c9b922bf0972ecf680289aae5071ae6c5d03e1c0b2402cd21464ca82b67ca870

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Joomla_1.7.2-Stable-Full_Package/administrator/components/com_admin/sql/updates/mysql/index.html
Size

31B
MD5

8ca096fda23d564fe62bc65ef5f498e0
SHA1

166b05dab71422b4ce7c55ba3ad66492a8cd8a18
SHA256

b1f5b9c329d8f4c9bb9d4b2dc820419b8a277e2886af023777a399c9ec187a2c
SHA512

4a5b3cd40f4e5ca3637a286ae2884755315897adc9afcd4dda2e49d6a102b10503fca48d851e4fce25b753e932382991d91a1ad2f4d0ed1ab932b99d61f41cef

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10B4F4E1-46F1-11EF-AF94-46A49AEEEEC8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40a53ee5fddada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427680533"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000008c9576001278ac89f393a4f09374481a18ae38b35b159649c850a51c4ad12e05000000000e8000000002000020000000765c72f021714c1be3053a9f76182160d5717afc0664dd9a18869fc5497ff5692000000064b806eebabe49c577bafd5a7999a8e6b8141ca9761ee31a5dbcbb55b08c68b44000000018817f6d6367d08d8a7f26f44011a23f314d49da24de7743067e6c8ecb67908b73bf80a91d3826c11dfbf19adcf39746bb1b364f63b204910fc22484a0fb562c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000553fe2351f8fc74e27b2b74f1ac8961463c972e287ee6f0b22a9aaaa849a3ebb000000000e800000000200002000000093ce8605de3087389dbea51e90c61972bea34434fc813aa950f0f25803b295da90000000982e5c9aaff920f517ae10ab69b71bbdd8eb268ae3c6b97cbc7cf60c43746fb0944978c8c5512921a458869981d780df02f54044442a719c46578f801de8aa3fd46a4980411c9893e3c295a04a1e144d1bc15593aaf6a8b26692c5bdf7a5496a8cf69d15fbb9e5cb5990248d90c0c9369baa60eed3810f73c46025fbd7350f15bc3a9aebd3a3ae419fef007e135c25cb40000000954ecd679cddc492bc7f179e4043c5be0ca337e1e35ebf11c6362c8a1e8e8cfbee1cb42e39c89aad8cbb6022f17f1bea3419d94c002b2b2afdf5b7b4d0596661	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1344	2064	iexplore.exe	31
PID 2064 wrote to memory of 1344	2064	iexplore.exe	31
PID 2064 wrote to memory of 1344	2064	iexplore.exe	31
PID 2064 wrote to memory of 1344	2064	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Joomla_1.7.2-Stable-Full_Package\administrator\components\com_admin\sql\updates\mysql\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bec0927419d09b069b3674dad106b19

SHA1
927a6e3036c77b5faf10352c77cb0374e2f663bc

SHA256
4d11810331d0c529af7e8adb6b70932ceacd56e427a387aad1e68663b7c393ff

SHA512
716c4d008759d6cfb02e8dc92589c786c930d17b7d510da3b30c1f64d1fcf5b5bc6d5cffdfddae3b4eb005eb28b5cf76eced1eeff1c102b7b5d519557693befa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d423461893af499100252b3dfc1ed876

SHA1
485279dbfd71d4c89c937ff9839a52e54d40b2da

SHA256
a67811f771addf6cc9b6b8392e154b63eff5ff1f049a6dc1fe4781249fc48b90

SHA512
155591efc80482989fc95fb69cc53185b3b491fb54b676f8a8e1bf86ef5ec32876e53ad428d6b68f87fa2bf70ca6d52f589800619f9b4339736663b10c48faa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04e8a9278e941f9d8c987622fbeeb2e6

SHA1
8821cebdf6fe409082fa3438c160ce16d662edff

SHA256
c69475c325c7fac62b650d58f49a2cf00f57cae1964c466a20e5840f0aa326af

SHA512
ca2ebf20d6296551de5548816444f41a60c36131ed3a4a6570cc719218b4fff0e81eb662d8392149e2faee37e9367ee65d5188e571226948d9262bc5e984ee3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a7ab798be109fc40a37fa268d08bccd

SHA1
4a98abe96c5225e13df037efb4d6de77f97d2569

SHA256
20be0b30d1706762d714b3926eb8f6fa43da29c9ade905afea36918334829169

SHA512
5bbc92a1f08e84d3031d0687727e41c579b57dbaa1d16ebcb1f3af322cdbf981875b5f73e404bc4e7e7abcf6e0f037f3f6bcfdcc771c61ccef31467304e7ed6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31ebcf2d6dbac4114719bc72db9db1d

SHA1
aacebec1a8d6c86735ee140939fc3e34a034a998

SHA256
f9997513146d1b51e9a69a1ee5af78cf70b19146d30f90df0c1406c8a7f05c4f

SHA512
7f9d35646760a8a43728bb87df36153147c136f9ac17fffbee0a78dd94e9acc280381b912a6097a2b79081356091ea11f582cc5cf6349386c05006e9caac8f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc4888a694f12f45e3cd654f4d2ae69b

SHA1
c7a84c127123a00d21163dad4e4b0da45c88808a

SHA256
1a3613c278b4aa4ba073ebd82df169e135138759ca24aa438963e39ad6bf2d70

SHA512
a360da52b60c6b739f6a540a666ef0845bac639c6effe9e6107f9574d6975f47c5398cb9129d66ecd94a2978d5a7109094614b05008009ffd96e29143fd1e3d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05ad26f38f336440c31ae3c68432ce87

