hxxps://forums[.]comodo[.]com/t/exciting-news-comodo-internet-security-2024-beta-now-open-for-testing/359265

Analysis

max time kernel
16s
max time network
18s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/09/2023, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://forums.comodo.com/t/exciting-news-comodo-internet-security-2024-beta-now-open-for-testing/359265

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E493B8C1-57CB-11EE-8496-5AE3C8A3AD14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2004	2976	iexplore.exe	28
PID 2976 wrote to memory of 2004	2976	iexplore.exe	28
PID 2976 wrote to memory of 2004	2976	iexplore.exe	28
PID 2976 wrote to memory of 2004	2976	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://forums.comodo.com/t/exciting-news-comodo-internet-security-2024-beta-now-open-for-testing/359265
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edd43ae75b52a1fbe9257e3be4f0909e

SHA1
11e8661aea916a0e13b3ea3b5469e0cac5ad31b0

SHA256
f9b6209eb06498833ec66f2e28ef729461e4b91bf4cc72d51c44a48af61189d8

SHA512
5ba230be75649a3b1b8829bf8e071e016e7cbd613209a1ab9e11019f92199a5e78bfbd3e3597d00ead9d1f3b91c8af30a0a24f7ef1f64581a486c82f0cc2014b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f27edf7905d14de2e0cb76cccc7d9df

SHA1
4cc8679f7c92789c2032349791fd1e7b9d424909

SHA256
31d54a83267d6fb152d7ff44c8777700a17d162cf1ad1e5729d180aeaae67b23

SHA512
2b7d35ad62a2359ae22cb253d485f20e3cbf44ea2f1e026f6f31478bb5a7f3aca36ec2bf74a9ae763761b74b28baebd0d5075da21fce5964a69a4c0bc2d40042

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b25e4e96443c2f51e1a6667c17b84c9

SHA1
0390b434416b9aa4a590567e9755ab197bd25324

SHA256
2289cec1037bd442547fe74fe51372b730211b6606e3862bcad756e2583af269

SHA512
36c0b352a8240b32b8a788b4cbc2ba1fc644e3471d9d6a12582325fa2049d4ed082eee15d41c32080cfed771b652b552614214c4aa2f3907b1e11fd064dae333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0c622b8dcc968830d9c8106696b3288

SHA1
ef735aa755dbf0cae0dec89c98ee8c41c1ccce66

SHA256
d44ae653328d988acea755c8b89c13245c19f4ba07dd374b8472abd8cc50b49e

SHA512
5c416a50310985536a60936e5e11f0d0c2461929624994e94e3745e9125b7b57f18b2afab3d05503cda963cc77859ce7891c63bcce853014c2102a8d49498181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
535419068dcd8a0efcad51e860796bbb

SHA1
d57bd7db238b0e6efe2a4247c7fbf2d8ba72cc8c

SHA256
12933e053552a72490164c16b8042d89eb8ecf153c52948afbe02daa405c5e12

SHA512
93577943c126f7a82df2903a36eafb99ca2fc6207fccdfa6db3daa3e8adea095707c9bf95630984d5c1610d5c38df2d7129b6c95bb87006cb7ebe34f93dc62b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
502cd5b9e52831934f3d1a0593de511e

SHA1
3e528e30ef7a229a90171bbcc66d7165189cd213

SHA256
2d5bd18a42369a84edf2cafa9889306ae66bbec2a4ab5010368e6e3efa9da5ea

SHA512
6036d32b618df8974053a4a6c89a23128b4cc845358edaa35949d60494f4adcd7296099a09607ee39914da6c395735ecc8af62f2f69b33593e393a926efbdc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c3abefab1d223ea903d5e52a8e696a

SHA1
34bc7a53183406ed7078c0c2af935748c5e97e6e

SHA256
32a58cd40df1e5936409dd21e6fc8348697d1c4228c402b6e9acc0218d86c8c6

SHA512
7a86e0a8b914886393e037acc28fb648b2b7a99d0739df1bcb9b94249487d503a40e6c1beca719dbe7905c83b0d7b2a1edf367f64f989be6ba73749ee796a8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa2441d45c24438696324de47b68f4c8

SHA1
770fac7e70181ee638533ed7124dcadcc95e2176

SHA256
a2bbb00dae832f6d03cd912592f10f92df19b3dda4ab75ab8343f50b51eed59b

SHA512
d72d086dd0bfe35573ac339a8dc8171bfe5a583755a1e7157fdfdf39b10e8a16e3d6403c006dae09fed8c445f44580843949ddf24aced89e7bb83bff4e71eb2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd4ffd66a0d6f8195a5e80317345329b

SHA1
9fcbc4442c9a1899cae447391a907fee5d2e5b40

SHA256
e175a66dceb09979176cd71f7af6f17f375b0eaa4489c7182ac9969c785d453d

SHA512
5ce87956ebf7748449f467c59f948d40086eb79d2854874106d75ced63ed0d61394c96afa7381885c83c5ec35fe17e78236b3a76e32ac4f6ea2ded66f941e92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C75.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D33.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit