a8bd64141498952951cdb152f23e2edc7e43d5033af1534c92746f3cd51f40d2

Analysis

max time kernel
106s
max time network
181s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19/05/2023, 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Minecraft Portable/Minecraft Portable/Portable/Welcome.html
Size

983B
MD5

6ea5a07e6f50beecf91d79b48047237a
SHA1

d4d55232c69d2c9e0cd48eceef43312479d58541
SHA256

fecf1dcda3dfb3b91996a78c9841057bbe65fcfdfdb8ebca96b67440af435b40
SHA512

ed1eba21290585333fc1bc810bb72747f299516a0f575e4439ed33c6cc93c12f8834638e608c496eed2cd544acd48e507f4ec666d0dd17e3e23d19350b7043c4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c000000000200000000001066000000010000200000001c82fb4d121d659c44c72b783166e868d88cef1eb9319dc106772feba84777d2000000000e8000000002000020000000550bc22635e3fd4ede73c4bc22a6b333a2defa139f012798df7982fb1e69a9ff2000000049693df10aa4d253fc42eb66a5a03a83b3fc2286be5bcfb0830f3eb8c17c068b40000000e42ef4d6b4ca6af0db636e4c4f9d08dab073db08966cfa0fa0afe177c374fb47ddf7ac2cb2faf0eedd3376bcfd1ead7519f9f2a515e50b9c5fc73f614f4f772a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000f18f722a3d2794f3d39584ae6be9547851e3017417d24312b99fc7cc95619000000000000e800000000200002000000016d2bfa65ceb9764f8aba15ea4a11e3c858281eb761af032958f4d9d4f30453b900000001a03684f78c17399c9c42583b710c270b62a80e93707481808e2b3cd6f8c390e8431cf680236ed554560a9aa47518fcbe6b0b600d21fd77657eb8e75896172ef85682a4ca626d65b8fe253d4e1b7b93dd7687114b2488df56beb641a59cd226cdca8994b2d5c274e1f47fbb1feb72b9230c80de6f79507772a11a2c92f7df0c065417194c580a5e95898662baae1a9e040000000c800d64b96f67bb8a05f7da4a20fc85eb8d1bd3d52e087291290de31e2e17d6c52147799d15634dec016e4db237b86175e9fa2cb0f43c8a13782622ee0c8d633	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30d51db9a48ad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391301744"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E03AFC11-F697-11ED-9F91-E6255E64A624} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE
1752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1752	1992	iexplore.exe	28
PID 1992 wrote to memory of 1752	1992	iexplore.exe	28
PID 1992 wrote to memory of 1752	1992	iexplore.exe	28
PID 1992 wrote to memory of 1752	1992	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Minecraft Portable\Minecraft Portable\Portable\Welcome.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3cc77f6d8a4719bd144d6df3dfe34e16

SHA1
82824effdc3965a309efa151f30c7e0043c2476b

SHA256
b60321083222ebfbc699f2c25adc618f0fbcd88db5bbe23c0b4011ceaf45b521

SHA512
e36b99482216d494010199fdd82f97f37297153a9939bb353f9209595e0bcf9f3a3cace0531f79cc16eeb10ab94a735d2377711dcfcf3ef8a46942b774f71863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a4c8fad91e39a9727541fe68d97ed6

SHA1
59d072f8cbd8609d92701de8461e06435b6385c4

SHA256
3f8520f4c79aafe9d9a962f7c887b885ad0c955a86d6119fa6aa0622d12e2e54

SHA512
aa63c0fee36afd9c0559e5287d302f1f5f5ab3fc97af6ca5ae7f7cf88c0f8e22c0bbb8980447264500d26b4be3f8097a86f8d6252a4219808bdf2684c666be70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8a24c224a93669d0af2d80e81999c4c

SHA1
39453f5908bfc0c59567829bca7f8129a4d3666b

SHA256
2ca0106d9d7542daaba5c23e627386467cbf7e4731e4cb6efe3d5396cacc57af

SHA512
5baec1a0c97b49853041e12ffd1129829f4094304e320063f8da22f7d08fbbe1dde81c872d439c9c2444eb469f03a711ffd1a58fe9641d2242e1fca576b8e051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34454e19efb7bb28bf1d73c41364c709

SHA1
8aaca2c7acf890a26b0a1138ff093f87c0a6f2e8

SHA256
5f3b5dbd4231049ecbb896348212c06ffa3953d4f63a767c4e8f42baa1f6864c

SHA512
e30b4514a43dbee72abc3c2fcc962dda47f1654b4e81b67c15c765aef9794d3153e8b90eafdefb90c85ed1d66e14e1b02eed94c785325a70ed23e6e02ddd466c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7517e95a04aad150cebce637cc931b8e

SHA1
e911c82e714cb84b1e0e220355b9581892309dc5

SHA256
d3c5bb1017f6f87f13fce66a57cbf02754b066104e1aca59a6b118dd58f72aad

SHA512
e7b0615d6df5987d1e893f59b1eb6d21278ef0dc105a9bc9994f617e1dad19e79e4d500759ab2df06ae80a4bd6221affe4cd15b6ec26dea1e6514ff36407333e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b9b340aa28f210cba13f50927af468

SHA1
4f3658c05984776c511f443e59ccdfde167b67d0

SHA256
af2ff54c654c3c49c5778a97011a2a7c28e9687bd4c3ed2f0aea686dc3b9d0cf

SHA512
eb58451c877e97e89c2a463c6226d3342d9f3944da0198da976e68b2f0451cac7f2d14b09e9325b8781ad23aa5e0cc8ce25200bb6a394c2a6d3083be6753c1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06d70ee630fc7f4b2e3d70a5d1d5df5e

SHA1
0ff7f8d06ec3ae235ccf6609385832ebbfc921d6

SHA256
666e881485ef7088cdf6f8b670e9b1c252c23be94eebba717920d531ef173ecd

SHA512
185f0d85637a1e0af935614253df9835036bd77aafd6ffee84112c33488bedfcf5e9873fb86d9aa028f6feb42d7b2d21e20002375fe1df564754fd2520ade2f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA15.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEBB1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GXJ7TOYZ.txt

Filesize
608B

MD5
f366de9e86e86ec8ac9240ab9601c813

SHA1
8aa8313a893c4b40762a227fc3c680d0a20d4ffe

SHA256
9a97ba089670655a8889da7876e31a184c446bbf0f68dc5c6cbc78e871a5a0ef

SHA512
350093c3995c39f8075972b9115f06978893f0bacf34fa32f0fad8b52cac460947af146e65138f93ea0bf1dd113fb110f9ea6914872d7e40d12b46aa2aa88274

Download Submit