c9b922bf0972ecf680289aae5071ae6c5d03e1c0b2402cd21464ca82b67ca870

Analysis

max time kernel
117s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Joomla_1.7.2-Stable-Full_Package/administrator/components/com_admin/views/index.html
Size

31B
MD5

8ca096fda23d564fe62bc65ef5f498e0
SHA1

166b05dab71422b4ce7c55ba3ad66492a8cd8a18
SHA256

b1f5b9c329d8f4c9bb9d4b2dc820419b8a277e2886af023777a399c9ec187a2c
SHA512

4a5b3cd40f4e5ca3637a286ae2884755315897adc9afcd4dda2e49d6a102b10503fca48d851e4fce25b753e932382991d91a1ad2f4d0ed1ab932b99d61f41cef

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427680542"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000180a0523d7b186fc4a3d6a97c71f57c96a96e6e78fbd046bd5a44f47519a806a000000000e8000000002000020000000ec44168a1327ea00335b7c62d20257f9dabf5fcb01817eeeee0ac476ebd9c6849000000084f72c4893ccbfb8e0e841637a2e35449addbeb9cfe3dc487209fc5eb309d623a5a7b790d6e3d64ce5cd2222fc7d3cde5e57a3366555236827178eb7b793aac97b0ccfa542321ffbc0796f36033525f3fedaa7e0a4010cd82b50a55e9e903173f41b82ff71d7095b39b0fbd600cbb861ed328f956e059ae7dcb6ddc875994eef881a2914ab789a5f2ed4038e8b8074a940000000786ee45eb897853b118a76ec8bec3e37d04f0860b83b7f855124023d45984ae43bbc006f9fee34abdc9e55009eeae4ad250541569845177bdbdb7094e3a22cf1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1543B461-46F1-11EF-AEC5-4605CC5911A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000002116fd04b9ef65a36183b135e6d8d8466ee6a4d6d9f52d2d30daa8c0d54c94b6000000000e8000000002000020000000fcb31b971ed3b210c0cde15a905ad1cf87aef4d3ea894f573bd5ae7501bb088920000000a62734a0d44f418278328ffd69f7e39d6b9764456b857f4da0e587cb252bc903400000004946d441869b6d1852dc6164263b7c1bc0b0eab5d9d34b4adf6a3f86d5601f519791877bb3ee862cebaa0a25dc5e59c7e6ed3c488f0e2a8a87ba2e5d5ae04ea7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90433ceafddada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE
2244	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2244	2012	iexplore.exe	31
PID 2012 wrote to memory of 2244	2012	iexplore.exe	31
PID 2012 wrote to memory of 2244	2012	iexplore.exe	31
PID 2012 wrote to memory of 2244	2012	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Joomla_1.7.2-Stable-Full_Package\administrator\components\com_admin\views\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59db9c2c0658fa361050759a587c3a60

SHA1
a49f97e0e2d5b966dec4c3b7ac15c79bd1ba603b

SHA256
cbcee90e3ba4f189eae6bd4b5ff9c4793a231ab8af30560ae6cc25b7a1a20172

SHA512
d6e36b797b4733fd94f2d35ef18686a9ad273d01444add1fc05efda8943bc842906b19db97124bd06bea28345ea8e0f8926c2a32517ac5fa2f32b7baebb59fdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c1ee512c44956498bc3491b719518f

SHA1
73ef733ba741e138ffa473043549aabb52bc4203

SHA256
f3521f677ace5c4da56cfea7e27c9bd78b1c8aa173ee68e87cdeaec4a9598130

SHA512
91f7bd954c342f7445d8fe09ac0114972bda3918afdaa16cbf6306cb99efe1ba54fe04c71dbc120b75cb83c807e48a1036bee188e4a7c1d90d9dbb73787dd02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6363926255e5eee1c221d5b57e2a3ca6

SHA1
bfdfaf18aac82d3cb9f3e96379b9cbdb9a72fd07

SHA256
b888172e6781463428408f1d2422bcea400b34d56147ccb6dd824ed393198162

SHA512
83723091bb89de019def6ee0e9ae875197b6c2dfd4b97ac2f97bcb95707087c93d8455818288e5244b36dc092d8aa666470dee7f00a165d2fff978e21e64ab0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf5157b53b2b3d030704d321afe0685

SHA1
6408ebf3fbe0c92552dd9e4217b3231a6901c7e1

SHA256
c50421c294aa1a995b8960aa08914d15c619db893a4d94b6b9e527bf4114dfd6

SHA512
c41bb676451d9953d3c55eaef77660ace95e15c7f03298402bdfb4ccb0985d955e71aef7d050d9f690c3f97d84fdc8ad8d084702e0ce5a4ef55f4385a293eadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1ce16bfb15fcf415ec7b9e909d12457

SHA1
290064151a6fff8de95ca742eb9ec927537ebce2

SHA256
0e1ac15fa526f5a5c269e0e897b8efc1edae8f6e9c9ebe5fc752d46db7b2a919

SHA512
8201854eaea724f923873bc775195b64323d48814cf9ccec148db48403434ead7e8c03fd63a0365644702da667b3001e2077e2019dca4dc39e7cddaa9fcac34c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01093f5abec0481582ee92245d064f49

