546f9a002cde7cac6923efc55401dd43ae8ee654da38281b12cf95a55ec30fda

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/welcomepage_noadw.html
Size

5KB
MD5

503788b7c7fc1e94d3881697dc0f9455
SHA1

c9710548dd90191732aa428957988039d9014ced
SHA256

bff319cb4251e23c995abc742d926b7c85b9798783ac9dad8e8cdc274ede423c
SHA512

138f60cc8d168004325dcf2452f24fdd29a3fddc6f693326d01c614a6638c1d40ce9f7b1766b9440de8012d05977adc0f2b92eb02aa76d44ee7dfbc99cd24748
SSDEEP

96:SI32bJbWEMkTSf7qOugnffDbhIDbbE5zDbnwEqqc/zIxG1DuspXdNy7Pt:SI0bWEM6Sf75ugffDtIDHEBDzwfF//4r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a7cffdbcdbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2940E631-47B0-11EF-80BD-DAEE53C76889} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ab66f905a266d4f14f802faf244fdc561675ac4041cef50bc5465197b5a8e6e9000000000e8000000002000020000000372372111f499f68891b30e8a613e97e909fcbe589bcabf54cd386ffa96ed07c2000000091695b136c4ebb01faf16f65906abadfda851edc4de2292f09cce17751441971400000001bb4f8c51ee0149ea0011f1a1e94ca82ee36f89e5881f548e3c69113a9e34561ef1571ad342a1fbdc49a0e877b6cf5ad99743610a27f2f55b9eb67254fcd4a10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ac3a7a656236346c3c29f337a9a31ab1ba665d33a27e62dd8034048c5ee32737000000000e8000000002000020000000c69f302c8678ada648635e89bb740768ab021c600b54321fdef594acfe3d07c79000000050113854ff428ef210f8a105a6dff16d17e1889d7300b836a339d78710d8282a78c6814d6bc5a2607a52ed56ef4d92f86452a3f6a282373ec281487969f97a161a31055701678a01efeb70a7dfdf538099c751fee3dfaa70411525e2c74f6026dade36200b6a1f6de5c9b77b0dd2a23aae6153c6975281a6de38d8d5255c8b6f23af44cb8f58874e750a02fb28cc0c0d40000000e055e8ecd08b4c04c777514dd9a007559cc43fb82b806653f4a302541afbc2e3be54f5f7e42425dab3cb00e0ca306ca6d0b2aa2c26b0eacc38de0ada0cfc4aa6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427762608"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2176	2280	iexplore.exe	30
PID 2280 wrote to memory of 2176	2280	iexplore.exe	30
PID 2280 wrote to memory of 2176	2280	iexplore.exe	30
PID 2280 wrote to memory of 2176	2280	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\welcomepage_noadw.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ced4f169dec19f366c459ddd468ec3b8

SHA1
aeb68c385fd94296baf93712713b2014f26c6aea

SHA256
5a88c11c598d8c1012275f2bf5014b9ee34e14fac06b993faa749fa9150ee2c6

SHA512
20185daa89a0eabc9bcfb0157dc5c2bd840f816e03be237cc90992e95fdeccf02c1e8301af80f17c919e9d4067e6136158f318ee36135ff65532b27e8f18fa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83a5a419db77ab282e06197924844c56

SHA1
489c67f132465c8fe6036e6bad5252d9b296003a

SHA256
9fa20bf385e2ae262403fd9effac633249f2f798f447749e22591b65201e40f6

SHA512
d72e77c1459e9cb14ff985a850d3646f7427d1b9b525cbb78591bcc536dd976e7f19e7a71868994da2c089f45cc0245364bdc31d49ab57ae320263a71e810019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cfad510542d9a50147aa220d116ee47

SHA1
b6222bee40e8ab0b07543cf8ce87104426437f59

SHA256
1693a23e8eca405bb8b955d89d93172c469171de2c84d1bb835e9768c8d1d9a4

SHA512
9798b4e7e97f6c9234e0c1bcc8193b2fca501e181c927cc51cd006dd17f48416166179a52d520e3aa291b4b6fefcadac2bd1cde1b201d560a37aa646e6897ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c90685af5f1cf6fe2dee97a0b9fb8a4b

SHA1
5508d63d8b533c7d5f129d61ba81d27219fd0871

SHA256
f55c2c5574200ce71026c997f6786ffa2d919c3fba94549e3ddee3639fe5967e

SHA512
846768d27440de11a26cd1538dac6b93176fb4094e1594bdfd59c43badebd6e3bb8860b3e4df53cd36244fb452da917a844117a161cf0347d008172b7c704ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30276f1d174a98a349c57147a947162a

SHA1
b02b09210a9686f326f7035f573674461864b974

SHA256
f016f222dd8587b6c24699007be4c2a1817fdb14630685c356735325ef7ae168

SHA512
7d563aab533438d1544cf0827781dd6124c91a34a2584246b2f2def8f6b876126bf6a9d58977acea86e4ef0ceb6d5e3f07a08cf45b83a6f790b58f8adf433297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba51f57d5c4165d93bb3476999b3081

SHA1
e310648b0f6baee3517e4e665687e952fcd3afe9

SHA256
7c4f339f7c8b62e26d59479b4a2cf20dde6113a45280f893eda02d10141a2634

SHA512
2a3dd93a51b2bdc6acd578e37e401aa40a64310cca803a6e32fcb24cbcd2e02a36c8f7ffac8ac5d0be9ecf83d1940f55865ca1fb5238309d7a66c381d5a89f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fca67e3a8defe9b48faec6ff3f17c10

SHA1
ca7a856ad6aaf1501657f2f070e2ce48ab395962

SHA256
a79b17a8abde37f7a63e571660b21c076d87229e5d2ee3ce14c573372d6bd14e

SHA512
8b4916f6adaf23eb53339e4e7e9f8f8a5afba2e5bd6e81b0619118803a393e077427e01f3da740008aeae921df15faca04972dac67bcff6749e7881f1c481f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4da4d8e6d6a8daf1fc1f0c42697f9c4e

SHA1
42d4e2ddbc59d43bba11f335052da23e041f2456

SHA256
d2c3184137ea6058bc7986ec9f7ada4473e18c8a1da075fdec7e5975ceaebf3a

SHA512
b0f7901fed3cdd55f46e769ffec2b465903e9c938171947851164c39f67a7cacd7aa62d70058a4bfed0e23403492764c65e6a7f5255c9a3be8db2443cc6e55bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0114223a9c8af302b132ff83ea4dd00

SHA1
f8fce2bba36607c807cfa508540dd3c81a3577c3

SHA256
fe7ec25f8d12015e9079b9b48c507f847eefffc0c9478c1359ba4170ecbbbe65

SHA512
f7b6599f702328b7625aa2dd5cf4d5e2dea9d68080d06925be20c01b0f2af70bb7cffa5e287127fcaa919306f74dc633087cffab71fa955781d0be856f9d1d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE247.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE24A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit