c79f3697cc8671dd38370f3ce88dd86792ee0f183f0aa4cbdc1603df4eba2d8a

Analysis

max time kernel
151s
max time network
143s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03/04/2023, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LeagueTagsFree-win32-ia32/LICENSES.chromium.html
Size

1.7MB
MD5

05be51dd8a5bae9490d9752f4feff590
SHA1

93fdd381b15f479a24a2525c717d75765b7b85f7
SHA256

fa45b5d0137c5546559b895c0b01cc3bbf0195feda35a217491c234ba51438b3
SHA512

ca0c0757ac47a9527dd25ef7ea6bd5294e39e045641142efbfa6fb875d740f4a7ad768fba963775db1d5900a50c93400c8ac99ce5bda97ad4401fb19661ba567
SSDEEP

12288:xm3m4mqm/mfmgCHzA+Sx2cXrDCRm0FtZZmS6h3BbZrS7Ui61GQqbdWHzW3F17fWW:4mnLiL4uHwvudBCrCr+KH4clkUzsQqB

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000168921cdd0012955f17a05661ad413c46c36032d7bf9d194cda78e31ea7c08ad000000000e8000000002000020000000a9229683f6c756d05dd619520a9090b6ee44a152594a20abb22c6f22c4a500d920000000d36cd1a89e1b43dafdc6ba21547af480af4073ba73dcceaa6cee57d522eca46c40000000421dfae1096f8d97e2502cc90e9ba16360376cc5ca1036ae2d36b4a8af5feb4fa8cb7c8d5cc5e72566dd872578894c1cb259778b3c7a556e0f623541963236a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A324F701-D1E8-11ED-B5F0-D28FF4BEF639} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00854b7bf565d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000b932560761a5218ac05356e221231245984b286c5c012618572b892ca399a21f000000000e80000000020000200000007d6e6beb9ac2bae620c29b0787f9c861d402f39dcbe7e8c5ac76f24329dba4109000000024cf696f1e9ddeed8e52d2cb0391e1e95b28186e4037ebf83ca1d134aeb84e43a42b86718f373c66fd9857e58bcc8e9628e2776716c47e0f4a7fb7145b02729848b6d80ac4f0a5308e206990157cef636ab678c0cf494e180c2f4cc2b630fa417d784a849e333274bd11122ae64b64f5afdfc5a33773f4c5a0b6586dd834cbc9d2412b4e7fefc069a003130fb3ddf3c740000000d357ddab98612bfa10aadd8877e6e35d4b7227bfa84b7c156bd6a4d472689e832a5a0368f14334c359ca49996c23e02adf00da4751d624c14e4cf07bdc495e6c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387268238"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1168	iexplore.exe
1168	iexplore.exe
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE
1104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1104	1168	iexplore.exe	29
PID 1168 wrote to memory of 1104	1168	iexplore.exe	29
PID 1168 wrote to memory of 1104	1168	iexplore.exe	29
PID 1168 wrote to memory of 1104	1168	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LeagueTagsFree-win32-ia32\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdae73766cfb937fc4c2f8447fb89cea

SHA1
b1b8b507c152f506a1b4d5c0999f653610e6bd76

SHA256
f5fa45893cc212ac0200c62dcb5710751f3737554aad3f8f09f7b23df660c902

SHA512
d45c1fad3a2100b0385013232dfb5b24997dfb5511af1a8128f56c3ff719c1fb46a6ae5081e7b2f7dd87754e5afe73cd8698c8b57449a376200685c4038b81a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7322651959bda4817b44b039f682223

SHA1
764757975c86652a5a588d44a6be72b04b410fc0

SHA256
66b9c68ff880eb0acd5251ca8b356940d3fef8d98c670452a410ab43ba303c81

SHA512
1c433cbfdb187d806240f763f97cd6011c35a8b09600f7ab024972d235243a64dfc1d7e28000cebd0cdf04078aef4a7eb81f73d75d0fd7efc18eb39cb0779672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
904110ee99c0eab458a9e37b92f7d08e

SHA1
54a03544239297c25ccde9ea0f13a855337ed192

SHA256
e65c9a9ad6ced4945b5cab2be1d6ee7327c6f302c569968c930831895a644fcb

SHA512
f13deb577925c94027afeb4fb04279030ee0722838c0168b1fff3cf4798e1d5e0e9bce62d6ba65db55ce2f615cacd6c715b08b02d6321a392d2aa0b03514f7b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18bec3e91e1989fa6bc6880b848e4e7c

SHA1
5accae5ed932cc985c5db782f2a354a281f36ab5

SHA256
63af6f608c79bfb4c492482a95933ea3af628e3ea096dd08ec0bca2e9b43ca40

SHA512
c1841cf7dc73db261f25d8e227653bae40d983797e4ba4ea7042e090e58ee0b84191a555386574c04c05df0cceef7dad762f48f50f9cb39932f380fb89057f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b57a528a85a5df8e3f074d92883d39e

SHA1
18da006e78777c5b3bc5114e5344f3ac02253ede

SHA256
eac079577c0003d926d59604166d5754e416477034c4eaa1abc66c44ff6911eb

SHA512
1ef43fb5bda9085a9c1a96828ea0b44132fb08d469bc241262e99b340af95e8b04a744cd964c7227679f1a56b37dc3d29b31929d3997c63ff52a6f8f55e783fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b70ac238eb3f39a179c6ffa24dd828cf

SHA1
1c41c045b75f31f7bc981357562c2868d466d46c

SHA256
b3f2e57f5a2865744eb50fa6bb16f00a524a639827cb4b3f8be872855a752db2

SHA512
b56349ad239bef4c5d8074d9ac4bdcfa6493adbc9f850c4bf4026f2f6b1f587db6c7bae61ecfab6d1538cb3b18adf83f01043361159fc533c7743e6d727bbb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc0878c749159933bf92affb7a03904b

SHA1
0a7ba0ef649da6ccabcf336345998f531db1bcaf

SHA256
313d0436184be97b30361a66a369d3f35dc72598802681b11d882a61c3a8b4cc

SHA512
02b764ef1f111f22e5ea4a6a1a454472d9e8fe41872ce3a4d4d9847800f6fecb599c8c41f86a9bc274dbb5f1c70ea40222a50afeeca97c22897814268266aa04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1e02a9595ccf99575af652d6c988fdf

SHA1
86ab0f318728c9e7966c532b608ee0d10416cc7f

SHA256
b4daec144b1de4dd6d21765faa9849f1f77bb61737899f2efc6c4b33635374fc

SHA512
758e0d4a1c1429cd987d62bfd5d6b6403c1f70a86c4e1d0e59268fd50a7b457a855b1d3c2792fa9797f4812763858a86e41010846768b6695ba2589002dedb04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f6a60981a90ab024788d082f046451b

SHA1
f7ced7ff221b67bd275c62faff0fdf1f73c13271

SHA256
4ab19c92e4f0086d051cfc530667a18d0e434ace2ad79207eaf771891ddd25d4

SHA512
b09a38b2101dd01df526f9f2d29cc247323dad7fb4744b412bce7d2aeedc3b78a5e60b5dce6c7a2164725c0b8f85edd2f4c9009a3e5feeb2ebe1de81639c8294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ACT9UUKV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab588E.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B21.tmp

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B76.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GAAUT6R1.txt

Filesize
600B

MD5
5292633dabdbba8bee7702b5a48589b3

SHA1
d7486e3547db9499bddef745c8fee48ce2238510

SHA256
7b1e8ba2efdba40b09c506cc1efc67881f600443d9e2cb47c90efba12815d510

SHA512
6a6e38103b28cbdf62d759387067bc108a5ac0f60aee66633828b5f0225604c73fe65f2c211cbfbf31a5f7ee97da5f0a24f81ed9c3ca60ea19ecd8c111f85f4b

Download Submit