Analysis
-
max time kernel
53s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/05/2023, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher 3.0.0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SKlauncher 3.0.0.exe
Resource
win10v2004-20230220-en
General
-
Target
SKlauncher 3.0.0.exe
-
Size
1.2MB
-
MD5
32c7e3347f8e532e675d154eb07f4ccf
-
SHA1
5ca004745e2cdab497a7d6ef29c7efb25dc4046d
-
SHA256
107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b
-
SHA512
c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2
-
SSDEEP
24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809123f3d986d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f00000000020000000000106600000001000020000000ea3919ce8d8bbf46c700c8326923dec9e1245a1616a24466c0eb138cfedbf4ac000000000e8000000002000020000000d3e18e9ab8cd44443cef86fd3e09ddc4531263dc48cc4767eacd07767e573ccf90000000b01192a6fa3135ea50f2c7de6e62d5ceac37af5301ee362c3691c048488a2bb6b86166a749a562fafcd6a90b18aefb14e085812a7a792ae18504957b48f328616aab52d28f24657d0791bf5fc74f2cf95f3500953d4247c6e7bfa22794ac7b71a65d8118568d7e16671d384df7aebd6ca72c109fd128fd533786bc566098267140de17b948e8e0021a6eaa8cafbc2774400000008c6cbac60bf73a8aa4a31a9054553f0f178f17a747b1a938c9feab5ea42e7e66b49037915b25d9fdab88d7d79a48af9d156ad2afbf56618a1b0a0fa1dae6561d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1646B701-F2CD-11ED-A458-D6914D53598A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f000000000200000000001066000000010000200000003b46d76661e9ac51eed14b3e148b1afe7f76314bcd5dac08ee34e9abbc28d17f000000000e80000000020000200000004bec549e95ec1c5cf7de6c54143a0fb481547868719bdcd4f7164ec15e8d307e2000000000e9c22c6b0d3af61d7b654af276a80869692e88edec9f99cf5633d37e7d618540000000835370cf5f8645fa517556462358d1d020fdae8bdc97064ddbdfa79893311a14a4ece67b69a51a76d62c6c47e972f4b361d6e41ca75bb56e0a194fbaa6ffbca1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1584 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1584 iexplore.exe 1584 iexplore.exe 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE 1764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1584 1348 SKlauncher 3.0.0.exe 28 PID 1348 wrote to memory of 1584 1348 SKlauncher 3.0.0.exe 28 PID 1348 wrote to memory of 1584 1348 SKlauncher 3.0.0.exe 28 PID 1348 wrote to memory of 1584 1348 SKlauncher 3.0.0.exe 28 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30 PID 1584 wrote to memory of 1764 1584 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1584 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5deee9a30ca3bc5a7d5def29b8ebc5ab2
SHA108aa53824721393e3e578c822ee27291d231057e
SHA25627b23280043424fbc5e7364f5f9e5ac5ef11319f6674d32869fc06ad93a8dc49
SHA51241558f8fd6f04fc3641a3ac5ae783aa46db1e4112b69df678a4b0a86b4fcc8942951b71342ee58e7354e78c7b0d9151f28890146a927b1f78966c2d55e0c425b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5473dfa3eef2c07e6a84aa84447683383
SHA11791587f53765b241330e9dc5759f5a83313fd7b
SHA2565fa60126ff298cd83869f17c8d4bf6bdc7bb6f64b2c1381ece982cbcccde5cfd
SHA512b57814fb6bb795d461cb17c4cd93c7bef339a94a90edf86214702f41e57884b82033752e9d11a017ec42bd8dae81d75343fc0e6b56786a135b106a153eaec762
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55acd9c2b97555625d3a251a92b2fbb29
SHA12c526fcc1b8946a367d592fe006b6e6ef7046ab6
SHA256e841875bc208fcab131c0cd09e6ed30b98c67c06eeeeac177f6804460c529fe9
SHA512d1ad3a0bf8a7dd497ba9b1e58841451a092a8975881d3c465d5e27ba004d10bbccbe103c714f65412648c734640c86e2c43f1894f37cfe1bb21ffd7a21feef31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57932de5797a5fbf757ef6d214e2ef8a4
SHA104d4a423499c7f05e9ab0b42fc3ba38cb777ad5b
SHA256c158a90d6319435cfddce5613e672c50922963c512a6a0aeb31302d4a54963df
SHA5128866d11b11cc047a3f170d958d087dc460e3e3635eaf86f4a4af61d2c497df7aaa0fad594f2c7d37bae19ccb6e3e6992ff18f9491c941560975f8b8230e433bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd34435651a7a20063672dcfe072a8a6
SHA1c7b2e05bc15a0614692496ec67cee5e80da07205
SHA256c63324c1d748b04ede7fc131841f4b08b66bee337a7a3eab20e15c636bb277f0
SHA512fe4f47e40ca27d95899ec9a176eaa7c2b1946f936ac4e9ff620f9686a946a24d383284ba2acd5a4b2399096708c7cfcee69c75f631a9681f3c5a58f7ee9fbb98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b6742f04e368829788e711f688666d1
SHA1b8018ff63415446b7214fe96d9e248183e440901
SHA25637afcd5fe1bd73abd67092113a54a04547e12525edaf7de170f4dd12f332c7be
SHA5123fe9e505579a0b9754e6f77042c885653ce6afab082669c5966923fd89c84e63c2ebc1bc78b9bb0cad3a79b54fd1693a086b78ff1023d6a5ec9dfdeac0b84a8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57abb723091ebc37a172b8077028ba5c1
SHA18e08b7d3f10e13fa43ad87dd649f29c79d169bca
SHA2562c2d47aa8abd000fae8ce8e340d2d35a925b4758ca9e4ffb627fbcb46fc4c351
SHA51219ac7f365127f9f7e83084a35470618f4f5c74fc5f0d98615a419ce535e467a835d179b953b2103c641909c7d4ce43415ff716bb6ad9d3a08e643e04d0997b4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6d38119b00d0571e50a845ff4881ede
SHA16166cde027ebbb7863a88a4baecbe5dee4376607
SHA256e2f0f9f5f815e2e5ffa92eb5f3a678ff8f6fec68c9884871cf95b7d264cddaf6
SHA51273d17ed8efbb3ae98d5865a8d5679bae01168fcc3e4684aa78eb1a39f7091ce28e95c2c14cf08483acf67f1d9c098107d1097fced89cfd19a3da0b07a90d0506
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f27f5a3b63de13043e7666648a6041e
SHA1e6d12073f323f0be19d62e3e6ff15b466a222434
SHA2561e2cddacf48f7f03a649142ec8123d4ecb354383b5a236601eab49dc01ac52f1
SHA5120ef89f832ee76c74bad21ab39aedcc49145aada637e6021b0f45b5854a60505e9872f6051cda2c647f3cec345ff5e786d50201e48269db38957a71afade3adfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eab2432710443ac4c02a404268df4aa2
SHA12f1fe29a9d92097913dbd8d6fd046c5e2ef9787a
SHA25660c0e5b983ab472af87c75544dc9b40b5b0c6fed9bf7ed0add575a12c470caf0
SHA5128aebd265d707967b96d0d1acfb02995addf3123c0cebd0272e55085c9cf17af17cc6bb079a28f7e8c83a545001527c588e1a39320b455b490d60afe6a8bad413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56857a4e7d30333ffd0ab1600674bd082
SHA133da46545314e2f1fb803da10ad1ac09c4f897b5
SHA256650580d76ed314fb7abd09ecc5b8ca5256784733cc98d553c6adead34c380560
SHA5126686bdb8f9164b82b88e6ad67559487414b1102c8784b4d90a148eaa206b8de35a1e71414e8dc47c32eedf51efe4d5e3a4731b28e832f9681f2340691ea4bba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ba35506797eaf30a114d953ed0e3e18
SHA14b3f615a0fbf9e40f45a7476d427b8a4410777fa
SHA256f30b057a311043ac0d5b8d45708f132f27d2faadf8dc12f4798353ad65428006
SHA5126060d7ccd194cb87e662a689a6c6c94b2422a128de9f4f877825af52e417f02544a70465890ef2088f0fc4db51a536520eb5269792f893606a935db18ce26412
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b597d0adf5bdf527a3d85d67519669f7
SHA1db9ec91f0728fa523cf570739629aaf223badd34
SHA25622323cc62b94ab917edbf0be0fa3b31700cddcc029c4cd2dfe71be3bb1fbdb95
SHA512a9ab10ceb0528b0f1944c362e50212f15e6298eca194239d1538094ba82acd72a747a1303604b46c06a261b903bf3682882b12092211ac7fec31ad5cf25df067
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d012ccdc5644f8ac2def7fbb735285f7
SHA15ea030565738fd002339fc74c148724785970542
SHA25687e07da3516aa57d8470b45261d4bf4ea055be577163e32543db468a6b5175e6
SHA512a795252b120d226bdfb1b3b0b41ff876003cc81fd9e6978da4c864b1d2c01f4728b3060201e757573ef89204241f4a3afe32acd7ca047a91c281385123fe17c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562f5fb1a46b103e4ef89c899a7ff2546
SHA1badb21af2bf56de4b2bdacba70ebdc41648fb876
SHA256142b8a6af2f1872093b6f9877bf59b9edc56c9538e0f3df21a72229bd881b58e
SHA51231b9aa0652f3c6a26e12ecf56b3624750627e545370b6e2383d2eb6736ed5dd96f03421e0f2117e14ae9ee49bca3750095ca01d92b3c19a132d7a27a7d7c0495
-
Filesize
7KB
MD5191bf7f1272d9831156c86b7295c0983
SHA198522f53b8a48df1680bdb6e7a4e0eb31434089e
SHA2560d0fecbdbc2bf211a677bab9c9dd4cff459d76b7e9a44c1d2c3742a02ca157f6
SHA5121366180a282ba2543862df0ee05d2c546419e40f83ccd675cdfca1a4b01ed1b6860d1f8ec9d6b38e69cc8cf72c9ab9123ab18c40c973cd5989c6fb456abfe3ae
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEOMB6VC\favicon-32x32[1].png
Filesize2KB
MD5dfb98b35bec083cddf7e575ccbc12efc
SHA1f77c5e6f37aec582c5977a76691f992e3ebc3a05
SHA256f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66
SHA51217d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
16KB
MD5d6c9aa1fde88ddad6596159f37b6dba0
SHA1bc883d8f3f2c52e97ce1a2ae84234592ecbb3bd9
SHA25608f96ab2738408119e7171100dab55746996100cccb897ed9c9f10ee6cd9ce50
SHA5129ef6e99e7106f1ca9aa892d07bba70b44d489256366533a26d2f8a6040cf77ec59019fcf783bedb49bb00d81796ce3a7b15556b51808299bb878ee54e65eccc8