Analysis
-
max time kernel
132s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-01-2023 13:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://steamunlocked.net
Resource
win7-20220812-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral2
Sample
http://steamunlocked.net
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
1800 seconds
General
-
Target
http://steamunlocked.net
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380210640" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63E2EEA1-91B8-11ED-8803-52E8C5FCC7C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms\AskUser = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000143792f9ca669944b7ae15f214ddfc690000000002000000000010660000000100002000000068382b06e99166f21ba80a1d11a1aedd71a74cea7354e2588adfded7ffb3e6d3000000000e8000000002000020000000d834f67744f3362ddcb18ef195acff01aa2aaa40099a4623400306aa7072ea8520000000e6522a0c85775f1d7b6d943ce3ea5acfedbdc6dfcffcf78eb701aa73ef1695cc400000001e6dc869004e23b0529a4d024d4277d6d108188583a1e139af4628292ad3271dbf5e7c8b651c972d05926c504c3ada9850001ccc94fa734dd9ea752575b1efa7 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d7cd3fc525d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000143792f9ca669944b7ae15f214ddfc6900000000020000000000106600000001000020000000b94fd4dc2e681172657bd4847fc05804781955ce64016fae1585ce80b8d904cb000000000e8000000002000020000000889e3a4a15bff69a3a2861235ef67f68dfad8063597b1df9a6025426183eb695900000002f42f50b24b5853c6f5dcb2ee086a4b6b3ce391b9fe29f248e7b372fa7c55918667aedaf4df13d8a981ca479b5ade640a8e0c3c05e43c319cb93a137fbe1f62d0781982f3e40b1f85965e4ceb5e98505cdfa34c431a1b34fc6169aa10dd6a530fac2e259f1d02e3fc09fe2732ab1c4e207c1e6be4d78b8a9dd95cd6f46132d3887a3b1957e2345bfb205ec66925d49ba40000000dd9d3d09b0b3de5e9cc3249fd3ca6312daceb61309eb43880e285baade07bb3a0c7b4f4103e12b6eeddb6870767c7fbf0d29f3b28cdb77f6a9bff95a6bd1d084 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 364 iexplore.exe 364 iexplore.exe 364 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 364 iexplore.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 364 iexplore.exe 364 iexplore.exe 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 364 wrote to memory of 1436 364 iexplore.exe 28 PID 364 wrote to memory of 1436 364 iexplore.exe 28 PID 364 wrote to memory of 1436 364 iexplore.exe 28 PID 364 wrote to memory of 1436 364 iexplore.exe 28 PID 364 wrote to memory of 1064 364 iexplore.exe 30 PID 364 wrote to memory of 1064 364 iexplore.exe 30 PID 364 wrote to memory of 1064 364 iexplore.exe 30 PID 364 wrote to memory of 1064 364 iexplore.exe 30 PID 364 wrote to memory of 1704 364 iexplore.exe 31 PID 364 wrote to memory of 1704 364 iexplore.exe 31 PID 364 wrote to memory of 1704 364 iexplore.exe 31 PID 364 wrote to memory of 1704 364 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://steamunlocked.net1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1436
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:668698 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:930827 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD52a27ba351e528032e7f37f4bf6bf0d1c
SHA1a41620494248ddf66d61fd8f7cff920fa90cd35b
SHA256ec7967657262ff9f3f23a99056a2b6ae861abeba1931271fbde49cf924bae5d9
SHA51269f1df546442581824dcda7f774ea8a03c1d95aa5c76f63ee181faaafe860a3e7bf352baded64ae399f5e8f532f7bd9c30b062a95041c6f7c3212b1ba6a0d77d
-
Filesize
5KB
MD578faab8bcf8b835db7299e300e629005
SHA1e479c3af558b20203f23ff6b6766e29e4ddd4bdf
SHA2562b0bb58b64bfdc237d3ee6a060e734dce26dea657e074d995da76a5a32973c8d
SHA512db73fb4aada77023bffc866d5856f0fffbfdaaddb30c4c668a40c3830c499eb24259da078e638834d852886ad6d60df8201a14207e9bf7dedb603a03a01a68de
-
Filesize
608B
MD552fce3ea8b7217da5ccb022a8df0811d
SHA12f985ea20580fb49334ea336d29184645ade4460
SHA25630dadd53130ae9a279015ebf9039f83d632a55c1b453a89c6cc870415ccd2c47
SHA512a1271c5ebe657ef67a0ea5c09ffd037e8427380b2ee6d8e2fd11aa65bd6cccc936d95c1c4261e2f0d64e8254f2f8b53efa028df57e257bdd2f34f50edc35b66c