2556	iexplore.exe	30
PID 2556 wrote to memory of 1760	2556	iexplore.exe	30
PID 2556 wrote to memory of 1760	2556	iexplore.exe	30
PID 2556 wrote to memory of 1760	2556	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IntegratedOffer-Truste.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f99b336d308374fff2808ebfa56fdc2a

SHA1
f2d14afd0b993ef8dde7519fecf64576696036aa

SHA256
2dbd4ec218ae3435d824ee17a1f252c0f690ddb8003664a0a3587c3acf9219da

SHA512
1e621c7758386a89f740e5cf755a71c73d53f5b562c234f02a5a4e182d56349fc84386a8e4a50c87ce7cc178a0bcd338dafde9089050c01b46c2e683ee81cece

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ffa52ff621474f32974172139f84f70b

SHA1
dc6feed6502b3709c83345ded1fd902a80782068

SHA256
18cb6420746ed04e886f2b75dee3a178e80c38db0e5ec32e4321e00bf2c582db

SHA512
2ed0f336b5823e699d19fb245b0ab9a847b3fd3994930fe42f32dca414f9c8be5470c212185e19b9d948ef8a45d42407812f05bf270c94c9da7c5e5d65694c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dc6b8281ca08cc092169cda0340ce5d9

SHA1
835419c2ff66ae37210bef4289cf83492a60c762

SHA256
17ed5869912d1a0236fca69e852d4972fa2887fe043576635b7a8da201026289

SHA512
e3aea73aacb3e1e5d38da97ae118532d826dbeee1865468b1815f6b1c7f4fbebafd6de09efc0edc703c9601b864a0ae7c57aa7fc91a441179d2ef02f4d24d9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4a4c44641138831263cd8a1a225920e1

SHA1
8b85023a7b329ea29eb381782e067d6f0b7d1840

SHA256
1971b41f656c2d3394dc648482371760fcef983a66f5d9d5b8b1006c36f42d64

SHA512
00ddde977056142c4a8a37050c77f752652f5deb224a10b38c6e467c35539347dde96b2bfb761c9d6adb78c92b8fc3a8a616f10b1030a427891f27042725bbda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b66605d40109aa0d11b29ff8f8ee6101

SHA1
2b2ab0eb28207fd776aefcfb16cd16756b398a73

SHA256
22bfd21208f8a17b83a9b5808d32d19e1a03134d7d7656cb3219d9e6f78025e8

SHA512
5a984b7e546dc9cb110a97b9eb943be5a390dc266295592dea2694488bf11f5723dd7cebb4b40ebc7f775ce67ff328e192080a929e9f1df44d9cf4f2d78bb7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
83e77ea0c20c4332721a59293f1a9761

SHA1
5329249034b4def76917b10261966c24bc824bed

SHA256
31e8545e66fdc9466fd25df7fedc3bf09c51e3098bcf6477cf43ef837596e32b

SHA512
7f6f252413bf03da72a167c6584a1720c6853f5eb1d624cf9ec21571f695fa2347dfd2f9cfc3e8a1115dedc5d92e14bbd31fa1185226b5c9314a6bb457b23a9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7b1e505d56afa73a2fe1d76d5782c70b

SHA1
046cb21b40c58cfd9f4adc5db1c0a7b7f1e8be12

SHA256
6e213c4fbe0f991a555471c0c6490cab4ad97e50ba3aadd87de99a97f02dbf7c

SHA512
25b5e39c60ce741d4203efcf44dc73ba6f4d68e529ef91107609046274e76ad58fb9a52f547dbc94344de32aca99ef3c20640ed20aaa7dd36d55b76397b8e00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3124a6a964aa363b5e66f9f8fe72091

SHA1
faa5d8f96204b8a2f3688321080680c204a0e6ba

SHA256
feaa1aa92751692723b0166d7422e658189a31660b13a01ef5a1b0ba5e1f22bb

SHA512
87f12f9cee57b85adec79f77c490d0a8173b95a16f87d167d0dce49462729a05066e60c74f5e7b5d9208802f7c1247b38c38f3dca1e481bb82eff9a20d2d4716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3d28c0b4a5035d51e260f3655efe7aaa

SHA1
7b7b935f0bd8d80c50dd2034326abab3150f2f31

SHA256
82bfa600538d8f7060913bc3f10f94708d6e0ebfb427d6453f3447fcc9c663bd

SHA512
f84bb68814541a4d58fd18492c8fab81f59407ac0f547f8a14d9d57381f7663f8e30f9715aca75a02631a911d96650a330c32690f2e2513bdd139c7a57ff53fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6b13618d648313566ac6645e0a23c3a9

SHA1
0abb73d0264ec8eb93cde2be00300d76756179a0

SHA256
b509622e4b32aa01b07ea5e7f0069f4b7d473e8dfa028549331a48b32ee8273b

SHA512
a5efeb31d5457e21ed4216ab42f554d0fdeb0b0ececb6f3fa91587ec3795d901d091a0c4519695ff1a7a572cdea54cb1d3265dfd93cd5f5ddb859099ce44506d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4ae0f006c6e83200893fa80b99ee3a7c

SHA1
9953d8e8e8e93072a263f5d87c141a24c35a46fa

SHA256
21f4323ed827903041252dc3484e358882928ae30a2cc48100cb69e477a57413

SHA512
c04c97ec90a8db3cc97543755505a0e9fd6add2061983a8118d2836a6784dc9d740bdc93bd83f4bbb1f3cc957f9a0bc8f8bace8308ca40b17de5e54dc50623a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
118439a1da5b72cfa8c2e5d1272d7c49

SHA1
f3f2630addd872670984c09b4d4c1e965b6068ca

SHA256
b9d5e431589bbf27ac4658a824b865f9c339ae7f3ab4531dc54972db3cef116e

SHA512
2f8447eff84849bd75783f3b49d8cebd8a9e66529172f2d0f254915c17f8096be8e914026de1874b33f183c59dc0bbb4a40f25bf6bdb8763935f56bddf5606f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c19ca9ebe25473b6d1950606b320d10d

SHA1
82e2b9f2e7eb74fe67227eadd9a28e9ba27a6d38

SHA256
5171472ac480a7aa623e74e5998648f4cf83895d69983a0617d08dde5ca151d8

SHA512
6fc1b3154c6f48d9ff29c00f0c6f139929065ab3e54524ccddb66a0899bb9bfe882cd2941b0740e11e8916807a452fc915e094bcf840a9cce3936adda6ad92aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0b5e8f51390f3309903a67dd7c9dea9a

SHA1
60d9d5d54e7cb87902411c9737744c69c8d1ffca

SHA256
d8db8881a58140460e7c32b83c36ef601987124568b12a2705f51de9653b2972

SHA512
65cdce3aa249de84387c8b2074f449fe02194238e968fe4d3fd8235ee6c74b6110816a9f6e671633f0d5ee16faa803c6a78f792c2732ebc215ccabc0de6532f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b3da4496aa6c4e166f9b9937aa75aaa5

SHA1
b876a0d9705d049dd684c65f7e058d0780981a04

SHA256
2019ef2956709e3ff85000408e5f6618546f48509d42dedf8b1026be368e364c

SHA512
c23e587548e703de4d20468484f42d0fac699a0d80938269aa0421c01cb2b8cc685a7d3bba88a17619957d807a17c78c5e4b99e1c32f869773133a5b6b0383d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1986e5ec4d9967ee93e60f72e5932837

SHA1
4472c96a761681777220115d79cefe2a1963c246

SHA256
94cac2e7188e5e487777124c293967d2e45398211b29cb209fa4ef6625c67a63

SHA512
98f884132e5684dadccb66dd3b217e4e42c6af8d3acd0baf0910236daa26dff5d9d5de1a53f1adffde0b2fd850a09c2d1e42c0a0a0166dbc2e8411ddbdd629ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cb93b59934faba3e10df2a7eeeeba257

SHA1
f4d4a03458f01ffb9b383d5a2607584b299a1f2d

SHA256
31dd75296a4fd55d19bb7b10b3451c8709a90e4b7dec262f0554752722323d3c

SHA512
62487610caba3daea02a929f72fb18f717f6ae16f783edd4f6846c351491c879f4f288a4e8f056492632f018f4465c91002dbc96f9b258effdcdd9fee896c1f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC1AD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC24C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit