c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20230220-es
resource tags

arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
submitted
15-06-2023 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.1.exe
Size

1.1MB
MD5

021b53abfc25a261077282498e5726a0
SHA1

ba7f38a28444504e6e8e1f995cc40ceb70ff6409
SHA256

c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620
SHA512

484bb65ecb1ccd3e5472a27737fd2fa4471240aeefcf4bfdeaf4e49636cec9b3e43a5c2feb7134074c92af01f52a456b8074aca8269480e210cfa3b51acae81d
SSDEEP

24576:7h1tjL2uma7hLQKaikK21SHCJ3ny+SGiPsGSa7tLC+/e0cUEcnr:sghMKai1viny6iPH5hF/e0m2r

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F66E16D1-0BB8-11EE-803D-EA414CA8A2BA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
912	iexplore.exe
912	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 912	2024	SKlauncher 3.1.exe	28
PID 2024 wrote to memory of 912	2024	SKlauncher 3.1.exe	28
PID 2024 wrote to memory of 912	2024	SKlauncher 3.1.exe	28
PID 2024 wrote to memory of 912	2024	SKlauncher 3.1.exe	28
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30
PID 912 wrote to memory of 1936	912	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:912 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9327b499b946981906740bd73e86d2e8

SHA1
5291cc8c93acd25f18ddab31fc5eabd87a0698b4

SHA256
c74a95fdc731b11eb61f4e6ff736768f88afd90467168efdeb61d4bcb0e625d8

SHA512
0e96edad1a06c353cc45aec49382aa18365222483db04bc331265ec61403e9b992d39fa034a8b48b538e1aad23b573c2d73cd323ae8176a6e29347ad3d43c72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a98001756b842c5b5e2b752df978d120

SHA1
a14398ad4f86895dd58dd2bdc08fb48b95873fc2

SHA256
a03f7aa26d7aec12b10ab21e908b04f90a5617f7143ef8da5c85403e1e9b3e3f

SHA512
349752c1042343da9b3a42a0bc042cf755157c31deadd18b73e143709637647faf673ac5e9586608bbfded47b85684cc1ad19fb25cd3e1c271e7d5b4df286664

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
17f40cd7746964a28dea373b587591e0

SHA1
588e781687e38ddb2a96140103588737b81eb13b

SHA256
1f9768576fceb2ff9e7aed55d4591875283c4f25410a83c6d7a399e8b5f1d524

SHA512
1f92f77ac6e532b1c341968ed387f7eb29389ef40a44ef3e5224d97650850904d3f62d518fc0422c4e22acf94bb0e20993732e6399787390f50d4a244ae6df81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
67937b8b4dbcb0f4eb7a0a3f865acffc

SHA1
77008e523bb256e7fbb89d524bd92e89bdc7ed1e

SHA256
9a4129e3ebfef6959d03642dd6a2b1246a8078660cd9613a80d12133b756c771

SHA512
c85f2888780960dc7bad37dcfbcd8efc0ecff55825c683c91982d46991e3be91f1a840d10efac1967f938753564672b82c29e7b686f18091d5792ebe088c6972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5306afdd6b95abd29acd6c97f6a44934

SHA1
e9b5e4d5eba9ffc03fbb3113947a9fca35cdc76d

SHA256
d57c2c8235d5af9049c35526c982da3f1bc70dc388fb4f0a3b948c680405df44

SHA512
69cb7b4e753aa207fe3453c2a9ef3f2c767936fcd8f41c407711639400ccdd5ce4475cdf9aa808aab2387a79edd234dad5d6319dea9eae7f84455c1fc86afe50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9e1e1c659407befea3d5faeb3f837fef

SHA1
039fb37a27dcf39e932078a46aa464485233026c

SHA256
a2f6ddde852bcffde814dc4d6edadcc749ee123ae130eab32621f8741807b8a9

SHA512
077d99dc2eb4680293df4422f42b9f63f413295d649d6bab555226bdc60a0c3e5dadd4e3fa962d158c0a1fe7d3943b3c9bd92a450a2b69d2cecdb4e8501fd52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d2291fb44ebb25d830030f0a93a71f55

SHA1
4b2c0317600dd07e4d8f0bd8db87ac5bf8e98902

SHA256
75524acf29d4a9f3bb43181a788fdcedc461f8edaa04102034aedc4e898c98df

SHA512
06336430183f8ff36b05b0d81ca1ed34bab587caef16ce577556cd1c46002509abc445eeb6cad2699aec99fc872f50258eb872dda3882b56587959fd79f5ef05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1861848b0c94f5aca730f11022b26a6f