SHA1
9894e3d136a668844227502b540d2ca6bd9bb69e

SHA256
a7bc72008b3bc4edd0fd32411a876a9915a0ef5b816be32aeabfe5d1a7c30a29

SHA512
d629c9056a2153c2213aea38c99ac92f9dd2c25c015ac0799e3df3076a79c5d7a5af89b1372d244fd0b3a6ea46e8a9944d806fa8e09ec27107dd85688adb33ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aae9796e37126103f4d0c2f8b8288dd3

SHA1
36ceb2c6f024154d91a9bf8242f7dcd48e64bc73

SHA256
061d8f0f0c7f3a4308bfc2944fcb527084bb47e108e7dfe7a83e4e8f7e096456

SHA512
b030e218ab02b4c2032eaeeb5707ec6714108668f6c9ca3236ac90fa7cd5f4ad9c521a13ddd21ed1b9d1b144b413fdd8fc98b9b70cf217b86440d534df0ef6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
103707488370ade25702a34b9b600970

SHA1
ebfb70ad2644bd2ef0834c13cb1ab9cd3e95e54d

SHA256
434b37113759a3d8b6f2122760fcb85570819fa4cbd6ee9df927e8fbca13e664

SHA512
5beada88d1101b25e81189f913b6935294a59eeb560cc502efd5e0bbeec9bcdd359bccdf125b0802090ae044bf5ace5d12f4bcecdbc678709580d25d7646d9ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
310a9fd8a61cb589d84766cdb41edfc4

SHA1
b4ef13e47c50b5dbaaacec27cf1da6becfe913a7

SHA256
b82714b0907d5622af063b4dd5d2b2175b1ed498b40dd6df138e237efb51ed6a

SHA512
795274fb6c017d3868f2f36e4a84f8491723531985344d35d50f33fb7933b2a202f15df52a16f4bb0823a713721a166bc82d77f18759bdfdba562fba924a5f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1092e38a66dbfaade9673d6d0314cf20

SHA1
002f8ae5387b530b157d3a044cacfdfeb47e94ca

SHA256
2f0f043a742b56dcd110be1cb2fd5fe01986cc773d07d78d3e84f1fea6abf1fc

SHA512
4c0de6c7d98ae6d1790f051bf7dd14a860c84ff9733a51f00a46732896c741e7901565abc74406e01a12dc0f90c9948b910d25c869d9533dac312aa9b9c83957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36265df5407b653492828e37efd0e5f8

SHA1
5362885f1c8c3c684c7741e4179a4d5eb0e78e74

SHA256
ba2362f7aba2818eef3461f602268a97d1624f50a46dd3b7e0b74057a413f556

SHA512
cbf8575d626a48616364fcc12e1e248e303786e449c87ac51c94516afc1ebc20bb409c3f159eb008fd07184294ba1e961aefcfac784eb3a0f0e468b71215c50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6fa01e8ef315304096836887e17a33

SHA1
e9bc3df32251ee613920e9f8ab9c73ac4b024236

SHA256
e5244aab5bd538eab332ed99d099c05d1b568100396bfeb980d3001453852d28

SHA512
7f984da287d3c4aad0463f75ce996d535ea0335a4e0f6245a6a859a07c884abd6f61ca5945989d60b0b7092813071ba8d8e90d68cbd8b845fff2ec39cb93be9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57dd96f5cbca9b4b9885320d39ff3c2c

SHA1
3bedde93f302d09eeffb07e5f951b9c498c03a6e

SHA256
2057b3a21a5f66dd0212bb2786c427848a58cf1aa5fd5743f5c578e8e1904d98

SHA512
e03c3f806af0dd9ef013364d36f6bc29c93e7adf0ff8100a975385b7c9358ac24a5bf2ca40d205eeae79a2f8c54f97021fb3007f4eaf8d9cc151b443c39732f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7f3c8c059577990d255f381a3cbce27

SHA1
253f1e3e37754515a15198b9353af0ae004d0fea

SHA256
6e47c8088eab6cc29aaf83a11c071f7704792a4db1bbde055c701f64431fef96

SHA512
b909fce625e3ee7e6e64f49463ad168df4f1c9241d6879b10a75877d09b0326d9e302d4d6b615d24608636ae85e93ec1161f17af6b89af91905574079fd40be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbf9013ec59b51c818b0a1f5aef22366

SHA1
caadb2e4b535fc2fae5f66d286f21691bf22d077

SHA256
2063a2581f142a238fec048398fd28b9dfd8c252cc10ffa84b2ee04b080ab054

SHA512
4f28fd04ab76afcaf18cde729016a538ef7816ec38a5326fd8c9cddbbc8b0d51485c293564ad46cf2033ae4c4975fb02b77f8c53fa053d21548a7d8c81e4dee0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209505cd971fb6529b9baec165e436da

SHA1
a593a3335926560eba4074a4942dda9545c5a690

SHA256
ae855adb0a3ff7fa9a292e5c28af174e4371df7ced115dd8ff00d39e62bf28ea

SHA512
32ba7d67a9a3b27c45aff0a3d9a94f49dfea6f3321224743e692d115845b7df70d489ee6aaa3df09600b42cb7e3b5a86e83a4886ee8961cd5158cbbd3e783c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab255.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar322.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit