107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

Resubmissions

02/05/2023, 18:56

230502-xle18sdh8w 7

02/05/2023, 18:52

230502-xjbwssdh7z 7

Analysis

max time kernel
31s
max time network
42s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/05/2023, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.0.0.exe
Size

1.2MB
MD5

32c7e3347f8e532e675d154eb07f4ccf
SHA1

5ca004745e2cdab497a7d6ef29c7efb25dc4046d
SHA256

107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b
SHA512

c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2
SSDEEP

24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D65DF221-E92B-11ED-8FF9-7621D5A708C1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
468	IEXPLORE.EXE
468	IEXPLORE.EXE
468	IEXPLORE.EXE
468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1964	2020	SKlauncher 3.0.0.exe	28
PID 2020 wrote to memory of 1964	2020	SKlauncher 3.0.0.exe	28
PID 2020 wrote to memory of 1964	2020	SKlauncher 3.0.0.exe	28
PID 2020 wrote to memory of 1964	2020	SKlauncher 3.0.0.exe	28
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30
PID 1964 wrote to memory of 468	1964	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6997745524776bc11ad35ec73e13f85

SHA1
4290c6ccb9ee328a722dba0dbf4b711df032871a

SHA256
d6ef8781653dd6fcc83f60079a264bcd6158527f1b6e977b09b06e4ada54a67a

SHA512
fbb6d08a93d341b4ad0ded97723bebf7081fcc81a42b0f2126bc30dad998c45b3b8a5a013de1af4b1bd8476025d4046a8d6501d6df8598db3a79ee48cbee57a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1daa49ee28f08297181a1a162c39cf16

SHA1
a2399d0b04b93c15aa06c7e92a95e65cc2b2632e

SHA256
c93aa9b1b0f4210c4c6388e18b6b009e97b13f50d5e7fa34443fcc31214cfdb7

SHA512
497e79ef9e0e6c0d72dad3478ab3bb63c315252d0481cddc3ff8a359051ef644f31f5789e7ad5fc6792d90ec8ff1a792537f88dbdcfc3aab45ed8d46516b853e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4b0a928aaa453b78b8b7c6f730a2d79

SHA1
53e6a690b40ab8c2ee7199e016879a509dd0be44

SHA256
eb058afafb6f8979c285c1e2069b5df5ac4e05d4399fa0a3865e8bc565f7c1c6

SHA512
42d715a284eb0d06921dc3e15004e653e6fcc1d87011fd7013daac76a7c3d7f9dd7f8bc3d7af81a39e220776a4feec6e98e8fbf583de1ace903ffbdd4a09cac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3351b9644623a5ab1172f43fec8010

SHA1
2d448d2b92fc44c6671c999c51a547b0e5874f98

SHA256
32d95692c0c585affb8daff8799dcbb61c2e9d8c2d8ae71554bbc94d761ff76b

SHA512
530711e125a5588a0118399fb00ebb30719e088e2967fed6c525a0e511ccf92d436afa31f418cd79dbaa3813eed36aa8b6925fe8d32610d5db92b11920308f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c47ab5869f90c9f12ea5bfb5c09d8934

SHA1
948b1ee654e4b36ae5cb3c2248ac632f9ddf7d1c

SHA256
63c58e969dc588d443d25c59ae0a704de0d06965d33fd03c4539456f72e7dc21

SHA512
195a504da912b3fd4de0a44a04264e4be37d72e6ddbb2cc60bc106d40296296199b5a9e61f3099f90dd188aa47f85b9f3ed46a15aff8b18493a2bedb052448d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb0c05d2573a14f3c7ac4add7dd7f33

SHA1
66cc1fc38d6bc48bf23426834c57996d8bdff4e8

SHA256
20a148dde7e498b641d89c9e996472790893254762c9f585adb055800fdb7d63

SHA512
3b35e720b3205ae970fb173389876b098a686f8c09f309a368231dcb54f835d4b3719aab6becbfb07ed9f8a5edf8cb2faaff7b6ca5821d0038cb868226d92779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9a4ed0c609c5e7f3f724c4c0caec6f8

SHA1
d010d86f27fecc3051ffc72d0ef15347a07b592b

SHA256
f072935de1a567105290148ee5e8c65c1bb9fd7633ba29279cba4e46c66c6036

SHA512
8783c3294800f40bc95b22b55fbe8da6132ec9a4069ea6ba2fe8bdb74394315282ae14509040593f8366dd58559a30f210b8b39b4583a121ff6857249a2e36ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7d180bacbdabb8c9a05ac70f773b2bc

