Analysis
-
max time kernel
100s -
max time network
227s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
27-03-2023 20:30
Static task
static1
Behavioral task
behavioral1
Sample
LDPLayer.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LDPLayer.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
RealO/eulaLic.html
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
RealO/eulaLic.html
Resource
win10v2004-20230220-en
General
-
Target
RealO/eulaLic.html
-
Size
8KB
-
MD5
a729d63514511766fcdd2de19cdbd017
-
SHA1
737827e5c0ab0adc287d3b3bb16d26a9a42f0939
-
SHA256
6dda16414ec5a7f6908f6088ea5edb7c67b024c3f695fbf7048ab823bcfee728
-
SHA512
ad6bc65c950a94383f3f1d987508d22167343db632412b74d4734482916a7c18981dc8d84c57109f0882f6c5c6f280db876bafd24837f06996614d1bb9ce6ee2
-
SSDEEP
192:HLFjO9B8eBfDX/Ek8IFyMlgy/RVr1YGrtsk2whjPYwWkpeFWlMddhTdLVxFl/:HLFjO9B8eBfDXoIFyLw1YGZsk2whjPYL
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D4C2211-CCEF-11ED-B2AF-D28FF4BEF639} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386721370" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07ef133fc60d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000051fff0d18d69707a4941f3e734726a2fe017dc320a60d5b3908e1f54aa1ff87e000000000e8000000002000020000000e941f0959bfdedb531399deaf412407cfa8a7facd9cffa238c83f0355d901e2f90000000e319f8ef55353371e830976ab4320757cb3956c4ee8b16bada6e7884c25b3bced2e6d2382a4ba34ea1f9b2437de41f73cefe2e17bb3354919a721964e05eee17af40671bbd9b83ae5112641939c8beda2a9d8e4ffa54504bbf68cf32581070a903c0e7e41e19f112a979f2c614101e25de81a2e06dafb49de1db7f0d3ae6076dc2059449ac7e78f68de5e5a37c8568254000000077103d8e0c0729c0e5a7e6b69b6acb09f5f30b9670fb0437342c5fd8524e116ee1d88339016825735bf77fa7580d16a1491d2128df87fe1547aa0226ce237952 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca0000000002000000000010660000000100002000000099df1982fbb60a2b307ce38fa6337f74aabd3846a3186f36ad530d7ea4786ff8000000000e80000000020000200000001e8954593e6f73e4aeb7b07ba324cf09c17b02eee153196335a547ee8f02175120000000f08e2522264eeb991351534b31a0a0dd4984164a474fc0aea2b0dd5718b818484000000000146ad6cb08b9a6823b69cc24b39e3407ecf1ba033ae61b1e9643136b13891035c8629cd19f500ca01395aec4fef6e1e2c27ae8a65c48554da6c026f99627bf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1724 iexplore.exe 1724 iexplore.exe 296 IEXPLORE.EXE 296 IEXPLORE.EXE 296 IEXPLORE.EXE 296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1724 wrote to memory of 296 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 296 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 296 1724 iexplore.exe IEXPLORE.EXE PID 1724 wrote to memory of 296 1724 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\RealO\eulaLic.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:296
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD508b2a5e0733cfac555f5e6a0a1a0420e
SHA1da983343d791d32f8f95775e4c91bf71a82ea46b
SHA25646460619d68d6ecee39adedc514e8b822d9cd448cf1b30485ee27e532fad7037
SHA5128456e39ff168a5aaf8a030af1ecf240e6e7226840e6298e3aac02bb29cc112d2ad5c8ba3a46ade7228f6ac7ee693dae7a5a3f03f2b290ad0a1df9a5a46bdebbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD516eaefa832eb2d408f2386993c599220
SHA1703f1a06d9ca74a7c79db2f01bde258c55e4975c
SHA256c645de2c3c3c7e142edd2cb76300f671a4298b3f0a3a00448b32bb17e875d081
SHA51206892c23c0831544112e6ef52e89d04ee36a6fe8b05a22f05770d565eb30f69e31907647c666c7b93b33332fba36046eba17e546ba4a2b57624ef9ed9eed07d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD54ea8a146097b94126db03ed793d69c7f
