Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2023, 20:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://igg-games.com/getting-796111196-bennett-foddy-pc-free-download.html
Resource
win10v2004-20230221-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
https://igg-games.com/getting-796111196-bennett-foddy-pc-free-download.html
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B8554CC6-07C9-11EE-8227-F67C60D77A32} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038422" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2361498011" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304d9991d69bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\igg-games.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2361498011" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2371838736" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31038422" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31038422" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40deb191d69bd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\igg-games.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d15324f2d8180c4ebd9b9543f0ad3bd800000000020000000000106600000001000020000000ab9874a35eef6ed58466e75c19b51505daf34541f202220dec521d81d20ae3b6000000000e800000000200002000000057f54461c14d4286d3a220d3dfb666d9fcb0572671f9b420a1fe658e4dfdadd5200000008486c906856e2240aa1310c59a6ade1de819a9cbd28f769d9438fac70ee5477b40000000e7988cf3933ec700e6c652c3e4249ee5cfb65934581489ce27e215e1e7bfe75a6bbf34e44059a7ec8acc7166bd4e32e466232d2b5cbeda825e14089133b45765 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\igg-games.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d15324f2d8180c4ebd9b9543f0ad3bd8000000000200000000001066000000010000200000007cbcd45722cf08b42ee4ca90a71191152f35f31f35b89994cd1cc684d1f5957a000000000e80000000020000200000009ecc67934731f9780d3b2097382616be7c8aebf1a3cc397c15e898e356baf85d200000009d34135c2047e948acc132eb093f9cf73a394079568a97b3a3c2b85189f0fea7400000001402087cda2b51737897039998c3e28e2e50b0da0de360049f560ab8f3074d078f7b8f66cab33a56c773183803fefdc31e206caa487ec81ba90b4064ff4002a5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393192321" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2805025096-2326403612-4231045514-1000\{4364B845-4FC9-420C-B00D-C727BD5BEFBC} IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1972 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE Token: SeShutdownPrivilege 1972 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 1972 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4628 iexplore.exe -
Suspicious use of SetWindowsHookEx 26 IoCs
pid Process 4628 iexplore.exe 4628 iexplore.exe 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE 1972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4628 wrote to memory of 1972 4628 iexplore.exe 82 PID 4628 wrote to memory of 1972 4628 iexplore.exe 82 PID 4628 wrote to memory of 1972 4628 iexplore.exe 82
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://igg-games.com/getting-796111196-bennett-foddy-pc-free-download.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4628 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1972
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5f555af3f1b663a55df56040069b6097b
SHA1ac566b3ec3882b349616e37dcce15f1470496361
SHA256e9a0504f3aaee42e85baf24a611a6c237ba0de8c974cf2cb0b9f26913e445d5a
SHA5128fca6bdd6356875a5e21d988cc809e6d062c1ee3271293f837968138fc4f302c5457707c4152a62b1ab8469c01c90d4dcde80bdbc210541ef12d151ff6edf1c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD530cd46f0816d2961c270e42badae397f
SHA19d29aaf597c04de1900532e4b2359b3b2cecfe5e
SHA2569c90309d3306f3111c5f49d82ba31dff143a7d022ca2ef639e267c45c949c936
SHA512f80364b353fb0ab67eef49a7f7bd6d74036c3b3e8889ad45cd0a61a0bcb73b71a48e26585d760b32ccd31d1e21093cf403c67fae3b3326f11bf4b19754e3b248
-
Filesize
15KB
MD574f37ab7180760a7c3eb37b0726dbe8e
SHA1eafe55b094854358bf5f982d3a85a96734b66dc0
SHA256e048fc22b3d8bec388bcbca683f8e9ff6c0d4e5833e590fb8bd46d1227346ecb
SHA512191b9126cd7a81668e0e09f3d516986e358d07bfef13844e4a798dc09480efb12756d84853d53d2f00b3bd22a0e2e025fed744e2ace8c62d61b95a9747a3c328
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
15KB
MD514296d11f00b928cc690302ea5dafc1c
SHA13d6a257a43ba276fe6b7af01bbc3649dfc4878e5
SHA25624626df01332861216d016697102b11ad71e431a87c6c3df5c6d32294af1d8f9
SHA512a5007c9b53eb0c9a477ea5c801ede1f293107075dae4773aecd3c92c88bdd6622662429b3330cc92b0c835a9305ec7dfc9b279e3c1386369ad2527a9427e83c0
-
Filesize
24B
MD50959ba36d476b6dc1994ba3c678b07c4
SHA1d30b94da72daa02766965206a85b7e0356375f5e
SHA256897410b87e27e3dfba3a7d6caab315a5e69cc941bb96d91fc74878a9b051843a
SHA512843f2144ba55d59ba3e62053dc018f4f6d51ae482c741cb4dc85f7af3375b77c75f66e2e73ff55ff7fe3b79314e7ba28a92fddec1ba17839ba33b34792bfce22