SHA1
b36cdf9ba04ecc3c5e44f1708119e0569c0dab3d

SHA256
42564d375e7a88be84728a65bf0ea39061411a268a3c805351ab498c46ea4ca7

SHA512
7b5770ce20bf700b133442e9b6a8baf2d69f8308239976b7c933b67c0b29d72eb8c608940cbdd5db54ce9b22df1c6ed58b0514fc481053bdcd0db0e4fe7e26a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17848e3e10c5fb484454e09f4cccc0ec

SHA1
31d787eeb3befcb575479845aac016dbce47b10f

SHA256
048389297a4ae760d018537256d6e36a8c69bcddc6f5fc258193d2610b29feef

SHA512
2067b0a702d207477f2ad9ec27afa806bc3b3ac79988207d88eb917b7acee5bc7b4aa52af7bb5ab1b02b9db6ca57788fd5caa1aeb9950b49432265968ef19260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f837bc4a0414313c3b280b940f63061

SHA1
512c9d43b55a2f23c80296b89bfb69184354c4fb

SHA256
9f1f79f940ff6cc57e81afc14d311a0b150e56bfa58cf1d58166e0fc3642a25a

SHA512
314843df2ea4ca5c231f7bb98093752cb6b9a076c0c852b4069cb68e27e14e42e4523ea30a16e971085d3f88019713f010632db1fc59229aa6a8289dee5b3c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872494b78746cd509368b364a44b3c4d

SHA1
c8171d5b8391da61ce6992edf022385331780947

SHA256
4dd32dfca2261449432e8cc1a8341e6a62f7ba2edd9bead1ef772596fea3506d

SHA512
9bd57d751db67e7b40aacb5d3d16c9b424efb04b98228fd73a23915d5a813b252cb5a4a3270742c729f9fe28561d4e655a5a40a0fb7bb04dd44525a0375b13a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4589e7a4737e103d38c5b84d8173c7

SHA1
be163b68994a791cf5921ef33b757b5b5cd9fa01

SHA256
46e73a23312489a758c1c37af6546ae77dc59bdfa38dbd73a35505e187e01077

SHA512
c3fb9228914943d0ef7258e5951a6871b1495ce812cd9c23e8afa4f85cf8a63767c412ca9ff2784f12bc2668d2eaf59dd4afe367a1aa85936b05ee81ae2b1d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
971dc74ea7c7207db7fc06c85e93ea7f

SHA1
5756a75f55a38118156f2720c5c0dddafd469e6a

SHA256
3ad39280e748b9ad194aa7d476f39ba5cb83cfabd0e1e42a5fc0ec621fc77a15

SHA512
f560628dc78d7aed60949c9a25c66b22f1e17c24e7a8c7597982124cd3529d1165b655486717178c6693e4f64999732a83bdb1f6b0fe548bf19a7a233d7dcdc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9077f9d396a369ddb8dcf23c86a46f54

SHA1
5435b3356d6827eee259d216dd5faf6c8c9d01eb

SHA256
c436d0400425401553fb3721ec80c2f9cf66498e0cf99cbae93b9d494551b003

SHA512
daf942d3b35f26629becee18cd97c2fe08d5b1e23980118803233fffc29e10d56fe2141afac336b85a024ca67963de5ca56282297c78dc4a270b5400300891e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jo5ozfo\imagestore.dat

Filesize
7KB

MD5
db5893c752bba9e6291ce9d2f930f066

SHA1
145c9099ff948549d2a62ad3475b1c8084ee5122

SHA256
9a48fb7c0c58835d5f707fc230b3496218df4afb0790f28ab541963959dd5b03

SHA512
e3b45891d2c561234e3bf82f3dee1b035f0d627cadd2222c94b293ad1745bfea18747689ec676631ce36dfb02d7a6dc8522b958bdea772b9d2123eda1b988e45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\favicon-32x32[1].png

Filesize
2KB

MD5
dfb98b35bec083cddf7e575ccbc12efc

SHA1
f77c5e6f37aec582c5977a76691f992e3ebc3a05

SHA256
f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66

SHA512
17d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4210.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42FE.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4380.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/2020-54-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download