SHA1087d4945a0d802f23fb8d92962fdeba1d03319c4
SHA2565bb622f3832bd6e20b14067e0760ac1aae696766d7f840bf3cd08cc5f685f2de
SHA5120e495ec601854b18fbe5ab19bd4ce04056561d1fadb8c71909535b6f8280b715c0a435051d0c5e1f5326527d2206319bc5b79af59b84ab7d161aa33a383c3438
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD57c75b8f17533b7e1309eabf787a54c7f
SHA1ca5467f776618e87e5a8bb0a76b3eadda3356381
SHA256519311269e3e0ea288095504527239f415686dfe2f020b3e27d68ddc2a2fa8d0
SHA5123251d9e20cefdb2038fac047866de850b363b7976a10987850dfdcc94b0cbce563d52f000a1d1196683bed52ed98ddc91def45aa37339ab59b4672668f1cab72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a35358a3b5d172e9e53e06d805eefb0a
SHA1f029988668a40edae979f14d765caa7ade53e08d
SHA25699e18e734342e6cffa3ef5c644927e87332b59336ac1e1ed0d72f18cfa3e9d7f
SHA5125d973bb1e55f7d8f56f03745ef2cef47737f23dfbc9bb8816a7141d47e95ca661dd824a598ba367a7c4ff3687cd22cd21e1f7797dca0c65111e1a1f6e56f2ee2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5adb7ef3597d07b2438dfc98fbd950bc6
SHA1ad3889d55d4aedb5cd666ba3864e00d1665169d4
SHA2563cb6ef47350228db3c52c3809e67b2000eb7e60b8fbe9b78167dea11112cb8d7
SHA512443825b1cf56f5da13545c95a7183040cf5466e2b8b50302be840f15b93678f5ab40fe9050d4ebe70d960df4150eb8c7d2be72aa0f8a3f01dc830db612c85b61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5c91bce1c4c4b9824dd75e7caa754aff4
SHA15b341461c855848c4ff85a9cfe4d90fc77151386
SHA25616bae75a2a7056cd39996408590a9243db22f98be49bdcec5c30798049d4e284
SHA5129a9e32514d1132c856ea01a200950420c352eeeb84e6e7c5ccd94687a9e7eaf4037b2c0b4c88c7173f7274c83fbde1c75b2258f6d5852462362cffa006bc08b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5dde7e5145433b2851086a5038668a156
SHA14ff054bd0f20b564f998c716105183af0b973144
SHA256cf81ed301c3bf2157ce305bfd1f75a129cd7a18f1ca30d5afe415b598a600e2d
SHA512a721fd871e6e03cafe8e866e1894d3035247113116ff86d6b965852ea677d9699a36e26b75bc8fb9643d0e5b6a076c0f994eb790a412d75f5f5eee2193c4565e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5d6bb2ed041eac1e699cc478b9b94fe7f
SHA160c1c254964bbf7a50fdbdfe836f48ace4a14467
SHA256e80fb3bc86416eb31c2e4ffb3ac2e2d92773b476dbeae3dfe0f2ef483b01eec2
SHA512f1c4315777e45000014e00350fb74cf822832ec56dbc7085d757ec4a2a503f7e7d87931f541a23211c56cd7c5f4323636ea48670a844cc4b6e3c589d41f4d168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5ed4dd5c49a578acb7e949068f46a3661
SHA19fe112a4b1f0794f9d18e24b728f89f3b7dbf2be
SHA2568e0bb75f9d701d1a727187f80384dae387492b1f69654a173f955774eb819723
SHA51283bbe0c5a96d5fc2501eb36c104b3ac03100284d68ba8512411661f55998a1c6237660431000bbf9ddfe1518d5d26fa2ff1da70f9a2d5b05417d259a48a5c31e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD51e9ef708cb2e73e9d5db84e2fafbc64f
SHA1bfc8025efc6a3bf716a7c7536613d69b9d85579a
SHA2560beac885a7e89cf3b817d31896e0e871a56aabfbc5f5ae48fa6030121140ee01
SHA512c37665b3eb8cd5cd8f414faebf03ede1693922c35aae022b9ffecc83141f302cb3fc188b8e90a0846203e7421fc19bf7a86bb4bcc59757c4761df12d870f4826
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\Cab592B.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\Cab59F8.tmpFilesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\Local\Temp\Tar5A8A.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\U6YXVCU0.txtFilesize
605B
MD5c62aacbdda3c14253adc598bd6ec3ae3
SHA1b1868b93d69c76c8e89982f62e9f75a470ee1fe5
SHA256e701558c55707169b19cd4b7881dccc2dc635bd54d4987e714da61ab9fc21f3d
SHA5125d81d87bd1b3fa3e15394a78004b5dc6a658f6fddae40ece8b146b38048dd9aa5737d4ad6911997c6145dbebf27dbad98351798b28f7f67faf881824ad804131