56955378e61028ec4b41b3fc7f0f1b70d26ef7dadced8ce5845a6fbaa3233dac

Analysis

max time kernel
97s
max time network
147s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-02-2023 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www.3dmgame.net.url
Size

112B
MD5

7028fd13e26b7f73d7750cb260305062
SHA1

600522f161fcbbca50ff196e6f8525d0fa1af0b1
SHA256

03e2c2f84d870f41ac46636dd0034812d4e7248a91d7eb38511de262049536f0
SHA512

0e64f8c748704b46911ea16c92ded3e2ec41f153c4f33affd2c442ceb3f477666eac51c60974385fb048f85002dc5c7c2225cacb09fef8d3c546eaad5b007026

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED48F371-B39A-11ED-9640-D2C9D0B8F522} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "383936326"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000001097c070fb9c3fcc82e4c1730b41d4eb28a33dbf87fe2658c0de97d497ec03000000000e80000000020000200000003ba63834b09140e27bdc6c57783ab8688195f31dabf71a93a20edf95167db60720000000a38ec7072452ee8276e91c96d789d565c0418b554f828c2c3eb2e5197be3509340000000d53959f3d9b072ab9451a4728cb83b23b20449eac859c338d052df41f1422ac73a4de00f1fd6409c467dd05487039fe923edc1bbca6185d30dadc3fb1d77cddb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000050d85f241d18e2ec6d36ed4881a1dd809c1a54ae44d49b200756dd17924d7f7b000000000e80000000020000200000007dcd328c64156365e0741776c59486ffaae3307c9670dd7716642a1342b60bcb90000000be6a21840f1183f3aa3e392dc27a5c9e8253b76b9f946750c4a37aedf57b46c58a1e75e5df6e6ff1f141380948786b19225bda60ce046112d93dc5279b55651dd27afc872901cb2c4d4bc1b55b2a6541abe925a23036adb292ab198422eb6c0cece59f65311d77f79e911a7c63b933d5e026741d76586cd29a572ea43b46aa751ff17e3572ce27fe3230763714ad7a52400000001ac5f05f774b7cd047460e46b1934e363f582565ae4a52226ee16c10a0d461193f2e3a9e6e3917412feb2283595ec3759ea0d0600758e0871d121cc01734124d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906266cda747d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1732 iexplore.exe
1732 iexplore.exe
1324 IEXPLORE.EXE
1324 IEXPLORE.EXE

pid	process
1732	iexplore.exe

pid	process
1732	iexplore.exe
1732	iexplore.exe
1324	IEXPLORE.EXE
1324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1732 wrote to memory of 1324	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1324	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1324	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 1324	1732	iexplore.exe	IEXPLORE.EXE

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.3dmgame.net.url
1⤵
- Checks whether UAC is enabled
PID:2044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
22039c9a60c801683079ebeeb0dd5ba0

SHA1
bff1c2853e5fc8ca9a729e73dff7463bf2249970

SHA256
09a2523e2b10553d36cd6365f93cef9566ceddee4dc703adfd2978c1c7a98d8c

SHA512
b8c064d040f336daad7b8c97252beeec48dfc578a5c850626cd3c276bdd8f7a59196ba5d9589523e4e45f7815d8ea84e6893fc728286d9e9f17cb689bfe791cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c43b1f84fe2c0b6cd6926e82c10f102d

SHA1
602df9c6c6efb2dff98578fcc34e5bc1d3b26c0c

SHA256
3670838b7512852d7d5acb0eea4048d38118dc07b599d9347a675fa064952377

SHA512
371dd60b2a187bcb5873335b320fbdef31d2a72e43973163fe82a065894d1eb8acc62460a3c4882aed48be860112fe471a244fb0c9b6f5e43cb31f639a6799c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b58ffaa4fee2ee014395c8a48436723b

SHA1
94ee729420433cd56a76a8d2215ccf78c15ed078

SHA256
1438acdc5df5d11318a8920193ca3017579cfd85d7493c9067f6fdd357ab5060

SHA512
1eae789d2ad86d8c0b7e8ff76e3c33edc83ac24f10f91b37132bd0f082b239992e1c62c0f38bd8ce4c24410875e970a99223e2bf19ec76153dcc9b16c7e2bd57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2aca7eb5814de96b2176dfc357c8cda7

SHA1
aa57a3d950a6ce5a4ed25327eb2de1b0544b593b

SHA256
d5fe532c5303a9e5217ff5237c0aec6c004762a11c690fa52b1c3f784275419c

SHA512
278d4aee12551546e0da029b749b961c13eba2c3abe128e7066dac057b98da8f9404031a02cefe877edfe3b466604a7c75107556f2fd92e7abd38cccbed6afc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d9e4911cf46a4b33e1e402d24e47624f

SHA1
0a319db528e2c00ab1c38ebada6fbc0f8e94fc0e

SHA256
b39c7b961b7e065bb5dc2c39b9ad0a5d20b965269d06bad323bcccd837695c51

SHA512
b6288809697d4488d04329d2da72ebe77c00c194494514ec1c733240716156718ee04cb808f0e990a2934cf3cf5be35e39c7fa10ecd831a8b1608f107d00ed6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5b490025baa7f79141d6bbdc8a02a9f1

SHA1
bc9fadab89ded94befce96e21bb63a41dc928fc2

SHA256
768b7caf287b046e3e041d3756d95ca74f8d4928d7cf3174b5039325b1444468

SHA512
2b28131a0a3c2cf1a4559d70c859429fe8189c99bb02e1dc075d5afe33013d288d80743b5b28240ad0e3070424462c88c718222a88217bc6750ee558f9e25bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
212addb99bbc965070ba458fba112c7c

SHA1
feab32f1fab7a25f8fedd87a965199074668d659

SHA256
7d9b3c5e755ade5cbfd90f047fa6a82bee9d4112abea0d71161e3474ac5ce4b8

SHA512
c1714d926777255ec62fe8ccd6025aab5e42028c438c5de99c2b7e1597ae9ce34de7b603871627e752712309549f06f0c2e26e36640eaad39179856882ea7cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
11093c350201424682d21a5438b63c5f

SHA1
303698a690fe574e0681e36c4131bcfecbab57af

SHA256
139c99d29e4eaa4f2069934413b0b63aa08a8933ac34e2c53e2b2515581e312f

SHA512
89393fae10c206ca98deaa3f4e96f0aaba52344d00e6b88bca5df9d035211671128d07694b15d2464c06b8413e05cd85118c53dadbdbdf2f4734c2f207998588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d6d436355d0dd8c626d344397b0d3583

SHA1
4133944cefb3428f9a9f9a9c30eedc47f2bfb9ff

SHA256
b2ca27c5eda8b02a60086eb0cefa8a4981a4dea17174e6e54e2aa19ddb588662

SHA512
ed4c8534bd7b8d579a43c4ebba68e203cf752044f57fd31668cd115e3f822207673029ef354035b94802c01975f8194b650ce919f2457b728fc5da18c1c00093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4615aca54453d7af872b9582b2858c39

SHA1
a06ce3eef569bcf96bf304003a488db6d934a3a3

SHA256
99923b7d4f1fd9bb11a0923e89ac49aca80feaf52151e9d70e7d2fc907e2394d

SHA512
630344aa2ea3acbbd22bf2e94ecde38a215859c1ec9f6faa94e9c1411b1e1c46c16b778461a79de98b3f0df964a50be7a9b546ae9c9465b0e4385df8dd630300

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60F6.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61B7.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UMI9J8OF.txt
Filesize
605B

MD5
df523bb581e98ca1c4f859cbc258df31

SHA1
56e234d78e3049999a1d07804a7c91fe4972e2c6

SHA256
0a8e067ed293ffcb4d0c1f288a3f778ecb3bd6bbe6096e31ad1bf0731f507445

SHA512
24de927fc40eb489a190e9ab5f747e23241d347fa3363d171781da566acef9eb82b8a29bc64abd2af9b3712b4e5f899727446cfc4c15f0732257e84836994054

Download Submit
memory/1324-55-0x0000000000690000-0x0000000000692000-memory.dmp

Filesize
8KB

Download
memory/1732-54-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download