SHA1
2a269bb32d756acdc4b158d560741ba6c9ee5991

SHA256
7e6c6e1254aa26705dc335e612789a8f15eb2f146a34eb62f86e464a7a218c92

SHA512
4050071dfc76e5b82bc3b993bfe26d93f03fd4b2773bb6e75328ac22b56b6cc44127ff7cb0f584d5319c8af12973efc8e54c10bb34010581ac1ac823839759dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f12234d3e12756e328265bb4549bd8ac

SHA1
eff3c2baab18391ba112c47336f1e6d5dca392ba

SHA256
467407ddca30942e8fd846d05f3a615547a07e594f02e272388dd0ed55adcac0

SHA512
5f3c566884224014ed0d7973bb608428eef3b4af3dc1cd96a7815ee34128c161ecdad97742fcec5c1452b5464cdfcf1fef1ef328f651268118d70428d7588789

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2694b93dd60a9f202ddc07de397ccaa0

SHA1
c0fccff0dc21481df59cb921569e0e5d00a17737

SHA256
e8c2d234c8ac678bf3c1cd7dca3862d9a71040b8aeb29b84e212260a9d2b94b9

SHA512
fdd4fe6fc86fdc3677fea40611cb4b8255563f0a1a2641ec459e13100f6b8e89cf538de58fca043ea4050696c295019a66baa36ec1f637f76f4254129c0e47da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b61758bec6fb3f3d07e270bf789f21d

SHA1
e6fe381c10850b89d08264a671658aa4ed6d4f4e

SHA256
fdb85a04ebb25e6c70f923f41416c2615428711c72537e35cfc6c5086f5cc6aa

SHA512
50d75d129fa6d44e3e25d9db1fff56d7f0e61e87c200feb1e4122cff28013cae278603997643a5c711635426900bd14c7b83cb1763e89fade858fa1448d614e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e3def5050a2811e7601ac4ba19ee726

SHA1
fdf9bf1f1a6d7cc2a1f66566da647bb2e38377a0

SHA256
c3aad6c52966cd893f3d8c70b433404e3bf3131a2376a64e337cd22906765128

SHA512
28fdc67a4caa38d8ad9bc3f3372e246b6f118883419fff25f7814c0099c8ce448b36bb046d41b9d3d972a64c2d17725f5dd38d4d49d61fd784e6f380fdca5971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06b4951a4a17beac4c3cf2677767966c

SHA1
1d414686dbcd0e42f87981b73b311c0958003727

SHA256
428f9b69c68b34812359ea6c9dc42c9c5d7369eb98228346f98ed128e5704244

SHA512
5016d2bf61f249a51a326225b4dfce8a68b22df5c3284305bfe6a530742de9a084fbf58e2efed22a69d6216d9ffd738f5e0db724dfb91a2f03803acb9d40aea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aca065b4a4107316387a764d1ca65eee

SHA1
5cddf43c6ab4e48c6d2c9381114a3541b1a2ae6d

SHA256
c98e121ea4cd2e96ada120efbca9e936f9f903a3879b7bce3e79432ffed8b6c8

SHA512
5b85c2bf53d93eded93913605585ab2ac352b4274a6cac86c631b0eb09c0a633bb115fe607b106579cc35bf442e19dd31f4f741af3440477a488874270e62917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b9b3f45a5b61e018a0167fff438d78e

SHA1
16de196a0266221a56ff33026c16fb16439a1620

SHA256
3cf9c923201768270f522eb51c47148b80c380725c850b4dbf6dc42d726c9513

SHA512
c2fc0d0e69eeb81a5781d7954112b6a1b83498b6050a99f899a7b8d4fb20c77d3311b3f765af45e503392245a559326f4e5aedad392c1de1a8598054244eb8c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3a45483bc44761449ab80f195abf629

SHA1
c1a7e7ed56150f6306df200ef1bea722ab1c3f6d

SHA256
be5ff5b85eb65b2e450d2153bf165f6f811b55381911c3ce579c5b934adb624e

SHA512
8610bdad19cbfb2c4a406ddc07dd4a5b898ab3d15ca25db8b1fee4d3cfaf3cbf50f63daac4d04276d839f52a85b6782ae2b39c6a11148787631423455b19fd2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c8f5b6266091c30c61f33fa714fe581

SHA1
5c8bf1253acf691ccd03c892e69b0b286ecffa13

SHA256
998690960fec06fcd516490da5c7b9ef53e727ac99c2e113a74618f5d67a7dd3

SHA512
29ae7acfd33157f1aab139eaf8a4e0cd8a587c8ed626f73aa67178b69c7e69a64e32bf98ef24f2c553afebaeec8eede7c45557ba3dd722403b903373bb019660

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1ba447955dec892de388c7b9f8eba3

SHA1
111d3b91510219b15e800ca5ddfb4786c05d60be

SHA256
5c568b7230117b52f8f0c7c2030f5fc239759cae556d15e1aa40c6657dd1f6f4

SHA512
cffb61af5c9d8b89b253a0aac76a387dbb5cdc4f912115ebbaf539f6bf334ea182f9e3930529a65f3ff2e1364e7aa98212d199aaca1e28436e55b517443d1a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a34e3a8f2f66742d751ff6bb01479dc0

SHA1
af76f1245e71abfc5b0e3d27fd4856455bcb0283

SHA256
e613b0759c899fc40c7f721c8c00ae4674aa2ff16d0217fa1769438aeae2d781

SHA512
377cbd1540ff5aa0ad4582be595ad9990a3efc9b9d0a7f7ca151cf16dd4a62d60920070157dce378cfceeab6e29fa70f765e750d1818b5d80626df927c0a84ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4953.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit