cb1fa16f15aaef090a93ee7924607781bca317857aee6ef9e0a1fe34e3b38b5f

Analysis

max time kernel
130s
max time network
147s
platform
windows10_x64
resource
win10v20210410
submitted
27-06-2021 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Turtlee.games/Turtlee.games.exe.manifest.xml
Size

1KB
MD5

463de6f0f24965acc91253f73d85a4a7
SHA1

07641d704233f28ecc628f8315da01821e70fd2f
SHA256

29537254e37ffecd6ac573ee6475966ca0d40ebb090ce5390703e7cad585b14b
SHA512

6c558143e3d969b1fb09cc4dcd18e4c6f13a4e275bdfd0ef8b79b89f2cfbba44a6e828ec29d8d8fedaadd0acb3f98e6daafc03123ce1459188195d60572e09d6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000e22fa212cf5003c9734830e648eb2a38a07999c0d6d4641fcabe9bcaadc1eaf9000000000e8000000002000020000000c5dc36560366e980170c85d76337c9251a8f4ca9568a282bd4e11bbaa225b71020000000a61cbee627dc8373fad1155add52cca82c8ab7985687fe517920472be34ff79c40000000f2648d79c0819e8a613cb98b3aa33950000bf5d7b431faa5a1558752790ba34f3d46e1794d0c7d862ddf8a5665744f8393a73dbe8043c66365c5b127db26d51a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "331538347"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "331570338"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30894834"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BDA7C138-D6E5-11EB-A11C-46584878C9AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2461545392"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0eb3893f26ad701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f03f93f26ad701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ad98e1c4c5c1f64cbad3c833b8884b2700000000020000000000106600000001000020000000ab0ba13b8a5e0553a630454a1438373a472e8749b50933ece1fbb7f4335e29db000000000e8000000002000020000000890613a9b89f7e6523a2a77649e17f075452938e7772848a852969f31736f6c22000000040bae06c77108b238b0dd89c1e0a13ea0eb8027167725128efeaf54eaf96e22e40000000916a355189a97ce6e585778adc0325d27ce53ce1378b0e3fd7965760b1ece80a30ad62b6885d8c6f65208801928f7594d3faaec1e2757cc28b7e800c73410f89	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2454671586"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30894834"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2454825670"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "331521753"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30894834"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1884 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1884 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1884 iexplore.exe
1884 iexplore.exe
2668 IEXPLORE.EXE
2668 IEXPLORE.EXE
2668 IEXPLORE.EXE
2668 IEXPLORE.EXE

pid	process
1884	iexplore.exe

pid	process
1884	iexplore.exe

pid	process
1884	iexplore.exe
1884	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 4004 wrote to memory of 1884	4004	MSOXMLED.EXE	iexplore.exe
PID 4004 wrote to memory of 1884	4004	MSOXMLED.EXE	iexplore.exe
PID 1884 wrote to memory of 2668	1884	iexplore.exe	IEXPLORE.EXE
PID 1884 wrote to memory of 2668	1884	iexplore.exe	IEXPLORE.EXE
PID 1884 wrote to memory of 2668	1884	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Turtlee.games\Turtlee.games.exe.manifest.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Turtlee.games\Turtlee.games.exe.manifest.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
41a648a37e72f30390bf451fd6bdf52e

SHA1
c77961414f94ea98101fd3d7f5c3c7002038e74b

SHA256
2b411bca91b9e1d8a701ce15fa5572d60f2898ba569f16d8211f2667138b20a8

SHA512
70e1ec80a57eb1b7a72c4da179992e06ba2099ad5ed3c8ee0a5824685401983a7796c436cc1bc41edab524026a9c8a74b074bff7947b5e671eb5f960b99fbc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
MD5
1c76bfbfa868f76cd3b0464a4159dcd7

SHA1
e6ea1e8ee78133371ddc774a4d78ea6000be207b

SHA256
408c6521f23e911e43ccae3ba683d878b0fb82c114481bfe17e919f016858437

SHA512
0f48142ccb8ce36acb765661eaa240f15fd389617d3e2714496bc11a8f27e33f6fbe41e4087037dff6b0ffa5c41b7f9cd2a36c0735cb006c0a38624aee030ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9UTD3T8O.cookie
MD5
f05a7512e017beed1c45312027ad57bb

SHA1
c773ad70540d6a854c288c9fb95245eab51a630e

SHA256
d8d2e9caedd9392c689c0514db4f4bd5a9b88550a9564f84fd386900a21de6a0

SHA512
a1e48c448dbdec7506daaa72f5ab91a8b2d588a3be25458d3357f6d901438d1a022d4ce48ceb379dba37538a9975e9041af08cd9cb8ee4b22fe54e99a93453c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NODQ7CY5.cookie
MD5
044de95d89721492117ad4d8585b215f

SHA1
dda2f8ec1943f26e8c289c657b284c360c49f061

SHA256
f49703384d963ef2c604d23a8c0d327c9555dded2594d1e0315b839d0024fe7a

SHA512
62a8459fed1c727e3b4e1ab3a793557d852b6afb07fdc5bedec3e00aad69742bc3be2e8d02a8d90107f864c41791adb491a860c0a608153d529feba90fdbb30f

Download Submit
memory/1884-124-0x00007FFC07640000-0x00007FFC076AB000-memory.dmp

Filesize
428KB

Download
memory/1884-119-0x0000000000000000-mapping.dmp

Download
memory/2668-125-0x0000000000000000-mapping.dmp

Download
memory/4004-118-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-122-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-123-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-120-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-121-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-114-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-117-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-116-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download
memory/4004-115-0x00007FFBE40C0000-0x00007FFBE40D0000-memory.dmp

Filesize
64KB

Download