cec4533f74a2a8eac82999f885ed865dab90f751a081b176abc5c1af9bc38acc

Analysis

max time kernel
115s
max time network
169s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
13-04-2023 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Geometry Dash 2.11 By CpuTutos .v/Resources/speedEffect_vfast.xml
Size

2KB
MD5

ff07c8def1602f53db09ed5544fa07e6
SHA1

9f1750d686223b6b00e4cdd4873775402329a777
SHA256

c94386adc56b394bfaf3c0c94d14fce7f5a985d9ce560adc803a7c6ca7fb42a6
SHA512

9311be7b0beb128ded6aa47eed0bdf489ef4a0d70b2b92129a8137a6854b1d0e1164945472488714ba64c5d3036294835ad491d91e3ee61ef9f212da166dc182

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a000000000200000000001066000000010000200000006b8079596e51aa8fe2d12ba4b244934529b9ff0e7713d440abee6a94811d4f26000000000e8000000002000020000000058c0542474d519922d380e78d8a292dcc8ae2862637030b0ea9c905fe10347c9000000025902936dc8651cd12002c06283a448d451e892cf1bd7b613bf4414cd50b54ee280a12a4673de0735b398ce926108fda8eeb3dabb8508304c95f8f47522836dce884ad8f36b4facd56b449c0e6bd446688a938109310c5c42ef0d3874e674e468c73494dac5bfb089707aa37e853067ad5e58a30d0910932ec3c28af02031f84e79a390fa9d77b8cb5b6f3067d5fee9c400000001b992e9f48e0dd52f80ba49b5a516ca10e249a872394b07f9db65cb636d3fcc3f2b06a1f45981ea0b1343bdf37b7aa20a17cc6fbdda9b8307a06d28b3b2d85e0	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388130700"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fba6cfbdd4578d48a4e75475bed73c6a00000000020000000000106600000001000020000000357fb5f10ee89aa04a13d80a7de214d91ccffd457c6a3aef4b3e2d93f1f2e089000000000e8000000002000020000000b3736214252214080a8317034ced444b92c1dc5c1ddb14440b5fb0ad9ae9336a200000005454550b0c706ebb7b2ac7d8fb9aa7b120033712f4c01f790734fb1d1233af764000000071c8ab6d02ed6e4d45cecf6fa7c42e0f7e95c81ef6cb99f8da08cd6fceea21a02e1c753426f91c4b9c792b76c603ebbfe29d2bcd66a4895a8325bb262b5a054b	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00ef987cd6dd901	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0FA2871-D9C0-11ED-A0DE-72D88D434236} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

660 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

660 IEXPLORE.EXE
660 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE
588 IEXPLORE.EXE

pid	process
660	IEXPLORE.EXE

pid	process
660	IEXPLORE.EXE
660	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

MSOXMLED.EXEiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1776 wrote to memory of 980	1776	MSOXMLED.EXE	iexplore.exe
PID 1776 wrote to memory of 980	1776	MSOXMLED.EXE	iexplore.exe
PID 1776 wrote to memory of 980	1776	MSOXMLED.EXE	iexplore.exe
PID 1776 wrote to memory of 980	1776	MSOXMLED.EXE	iexplore.exe
PID 980 wrote to memory of 660	980	iexplore.exe	IEXPLORE.EXE
PID 980 wrote to memory of 660	980	iexplore.exe	IEXPLORE.EXE
PID 980 wrote to memory of 660	980	iexplore.exe	IEXPLORE.EXE
PID 980 wrote to memory of 660	980	iexplore.exe	IEXPLORE.EXE
PID 660 wrote to memory of 588	660	IEXPLORE.EXE	IEXPLORE.EXE
PID 660 wrote to memory of 588	660	IEXPLORE.EXE	IEXPLORE.EXE
PID 660 wrote to memory of 588	660	IEXPLORE.EXE	IEXPLORE.EXE
PID 660 wrote to memory of 588	660	IEXPLORE.EXE	IEXPLORE.EXE

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Geometry Dash 2.11 By CpuTutos .v\Resources\speedEffect_vfast.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
2⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:660 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96775e4e1ba627d396631ad250e71906

SHA1
ae94f57380ef83a07894b64e0c80f05e0f1885fa

SHA256
1e17496a5046af30774f87402fb1f22490596287baa9f4f9d7c1917a85fe95ee

SHA512
8b74ae9a49ec65f2d31a1b3fbd2905ee5240242dc732fd65ca04fb27e14c430f9cf8dfc324b7e95d2af4e2768a5ce3a7aa4e0c7aa7288e834687df66a7117c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3a93fdb915f5104ad8426ef485957fc

SHA1
74a41bcb8abfb121bf368bbb928cbd4500239865

SHA256
4d760f101b408cc6de7ace266dbaf2bae5ba5b7bd876440dc780a1ddba576a3f

SHA512
44b318693b0b270f50ac2ec72ca7380b1063a56462112d07bc7ce21ce0ae047ae8d86522de9266d81439ccaf3cfc4306d2692572fda9a3d1fd629bf8da97cf8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4476997658755b57baebc0f16ed96b85

SHA1
1b50b8f71952be51b721949f06ec9ae9edfd1942

SHA256
6a81818e45cd0c2b2bbda3cf3abb9fe94be307df62746afc9e29c4da7e0f09a3

SHA512
5dcaeaa5b13afe0fd724accd04218091e17e6daeb5b7242395ab03c2a0ac3b90665efffa51f645218decd4a36a5b1fa45b9af5f2013d5f05641cdcc9a886d5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29b5004f958846cb6639b4e1991144f5

SHA1
9895c2c83375235cebdb3ca8b61d4b0d52646656

SHA256
795fa7c89f7c20a1abc7a65a8266e6046ee455c4f7ac8e056d949eb71ba03689

SHA512
0f5a0b1637bb924f9341c1f3167d9a95c35f978690c36866db3239033decabf4f1bf45dba3733f377e5ccccbe96ce8a352ffb168eb730ccde87152dfbf99c632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df9d4ec5c265c9daeb780f96b427ebb0

SHA1
99970476e42fd9c0d6e83ab7dcc8d4f33989753b

SHA256
189bb9f92a861e4c63f45bc26a37e2e8061270ac5c7055c4871b9b9aa45390d9

SHA512
6e36b8fb4e33400ee48ed981d5569f207bfe575d889c6d2af0a523f5c1e302b4bc807b75b556c813687e7fc91129b2df50d0c85aafdb98dc2ed8f3ca08dc3949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58c02b14ab55fb8224b2b78f354cf5b0

SHA1
040f220234c28c1dabaf051be1cf98b2f304a2c4

SHA256
dd33169b7efc1fef7272dcde3f37d161ed9ba7c5d9f445d0e0308d69e45cee56

SHA512
44cd39d404e841d69b7168bad26cea35e0cde9497b2cdaa0ee93cf941c63a7fa41c3d0fc9bd2ab6a567ba3a882af07d14a304223e1c906856826eb1725df24fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
588615aa1ece41f8f0ca7d0130fdd61f

SHA1
3236f1d3c81945c456f163509089dfdc2811b79b

SHA256
0e5e3d63f57dd3d1d4f7417856f6a65c1e191c52263e9a9e8e38f0cf045ecd56

SHA512
50204a61a8910a0cf3e8f4e3d044621a3244196a4485fd39a0dc2b8ca682b6f75abdbadec46e551aa96de7b8bae977123cf6112f3cd0156cecbda352f2a29178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5810e93cf652f80c4171a8361d8af72a

SHA1
a7fa425db6f8870f99f2dc995fc2e6a6dea67bd6

SHA256
68c03d37bf183e43d101c7c5b82b70da41e0d43e72f56a366edd1cf42a72bdce

SHA512
3e0e681e7bb86079e36f48053cdb7ad7bc1cd68a8ce8efd926e7540d89a2681a5fd075ebb32273e814bb63a19e4dd8d5534d8bbf2fd466bef90a213b47b53e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AFOBZ3YS\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D35.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9181.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\56Z65X7Z.txt

Filesize
600B

MD5
f36c8396dcd221441c7be9265d974dae

SHA1
15581f03ab39a282ef6d18c3c73ccdf6cbbf6849

SHA256
c4c5a618c27ff736b39a32fd4567620fdffeef7637c03d62ad44db7028ef5d24

SHA512
dacc3b3374fa8e7e5ecab99f3db2c15492b42ec5c61f1933316780638f47635ff316e4358633d65a0916eea7b1362c0f538818512e3520a2169f32bffd09e246

Download Submit