hxxps://minermundo[.]com/advert/soundtheory-gullfoss-v1-4-0-x64-vst-vst3-aax/

Analysis

max time kernel
79s
max time network
137s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://minermundo.com/advert/soundtheory-gullfoss-v1-4-0-x64-vst-vst3-aax/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b043f8fd1dffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000ab6f1fa7b57b30baa55f9d32c6662ff3be030c3afe6beb1fa9f05128438d9b0a000000000e8000000002000020000000993d74b1659eba77af23f29caa59d3a686a4e969009b85402ce0f27532fe609790000000e0a955f0b7b9682d61a8f87402ca916e983bff3fa7604929a270cfa10ab958dca04fbd04560841afc59df9ca9f7c1dd82712fc761a4bcaf495a0644708bcfd81fc34acff85b98eea93c7bd323379ea4f358ad7432ae66d113dbd4e75626dfcad974367f7ad1d6b09891568b91ea77f9a4a0cc931a99d66e257d1b7e85770566a3bbf0bdf93303093ac7516442f16e0c240000000800e918dc555cd746555f979d6d79b3ed531c70a5779eb68d37bf472e0c989927a88038fa2a63b2628888efb9c9be0003f39a60fee24eb9d6acafbaf4bd77c2a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375960659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000277d659a358e73e93bccc506238dda958d7ba9fb5a4a4d36df81c22aa6b18435000000000e800000000200002000000084a7fcf0413588e7d1b018daa8e20141dfa86c374010411bb318c29f58d8f280200000004438b9ce3a40d9cad1f59a304e8ce78f1bb826055973703996454998172ac01e400000005e9251f8810ea18202a0a1aebfce5dd7cc3bd22221a5b9f8b0e9ba80ef92b242153e1e7c28671fa920c92f19407118c4458354e346532b58442e4fe25edf62a3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21793101-6B11-11ED-A5BF-5242C1400D5F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

iexplore.exe

pid process

1480 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1480 iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1480	iexplore.exe
1480	iexplore.exe
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
1132	IEXPLORE.EXE
1900	IEXPLORE.EXE
1900	IEXPLORE.EXE
1900	IEXPLORE.EXE
1900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1480 wrote to memory of 1132	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1132	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1132	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1132	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1900	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1900	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1900	1480	iexplore.exe	IEXPLORE.EXE
PID 1480 wrote to memory of 1900	1480	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://minermundo.com/advert/soundtheory-gullfoss-v1-4-0-x64-vst-vst3-aax/
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:537638 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9c094971a27ff86a263ae18cf5a0ff14

SHA1
368624fab92930f3edd9818b82341a152e72a162

SHA256
078a8257a7f0fe4fd6eb28f408e8ac24b0b018aaa023b37b1db23005ce91bd63

SHA512
236c9a1af251eb8175c25718f724fb564c6dd3aa48330641c0fa2bc2885c29d40f8cc504d1e68e5d9b4983760497b02aba396675deeaddeefce2214a3e6a82d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
ae7674294f5a17ef8761b33ac4dad848

SHA1
30a771e623dd1e3cb8694bb5f71393aaa9e87b6a

SHA256
cac85ed50ce25c45d5093aaaa231a0d1cd9667f47bd2312947070ba202c5d96b

SHA512
ab4a0adbe606ac6b1b8c87fb24fa23c7fdd23fbdcfb616f24fe1269dd4d409c45d7b64cdf65b08caa13e88b4461b29d2bded7e197120a7f65a525c2c5e905a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
472B

MD5
942e48a42959a84a8fb01744fd2caf86

SHA1
a3659e206ba81e8549afa2d9138060148883ba90

SHA256
7b84fbd99ebee52b8eb3b3d506ffc4ff9d15bd2bd211fc4003a20fe3ef171501

SHA512
924f681dd75a06bd57987ebdaa2dd7f5699dfbcc33388eb51368f907d583b40c8a62524a984550902d2b26831517c6aeb75683a3282f1bd5c256d80d55731138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
beaf9e24ea710b4c2c8276e10b98c64a

SHA1
660e38e0a3bb27ad450c716ce23858980c0de575

SHA256
619b0af350f58a95e6be4012ad82e3e560e766a48617febd70329b07a23366e4

SHA512
fc78a372dafd211ae58b20526bfb8aa5fb1b6ec6ec1622d48b7e91945d15814315bbcb12f8736e8ee46f77324ac9b861ab84496f598fa3318d7922e9927a9b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
9043c5a94d416da645db57b8423da840

SHA1
259aa5b31c5d8d8477165bc0ee8dc459dbb904d7

SHA256
7a11181723fc349609b061a52ff73405cdab64d326e8616e753db623e1627884

SHA512
433953b523efde07a8b2d5c6d1c81e53dbada131ca7f5c415cd529a8b7f796ca367b13114baa5734e2882aa894cc23d4606c60478b42894aec1153975a8cb4d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
360b008b75f97da29f0052bfb982a9e7

SHA1
0313e0664752d345410bc109d8de09cea876ceba

SHA256
82df71a68988b634bcc1f4f2be6f8eca973440efc3558907c2311a0f36b3cbe1

SHA512
4c90383d80091474c2e592e4c5a2ad177a270cc0306a8d29f86266a67326c67c304bdf08aa0544eba8fb6920608f682a598e17a397f0adb1ddc5519a698d5d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53a5c747f086396a7e6fac68f0ad02b0

SHA1
524e867d0f3ea3e8c186a74e61e3ec347db89fb5

SHA256
ffa60a8c96f23d3238aee07b6b2a19415c39fe0ca84a976517ee955822e589df

SHA512
a3f7f87725562b098bb7bcd08a563b41e9f216d03830344aaa5c4bc2ed69695b0e49243c84ee4ea07eff819955e1d1d99c89cd28520d564b055f90dd8d91a37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e2ec8737a7f67b3342dabe1f248c17c

SHA1
1f1db28227c58a173afdff7894b63a34c0e88ab0

SHA256
6239a7dd35f692a77699ec63b39473a6bd284ebfdc0e9f4186f79de73b3f08a3

SHA512
0b5e970760ad56a46f133b11cbc03b39555beb10357cffd976727f84032aa8a0e60938ec2403317b69fcccec8943d2eb7028cd00de7e9b78793a9023bf908a08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
743a81bf4efddb6c5587b607a2236c2c

SHA1
6caa3cbd423d73c0b76e49e73639c4e0cf6382bd

SHA256
0e83e59e94ac80a80709415af8a3dfee356258d47c9f3929e0a86bbeec219d6a

SHA512
d9e17342aee97d38f5e9bc6d2284fe1635ece703c4e7c81d87927409013a4bb081f128b9288f125a93da718ed376ee4c51aef422e0a3d1002de7fc01fd9e4b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b8646113cc6d1bb8d184d303268d9f72

SHA1
c5563a1125f020fd43de216b9a5056f1be708abf

SHA256
f491f9fdcde6d247c08841c0752aa5745179f9162e7d4b1b50c9c56bdcc47e41

SHA512
78f45fb63001d74a5b1ae26ffe19e6167532cd2737c1b330627862636dabb9e4feae7c46844be7f426fee89d687a9918acf6b4e5182b73fba5ab8d05eb0a6a42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_B49B51C2F61192D2C0D20E671D9EF51E

Filesize
402B

MD5
fb64cd2fd0c497f371fe1fdf9826b4e1

SHA1
6503fe2f3ddf808808ea311de58b3f4c0af1b0e5

SHA256
04148afea969e5a9bd8af6648cee28fb67fd1bc1bd9dac2c87947fc2bcb4d43b

SHA512
878c3eee848f61247a84dce69f113202122b7736090f290307aec2466290b230347be8c34e11043e1f7b6d558ed6cfeeef2eab255e28dfd64a229af1ea682138

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ROL4R9F7.txt

Filesize
603B

MD5
9ae87ff805cb25fe29068d38d8ec2bb6

SHA1
f564e3355be4bb504f30ba198839cbf178ef6e5e

SHA256
961cdfd9fcd2c0ea50ad918ff373c9cd85b85219b08d9ee38604bab532057a86

SHA512
11dc9586ba670e94317b0989c390a24c5e583b8db869c94052915f592adabd713621561175d5bb8f75fb0b3eb5137a455503044ba69f87347540f9dfe4ebd3f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ULUX4VVW.txt

Filesize
330B

MD5
147c12c0c7fad06c54ea2c8ca597aae5

SHA1
2a5c25c4d7b69ebf419ab85a5625c2fe91249691

SHA256
e28dd7be956642611c158272ad0ad954e0160f7b7ea1daa62d3d264699dad6e0

SHA512
3a6bd8e444ad6b4232d2639e27cd208c35be59b1d2bd4b002e9e9449ddfac759b72b2c50e4bcfe8c432aea269773e1c3c5105944bcdc5fc1794f69a1c531183c

Download Submit