SHA1
7c77e89e0b43ecaeeb155978ad83252cc3fe61b7

SHA256
c4e01ce691a1057542ab90119b1d353ae8b3a71cfc72b7d028c101ae69dedf2f

SHA512
aae93be891a016ad32ec752ff2a2a8882e782b6c21745e83ffcbe6e1b637624cd4180e916e61a139d90c44f8de9d2ed17846a38ce72532e2030a1fc2341d448e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ac4b45ff31c76df269fb8f98d1642c37

SHA1
33ec66ef3ce417c9dade752d628f8b013957cbc7

SHA256
be03a11191953e8722ec19be115a80603b0aa5719d970091ec47fc87b8b0c1a9

SHA512
7a8f54a66c8a5ecb2015d104bce867b75c0858d6cd8af7821d6cf54798242be13f9fa7ac0cd05570ea647eda4018816c657fbbee8cc4aa19f768c7f504b48b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c8ef565f1be1ecb1a0a7766849fef368

SHA1
e7cd16d6518e59b0e8091f56c1825dc02e292d8e

SHA256
7486b5e5daf7d403a259109d4ed3b1a2e41e9d5249dc35a0c27422213834f1bd

SHA512
595b469dac6c575f78ee43dae2ba1dc5509e2d3edd40aa17b5aa9344e65bbe5ec7b0e73ca72bdb3a9936e6eea80be034bb99b16d8ec08a9d68820802cc9c507b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ae70b460a05573de0e768625a0df2b3f

SHA1
e8276114a5d9822ed683d59440f66382b45bbaf8

SHA256
308465fca00bb3faf424529d395972ab204dbde40f1ecd1bf43574abfac3a442

SHA512
ab5571baec30bb473f5b9ef1a339170636d493edb1198992d11a0627703658b6719fd226e314b51df4c2fcd5871d53f7e111b469931b914b8c505deabe07fb42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a7fd6611894fa370e495b06599412f48

SHA1
f099c84272b81b2172eff8175dabfbe9629b85f8

SHA256
560a455cfa1bfb55368203799120d8d08594d9fe1993a840e8621d1de9da251f

SHA512
cac8d08588ec14785aa67ca6e1c50971ab4809d9361e5f924759ffe2cb57de4ee204dfc858092853112bfdd7c94f5735f59b46b6fa3f0424244ac0e526efd09c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5798034d2bd84c67713c964c4309f145

SHA1
286e58496eaf2c65dee532c41afa31b3ea0d9e10

SHA256
047ccc800299b149724b394be4f55074d421a00af9604f8365274a31b16e9713

SHA512
cc5664b4f53d8253ade8564407d238d3efd914bc1f702877095a320ded30904ae733efa959d869210d8bffce6cd5e26c52a8f5faf56c267d91145877ae3ec353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
342a75d0e037ce0eacbae5e304b64d39

SHA1
8cecbeda8bf44f516d419328392c5db909044b8b

SHA256
5c09c040443244d657a95b49b2de6a3b9b4fadb4429f24a1287ab1e547bed8e3

SHA512
18188d98b22d73a80d85e7f982b532572ebe38b94794749fd6700db65b21e8ca9aedc9ab8caaabd2e433fd5f1edb421ee8f5a8b479ca63054f7de5a589b1e030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
76d1e6be2a2baab95baf4a3d68119bb9

SHA1
eec0fad0c287fba2115361e1a6956b0654a68e94

SHA256
3b208ca72ddeef837904820aea5b694f7c99907e4b231828df03c8a7b7e75c82

SHA512
12804233574189ca014aa5ac8d076d42689cebf69fc5fd746d7701cbdf82d8239d86494962f4b48265fbf4570e29cd0a652f272b27e991b200913a97f3d2de84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jo5ozfo\imagestore.dat

Filesize
7KB

MD5
19003b4f1f9f7dc285f90b15bfcf1c81

SHA1
54860cb51d834a02623c48c6a205b5d0bcac9668

SHA256
1218b33a9116ab1725cfe075cb836f8462025fe55ce8ea07fd291bd481289b91

SHA512
ad97834ad7bafb9a08cd18ce97aa5b818506d63b5f3c522a62bf034fd9087e7e6b9b9a977b807de77b081a34ffcc633e28ac141e9ea30663d48392628e3a68c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SKXYVKI3\favicon-32x32[1].png

Filesize
2KB

MD5
df4253088bb850c76f81c91db284d4f7

SHA1
46e3e3c42a159f22038d86bf39fbde118c91dcbf

SHA256
590d33ce64b321c321644bc8c840c354257371f8c247f776b788a5ce2c9bbc72

SHA512
7804f8507d35adc2a3f65a4fb017bc50219fd2ee326693dfc5011cc9e22df61f50533ee7eb597133ac69e502683b7089df89735f03e11807a4724564061b0b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab400F.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4100.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/2024-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download