c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-07-2023 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher 3.1.exe
Size

1.1MB
MD5

021b53abfc25a261077282498e5726a0
SHA1

ba7f38a28444504e6e8e1f995cc40ceb70ff6409
SHA256

c3db9475c3ab6b53d8f6d711f587e5218c9b8d332229a208277bc0b27a24b620
SHA512

484bb65ecb1ccd3e5472a27737fd2fa4471240aeefcf4bfdeaf4e49636cec9b3e43a5c2feb7134074c92af01f52a456b8074aca8269480e210cfa3b51acae81d
SSDEEP

24576:7h1tjL2uma7hLQKaikK21SHCJ3ny+SGiPsGSa7tLC+/e0cUEcnr:sghMKai1viny6iPH5hF/e0m2r

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAEF2B81-2229-11EE-9706-CEC9BBFEAAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2132	iexplore.exe
2132	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2132	1244	SKlauncher 3.1.exe	28
PID 1244 wrote to memory of 2132	1244	SKlauncher 3.1.exe	28
PID 1244 wrote to memory of 2132	1244	SKlauncher 3.1.exe	28
PID 1244 wrote to memory of 2132	1244	SKlauncher 3.1.exe	28
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30
PID 2132 wrote to memory of 2504	2132	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd0bab49a185844d404d46632ef9fa74

SHA1
615b96ec3974a4ac68e2c984f78f77c2c59f6ac9

SHA256
b26c317a20ae6c1248985041e524ad655a01465399e1d6505786ba50baa81b2a

SHA512
2affc8119450dc7f2daf992d8560587e39f320d317bc62020890058012eb77d554ca2c5b2e3a047fe496e97188567275b6d1b22e68435f5dc6984c26b104b2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bd2a85d6c624d889db243a271235ae4

SHA1
41e57f71c9139868fc648c7400148aa8a580ff12

SHA256
05020233fe2256a5199ff4e60de6b004e26fd9561e619dc84b82cc465eebe8d3

SHA512
172c2536fdf685770ceb24ae9bd1d6a642bad67a970c6ce195855486bbf0dcacefe74e7a32460168c790212851296263746d993f078d8ce592d062d6664a69a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd24a86d58772397686e4d2874724ee0

SHA1
893b0b88b1dfdd9cfd80c303ee4441c0cc4cbe41

SHA256
e0eb2e4c7390d6b7c9251dc65eba1710e6a010ddf238d5d2a2739c4edeec7c33

SHA512
04df48ed4a9de01bf125d8df57fd4143195bcd9ae3f1fedfcad6c93812117dab780d2fa47dd86e36838cc0ade7d8d4312494bd103d3742f8b55c20a3d5654608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54bf7d0f16eb7596d6c6598ff11f2959

SHA1
73314b73ba385ae5fec06acb07c9bd318ee6ecb2

SHA256
551b5446ed86c4ee2938854f539c0cbe1057141ac86220accc8336eeb5046839

SHA512
2a4055ecca0ace2f2fd074cd07cf264a4b4313e78bbccec31776740e774c78e5b1e6c00f5c39e3525420fdf095d8579cdea5021e08b023aca4e4002ef78cd92e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb55f155a26074f7a18c26c629c1cee0

SHA1
107c3ae4fc088e17724c9ba8d31f33953ecc1f5c

SHA256
1cbf8267e2655191aa9c1d49611b2418e8e053a0c833253c1eb8bcc9bf3e226a

SHA512
442d605613a0d44e38fa61fc5471fc51ed2a359f18845beac12d9a2f6419a6c01ca8a49490027d1a590e5aa01226d397404b188bb9e292a382f117932a32d982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92d069fbe6601241600e91631837a7af

SHA1
9794096c96aed42516a2b86c758d3ddc32b8e5e6

SHA256
1498d5b5450cc1055aca1f2b7e409d2b78c07a04c33d539ef22d882a76619cd7

SHA512
1b1e7bd23bfd21638c00ea539ea300acf00928a80e113f79d84b95cf0ed837dabfd84bfb41b602e2afcdedecb99e9421fb4d3054581998e5e7827689b681a669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e87ad63866f2d6046e70d572c0b0b24

SHA1
6c8271eef36a37faae759aff4abeb67f5150ea1b

SHA256
c8458c3663a4158815b8176ab0f956675e6724201e34be61a019878fffb93db1

SHA512
b2dd069e01c3aadef803d9c88f830a000932a6126730e2977cf351c54bc2229622571c0a65d09443e4cf43d663e995b615510154e6e2d10788ccee5f39b3e978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c8a2fccfb39714f69bff76951096619a

SHA1
e5cfe1cf218f88f2107891b404ce79e128178e9e

SHA256
3eca2d0107524dddca6b028d35dc4ecf4dcaf063eef9d8936a5945f5b6816f91

SHA512
a08fb1ca0d4ad4f48bd9b53f81a507559e60e5b662adc4dd216cf10ad41524189bad5abf611a8032cd96d4d9155318503118868b4bf09436899bacf03921ee39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e8f268a6cc3918af899be0557df348e

SHA1
97f28087bf2ffefe853031a6d2ae2eec5a89dfea

SHA256
99b82bb158e3a67bc0d87fa86cf43252a4adb7ed76086f0d42bffb6c12a57062

SHA512
1a067a2634660835d7a48a5ab9ab46f7ff6a096483937395c05338b8abd9c9e4ff4f9effc7a91734265bf2b1c1a0f56ca60d8437d104266f3cd6d6817b21b001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
404fac1a215339a54739cbeda843c92f

SHA1
8f8b1c865a701f2caba75e9b08587521cc5ac9f8

SHA256
0c0a48cda79e1b354ed2ef0539b72fd7c3164772e357ff197f18b8b3598afce3

SHA512
aac08abe79298e5716fe73a69c9665d9c4196a7236af5bb0361bc8e5c7ef8465a25762983945eee08a3d8db8361db73105751017e611921b30d5345b39942ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ed75eff819cbf12f29cbad1261171e4

SHA1
b4ca8ddb9286314a87bf37d2c2130a75b2747ff8

SHA256
fe8efb341a3beb339d55a0d5647ebe1d9ed3d9a5db44d181db35517434215b2a

SHA512
0bfed38512c1a74672825d23dea9c713da0c1177cbd05d35db22a19d2f4dfc0687e2b7c766f299c34e09a73a13a9710c8aa1365e4f79eb616248690296b67913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ea189748dd02ec570f208ddabc91cb

SHA1
1bf4209ed5e3086de9a12da59e27b3f0d82306e2

SHA256
8baea3ed5f1160f49cdddcb5fbd1b59b30bf97bc9a14eaefaeef4c9de8e0c80b

SHA512
6928c2f9d0ec3eb6fb23d10dd75ab4c320026eaa91dda1f7a01a5444ded829c62e3a7b0d2186239cc930c2b75933569df81b5eb360c00e6f1f34dd5bb398fe1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584fcc974fb0ea5cccaa8161fccf1d26

SHA1
a505704a0a98f7855237da4f6fe30f8a3c8f8632

SHA256
63badaff0a2c4a0242da721add5fd9a6bcc9c82056c4ea646845f30a5d0c29e1

SHA512
33369f33a0339977342b402c974e05fcd855f2b892758928228b7f2db0a9035d4160e0815e2a798f41106f664772d8acf5641f2e7c616c80e79ab49866024db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74c1a4bc75cd149a8b1627c6b5e470ff

SHA1
bd3fc8c0338379d049bb5e241771a27ac6c5de3e

SHA256
d5930915f08c7c1c296bb735a0a4ce9a2b13f46a80c7a8e29c52649533c2ca4f

SHA512
58b7ce21794c87136c9759467f37ad7e1a62a45c2af2231b9c82ecab759f5ab7740577977059fefdb84e47952c5249cb4f6ad1d55a0f0ed4236981e94bb3cdf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e15ced64704394e0c41a5c33fe18f9d

SHA1
3a90bd10337b4c61c7568a7a1f6e15a2bc2cc87d

SHA256
f46c7c97bd3cc784ab839284d38f81729beea8b38b72dffb581f3d27d3758f15

SHA512
854877a2a950e566dd5617523e5cfc5bd126c0f484e90a57d5359ed740ac4b3143a17285fac4f7515e01e14ad648662d51bb4ff061d987890cb00c4ad554dc2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\b423aar\imagestore.dat

Filesize
7KB

MD5
9784330b39c57e15947ccb16fa2579e0

SHA1
053b651231e4b6d3b0db399b6e90a6d42bee5e8c

SHA256
50ab7d72969bd48156b0d55397098062eab0f768f0062c2769f4929f2678729c

SHA512
a359b88513b72ce78c7f10cafd8845ce66fb933a2078939185e5710736fbee656870f3623b2a657ef615d4e57273435c9b844ebaa06c5b11a1057b54755a1d6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U6AGJ71Z\favicon-32x32[1].png

Filesize
2KB

MD5
df4253088bb850c76f81c91db284d4f7

SHA1
46e3e3c42a159f22038d86bf39fbde118c91dcbf

SHA256
590d33ce64b321c321644bc8c840c354257371f8c247f776b788a5ce2c9bbc72

SHA512
7804f8507d35adc2a3f65a4fb017bc50219fd2ee326693dfc5011cc9e22df61f50533ee7eb597133ac69e502683b7089df89735f03e11807a4724564061b0b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA797.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA96.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/1244-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download