c9b922bf0972ecf680289aae5071ae6c5d03e1c0b2402cd21464ca82b67ca870

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Joomla_1.7.2-Stable-Full_Package/administrator/components/com_admin/helpers/index.html
Size

31B
MD5

8ca096fda23d564fe62bc65ef5f498e0
SHA1

166b05dab71422b4ce7c55ba3ad66492a8cd8a18
SHA256

b1f5b9c329d8f4c9bb9d4b2dc820419b8a277e2886af023777a399c9ec187a2c
SHA512

4a5b3cd40f4e5ca3637a286ae2884755315897adc9afcd4dda2e49d6a102b10503fca48d851e4fce25b753e932382991d91a1ad2f4d0ed1ab932b99d61f41cef

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c6b1c09b32a3025607bbd9556b89cc28025caf4ec9227b1fc220ab003ea4cf44000000000e8000000002000020000000a7222e2f77c8dbc72d8bd62fa362ea99727c010fe07a1452692c05a652546e192000000092ed36ecfa88971b0f932299ebc67c05fa8adfb93540241899186ec4e03c8fa240000000e4279e4ec58d483611473df8b7159357b15c52ab851ee5e4cad2e1643138129f38b67e6a98370a4d426a586e40a2e8f4f99ee763c1ce2d4c5bb125f33dbd61ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000da00dc6c274b737894bebb8eb7e63df9ec6a9dd0c18a1004c7f042b8c811551f000000000e80000000020000200000009cc4547376f587ad02d8acbd0aa688a985c73f0966f3245059af9bc1b50aa419900000003eb0d35d6418efa0e06c9df9dded7759f370823b929594adfd209489eb474b743c2cac03e7da6989a49dfa4f462c272d754eda366085c4a7969ff7d4f1ef5ad06658e2219d969a755f6f41f436f381028bbf1b392b7129d3d155a381149fe9062c7ec9622365e3eec62867a98238d47f529bb4e522d19a3cf44e0de590ea66f641e85c08a09a1a50ff12fbcbee6bfed240000000732e0a5fe0ad125b343d15bad63f2ea40c4feeb288d0f6053420599b60ecb936b2183255229bc7436b407fc9e7829ee3eb0ec06a2c0d9faae14b02acba337581	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427680533"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1066A601-46F1-11EF-B96D-66D8C57E4E43} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e7dde4fddada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
468	iexplore.exe
468	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2188	468	iexplore.exe	30
PID 468 wrote to memory of 2188	468	iexplore.exe	30
PID 468 wrote to memory of 2188	468	iexplore.exe	30
PID 468 wrote to memory of 2188	468	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Joomla_1.7.2-Stable-Full_Package\administrator\components\com_admin\helpers\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0ff202e8b7d5998378ed2bb737b5c92

SHA1
d37d0c2c3ec76b5b28e331132b18832cc90c8d49

SHA256
bc448ad294b614acd4f80ed3944843fcaa19f0aca6fff8ae1fe232bc771c5820

SHA512
f7f12d86c726b1b77bfb82e480255a5495a76853757ae093ff0f028756e30d732895f37b9888eee849a1d7a8b04286148814c42298f8e9fad6f5e0bcc5d01795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ad2d05f5bdfaff92022eb0d10a23f4d

SHA1
0aa32cfbfced67705aed80edcad5d50267b314be

SHA256
cd1c13ecf6e552feb5035edefb0fdb9f4269ad84c15c82ec06cd7773e64fca5e

SHA512
93ab4323c7944cc9365432e5f9fdf49955583291a1a42b7e3b8f24fa399da0eaf1299e27739b8fa0adef7c7bfb5d1a1a73e11a5710e5b86f93b28c492b069c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dea6f8f8b218859deffe8e7f737d288e

SHA1
cad7c6ac073f348da6c137419dec4ad49aecf367

SHA256
c3b141e21f0de088243fbcaad543506c02ea82961b477d35934927386961a28a

SHA512
1bc95f8ac239d6a0e98c805b68e3db2847948f1e47df9560af333513ed49d10c5693a515f88ac6c40826308af75736b94bd439f0a0bd9c7db607e71b6e6e3260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3da0de6538c6ba4260806fef00090170

SHA1
e6db74692b7d4a428f9fcd9f198fd776f1f3cc64

SHA256
179c2c50e66fac95b83f6a886122a10ee59813686663b0b3cd34007a1374503c

SHA512
23e1f8d1db85b9616df23255093e018fcfee912f538b5ee72dacac1360346970d245152e4b2313921810a6c7cb2787005278c2b378caa10678bc2fc25acc0a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e3cfdee2101636bf8e1e12a60c5f05

SHA1
11e1f9829e3670a0899a685ead5f5981ea6195b0

SHA256
f102175403f422a979da924546ef72fb67fe66e6bf44acfbfb6c29c0bb69468b

SHA512
d4b07740dd353b821d30df6228fc36737f5c10cdb111f71a70ce536b314adbe165a2a8d73c5b4460569acbaae59ddd2b7d5f35ec6765c76f2a3979e0c25a17c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bcea94fdb4834fdc0027ece081162ee

SHA1
4eb322c8cddf19094ebd19d3aad7e9ab45eaf8d2

SHA256
e684d6c6ab2964df87d2a3b16e7eb244f7d894f9ceaa3a604a0badfe8ad53df8

SHA512
d14ebed2af618a87ef4025b79fdf41e491ede231b8c7110e0161c8e7b18940cbf482d8ce39e10a4ed8b0a030a7d49bec078b44e298b2ddec90658f578e8875af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328e51cf99c1d74f03f87a89d24d6b2c

SHA1
f9a68095939e0ba6a3e0446767772b612768133e

SHA256
8e81f3eeec64aaf586a3e9a484c3fce58acd50d518d5dbdda67b048a3190e16c

SHA512
61260e32e96b0721a6578c72441e6229e70411b36dbac08d19c81d7a508f966bd482a0de4d273ea4a83d5eb2610fa61305aae8e391726c6e5bb44c3c524049b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1d43b33b85031bec740e48be522ca77

SHA1
b3f3aaee61c935f5fb06f6f834cc6855d77d41c1

SHA256
0f1c74c57bdb2792c74a7cd333528e71e80a466ce9ae6fc258f9eccb0951926a

SHA512
04c110de0d7d70f417289e03018a2928828a9c7de4308458d7f6ae17035ab6106f3aa7d83468aa4dd394a8e63a0b34572cb106abe47e3777882c8eb9bd37cbdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2647935597c52fa986ba357093311b5

SHA1
3200932d2954d5a3f661774f37218a5afdd0333d

SHA256
25c60a944dc3e7a884a727a3ec2b9aff7c895e38dbdb777cd3a2db761e53bc79

SHA512
5bec2be28260f2fe9aaa68cab36e4b55a62e4c88fa063089b3483cb110f87d63a05cd576bfd17697cbae4cb448bc43508bef243330f449c48fd5620e0a848897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1374725dc33e1ecf476b7ed5d52bc1ed

SHA1
cc81c5f01a030728e5d2d76a8a87a13e5cb3f188

SHA256
6cd8a893d691d12ed03943d8376d268763ad6f217459c5d9cb20435b9fd98d38

SHA512
57fca7889dba074243ba55be87bd1ca3ea7e6ca1129661fe986cd810aaef2c4d3a92a72f6065d8c6bb8907d19f9645312f86f887dbc93cd472c217c60aa2f37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54a0e1a44a11a954ca9b894578773167

SHA1
506848a4ac8210e5dfdfd133a5f49d8a58c4f318

SHA256
57c159ab7b66c77f6c2304250ccdd884c74465fb51db06447635b3e0bfd1f8ce

SHA512
573ce4f896ee70df323c90d197a243f36dd3a44fe1ac6f3de529cca9d224de5113ca9a0d9a8657aa484fad1388f8ad11d66906bbc6f1f077c3aee2d26ee39ad6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dccc78edbeceb7cee8deb7d34fecca2

SHA1
532299f0a33656f38e5d4d173a9016a92b6cf50c

SHA256
61e676dd5a2dd8ccb7826c4f1a1767b489f309b517d05a509de2343c8eb024f5

SHA512
66d3b2fa45002633dff2a9c7618ae053811798a838e802649ecd08f03171570d576ffa15828461ce56dcd85c21025c193a5f2c9d6ad898a7a381e73c52fac58d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09683ea0e8b24bf4d5d69615af3d10b5

SHA1
06556eda8319ed041bd710a6485102d87121d813

SHA256
086e6e5a8ed798c6329c38ff3ade0028283db9b182f048102548bc18eeba3dd9

SHA512
6973a5bb93a4d20b54b622c6fc7a1a6d5317923048225b3b8d4986ba0cae1d5ce1fc453c76e1db1e07103a31f42b2a4067f131a9604c49544c9f67401c5d954a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790e9055e128153480687484f3efa528

SHA1
b45443abc56acac79ff9040874aedcd02780d2e3

SHA256
5010b50d83b3f84e0470c3fc593225c66839205bcfb267c2e065678d279cf812

SHA512
9e23e11eb807c7058346b47a99fd542cbef2a5ab94bd54b405696bab62c6118c252502eec1c490733aefc46713da3a2bc9241651de3f3f06569e0e49cbaa08fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b534f11da5a6387e0df9c324dff796ed

SHA1
c36ac94ac4413af13ce152f85306e5a651eeed92

SHA256
fccc927279cff573b97353933fa54e450adcb2310f7026d724997aa337e5a8df

SHA512
ee1fdb6290679e0c140e9249059810a32ac6378773efb75eb223da0f207ec088944e2d3bbd590f723d8b996ba2285ce84511ccc6af54e30da96f2affae409016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87a6d3239c48455808c838d4abec7037

SHA1
d25971068c0019ff5a84d9a72254009e82b6ebb9

SHA256
74aaaae83cde4d85acee82f3ff565327b44e17113e71f273edcf4596a0dc2596

SHA512
d2533066abe0e32e814f52f9b15429da7fb8eb2d3ffbae0cf1853586f19a3f189e55ea3bde6a3c933d28d69b08664d2e09f8271f9f6e8cbab471de31815ffc11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12423a7407ffdf90ddad2bf012209c9c

SHA1
a0296b8eea3c34b92811afc4b0ce24552237c4ea

SHA256
84a490646af81da7c0741416a55f483b4a1711629d9ab2494a7df1483e825a2f

SHA512
aaff16425724bc06a1cd036f23ca9df000e7834b1f111a22565d69e55a0d505626c26eda2d56dfd6df2875ca33b85f8a45fdf18e2081014f8c858087c4902de9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6EF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF79E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit