d1fb85e63f1d1b46efaf9790fec6157ae1fc169d8b4a05290ebdff0205dcac1e

Resubmissions

16/10/2022, 22:57

221016-2xmyfaaddp 8

16/10/2022, 22:50

221016-2sk82sada9 1

Analysis

max time kernel
158s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/10/2022, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyHunter by windowsactivation.net.rar
Size

3.0MB
MD5

767feaffce5aa556d4dfe68be2e7bb45
SHA1

43d74e509e15b2961a15d924abf2294b918537a8
SHA256

d1fb85e63f1d1b46efaf9790fec6157ae1fc169d8b4a05290ebdff0205dcac1e
SHA512

fc3ae140c6829d828ab9faed903533c9f857307a5f279ba95b764f4a19f4bb59da1110561e6ac278567b34291a1280141fc12d92fd06886283c0c374777c1a2d
SSDEEP

49152:OY8JwzJ9M6oZ+gv6FjRAeYt7pkaTWRZ4B/e6dJhAiNyH7vlrXCNGozvN5d:OY8GzJ9/k+giFXWpkv0J/kUyHZbwvN

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
652	SpyHunter by windowsactivation.net.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F97B2811-4DB6-11ED-9551-6E705F4A26E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000002e898eb96112a99f57ef80052b2911b768a76cc0612300cf49eb661541fa0e2d000000000e8000000002000020000000db60d779a560a809141cb0339233c825c50cd5c3498addcc7a4ab5f69fc6032a200000000c3f219b3ed9bcca1d0e7813110d7b922c86c2c08b86b6ebbf8f2cba330a9d96400000001d061455eed16572c644bdc315a4ce22707afd1767009727403e8ad424f48dbcb05442c469515551323eac0b4aa29606a5ef5e2079fe1a70d1f9d7f50033182f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000628a74d9fa4635539069de0baff0d4ec9a56ad84375ff4332793c65f2ea2bb0e000000000e800000000200002000000042f901f77d921b4bece1d8eeb8a50bed8c8284e8b4f1bc7d734663ff70a1f45f9000000040920a45e212e0eee8ebc4064dc5d410580c5f29e62457e29e5972d0b2339b25490a79e879aab0895bfb9776ded06fba59086b4fa496d4272cdc1f7a53a3c1284bee89022a8b43f1241de0f29628d78497e76a41c4806dbdd3f9915ae8f540b0fc260318fe1fe59466869635c23ddb5377bc4dfb0083b254f9fd759bcc4a85e1986dd182f139549f4b887c1961dc84614000000076042bdf8b1e44c36a05221d205dfac01e0a47d22d5ad13b09d743055f412b08894ace6c165d74b6780dff0ed9b8225117caf71884926f8f49c3e9f66f06118e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10920cd6c3e1d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: 33	1536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1536	AUDIODG.EXE
Token: 33	1536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1536	AUDIODG.EXE
Token: SeRestorePrivilege	1076	7zG.exe
Token: 35	1076	7zG.exe
Token: SeSecurityPrivilege	1076	7zG.exe
Token: SeSecurityPrivilege	1076	7zG.exe
Token: SeShutdownPrivilege	652	SpyHunter by windowsactivation.net.exe
Token: SeBackupPrivilege	652	SpyHunter by windowsactivation.net.exe
Token: SeRestorePrivilege	652	SpyHunter by windowsactivation.net.exe
Token: SeDebugPrivilege	652	SpyHunter by windowsactivation.net.exe
Token: SeTakeOwnershipPrivilege	652	SpyHunter by windowsactivation.net.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1076	7zG.exe
940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
940	iexplore.exe
940	iexplore.exe
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1716	1976	cmd.exe	29
PID 1976 wrote to memory of 1716	1976	cmd.exe	29
PID 1976 wrote to memory of 1716	1976	cmd.exe	29
PID 940 wrote to memory of 1224	940	iexplore.exe	37
PID 940 wrote to memory of 1224	940	iexplore.exe	37
PID 940 wrote to memory of 1224	940	iexplore.exe	37
PID 940 wrote to memory of 1224	940	iexplore.exe	37

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SpyHunter by windowsactivation.net.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SpyHunter by windowsactivation.net.rar
  2⤵
  - Modifies registry class
  PID:1716

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:384

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\" -spe -an -ai#7zMap32141:126:7zEvent10372
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1076

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1224

C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe
"C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

Filesize
5KB

MD5
445da50b6e19a65dad621feade74b210

SHA1
338b776af781349256b0796c659b6f3c0087d7a1

SHA256
bc5bbcae7aebb8cb00b6e019a5db64694f0c7b4a2d9449ee2d231e3dea7cc875

SHA512
02026a50444908cbe710e7f27ec9e2a6d4f0209757dfc3945d473bda295db5b5e65a04b48c09aff934929c2c6bac16460783dcfe31a322810bf8656f339d0f3b

Download Submit
C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe

Filesize
6.2MB

MD5
7e47be258b69eaadd7341aeaca43959a

SHA1
2159b3bf9360ae6b4028efab6963d49dded0820a

SHA256
9996c01d79ce10f82189ef43f069c7440178f3051ba49e40c9a6f7dbf6b5a268

SHA512
8dddbf4f9b300e30500a05e37054a0f50dd47687bbb7b7ac0d8c0af11b5534ec278e09d761ca1fdec3a059350eee637312c664d7a0821c9eee61437ad0512009

Download Submit
C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe

Filesize
6.2MB

MD5
7e47be258b69eaadd7341aeaca43959a

SHA1
2159b3bf9360ae6b4028efab6963d49dded0820a

SHA256
9996c01d79ce10f82189ef43f069c7440178f3051ba49e40c9a6f7dbf6b5a268

SHA512
8dddbf4f9b300e30500a05e37054a0f50dd47687bbb7b7ac0d8c0af11b5534ec278e09d761ca1fdec3a059350eee637312c664d7a0821c9eee61437ad0512009

Download Submit
C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\windowsactivation.net.url

Filesize
118B

MD5
87e62bf1797b5e0081d78a61568939fd

SHA1
5a0f346c6c380766333f68d39d413bd20336978d

SHA256
a75a691c8d902eab99cf2ae3785d1e5ff035ec4dc0d860e1a492a0b441d74835

SHA512
67832b2d860d8408db98f89979534db9238fe41b93d1002550c8889b2e910584ed81c5c712ac50e8928cc145c56f601ec71ffd225bbccc6e1e3446ba716f488a

Download Submit
memory/652-86-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1976-54-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download