d53fd981970015673d5ee316193ab47ab443c2e3ceda3adb5df69cb2f30211fb

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

license-list.html
Size

79KB
MD5

f94af24d26cb7f431bd4a91f85148edf
SHA1

a6a02d1b758bd64068c6ee5ad35b718821164186
SHA256

895f448ec297e76fb2b0b7028733b68b32f5129469d016f1ad3fb2e801877ba2
SHA512

cb507d0a05c859941a6d3becbe83b5869e02658f130b4709045910b6610645698bb18e6cde94b6101129492727473f5ea3e5a8e5abbc64d867b8eb206eaaae81
SSDEEP

1536:k7nmqAIwHXBbORpFlNtqqlwpbuByB8B3BiBSBLBo+OOhjBp52E2YE/Z2h56b7o0U:k7nlAIwHXBbORpzNtqqlwpbu4Wx8kVmu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40961e57f9f7d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a71400000000002000000000010660000000100002000000098d989de0216022184b5af0622a08f70646dc3f4bfba84b8824097f427c22426000000000e8000000002000020000000daf95ba16b95bb6faa79e109a372e0552c65901eba4859690bb3e5e8f9b01226200000005938eb34822521c59969aa88372b85b1f43117dec37509243deb8de2656d70a340000000c0c49b69dd4a2aa4147cb189c07a4df1591ae52245b336ba23eaa62250a360b6a9cff22fa6cdf5069e40095582f05522bd06dd4bcdb483a2db13c6e8b65b3502	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "402719662"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81CD9671-63EC-11EE-A109-7A253D57155B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000627517663bc6e381dc2768815805951943796dcbf5b5ff8f615bd50cf3b6153e000000000e80000000020000200000009b32887d8daad42ac3e9930b4764772f66ff7ded9731baa4b14342f46fb7f9869000000003f42cf40a0d464a04cb3670f2507d8cba6fc3b23752c4e803df10d4da166ac19f12b48c55742ded3d9a167bc3476fe8bb11e62bc0d92d4583f50ad1ff5c97ce37ceb6f6f3e5233c9f2451b1d5176634ac77af7f11faa85b76d81054cbece8114d762a8d8fc3634f04dc46acb754b1c57e72655ea90cb72d012efe2ea28397666cb348ef01910bbcef6604ecfa912cf040000000c83bfbfeff61a9e56e75f6dcdc09a48743730c1f6611f60d1f5a9ce3ffc36ea60fd6abfdec5e1ad350b5869033922e57e13c743775f9a474c34cff97d367bfe1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	iexplore.exe
1336	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 3064	1336	iexplore.exe	29
PID 1336 wrote to memory of 3064	1336	iexplore.exe	29
PID 1336 wrote to memory of 3064	1336	iexplore.exe	29
PID 1336 wrote to memory of 3064	1336	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\license-list.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e399e085409578766ec7090eeeb638db

SHA1
00b9bbbf5269dd0bebdcf5d6b8a5ceea7bb12bfc

SHA256
9f55e03dd9f6f4b516e1cb11dad36bce9facd47f0db5863f433a5b19c102f089

SHA512
683948f542e86cb8a2830a20460053c1abefdd98f6a22246234ee0a44ea7105a60446da1105f8fc401666d6d6ca47f3f06d80aebb40c58e92606b71676a82982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bfc773911f1736ad0aba976fa1535e3

SHA1
6cb246ff94aaef2d303847bd08343ef1ad14e3f3

SHA256
23ea788c3f3440c6b25acc937e6e3c2acf3eab38e935325977c3683fb37fad31

SHA512
8a68f88b14d1b817b03f14b97266a0d9db856a1c7d2975fb35c95789ec4f5088d43f404d0e2615311a5ae9970f66a3fef47bb5ee4b2fc4da3c9a8e2c947289d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa01cdaca5fc1ba29111cfdc8cbef787

SHA1
a1bbf82db7d6d9c224c79981352188aa5475174e

SHA256
5795768ba6e1f0a39d688548c9501164ceee34d2a02d7cbb5e89068b1c067688

SHA512
71225295ff932c7daa1747128199e831cecd6092365900f19c07f32ea0b0e4e3987603893bb23a2d47779283fc13b45fedc67f626c72ca12a6a0ba939c1853c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e69d0a8bff30c7cffd00fe5e6bca3c22

SHA1
d6be903fbea4060583bc0af8dfc08fc864a4f9b2

SHA256
16c94ddc67c29e755e7886cd850eab09c4eeaf436941b96b22a391449e49c91b

SHA512
2cfc35caec9e06eccfa83755ffa58e77e51b1053a20ff9933d343466c53907eaf7bbad9f96b39e0bcdf37c05baff25ae9d2220d5762ad52f574252ed7adb8e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5118d06cb08e7cb5aa07dfce6bd9ff0

SHA1
241f60cac28d8acc87320f5f9b492d100fefe013

SHA256
816b12194075770af7cb6e60bc5a2756d626e2806f437685e8b4f3ca6d330b0f

SHA512
b29dc43007af837c817bd6d8af4b77bb4274ebf87dcc301215385d3c0c62827ae5b0cfd16c09c44e36434c4909332b31a7624f16d54dde03186c2cfd1a231b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a3cd6479606f7e4c95af6eadb55e643

SHA1
187008627948ac81dcc18463a717e0b89ff4153c

SHA256
95d63c8d31a2bd8c4acded1f94fd5279769d2d3e15248adfc9aaab3d1e07b58b

SHA512
bffac7125d19a8917ab851744b8c3d735294e1f8d3bf92b284e45c3fb9610a21f925b464ada88bc746ad22590acbd74dd7be4153a1ee52c4a2f21edc09b5a244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1204c94d45c57a1594b84fb22dbf0624

SHA1
26ab074e6cf30c8827093eb56e2fc4c9d3283767

SHA256
fcfa492face95522ae59a6c8c78fbd4f6e2668c6b6a894896c4880e3b95b8a1f

SHA512
11f000244ca7b4192b6ce940215dcf958d52aa0d13e247a14caa1eceb6b88ed066d2b9a87eca79ec5ed778bb1a6530ebf62e06174cb5e8f59bc9b256a144419b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9898d2cff2a7209112c89b3bd5c6007

SHA1
52bfc2ec0c0b704c60da712f55d0c92c8acd9c61

SHA256
c5d297964376d6ce1ac213f6f2deabe740875a74784316a941630b17aae8f3e1

SHA512
dfb5504cc286251249b651506ab9dcbc8166d89b541079dc6d341ae133cadd61bd0c7d50876700b657c916372e60cc7fe27d04f15fc46b9e7a3ac4661bf60de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc038e957264a74a36c81f63cc11cced

SHA1
3d13c5ae33e6171417fa63d12d6b33a52aef03ff

SHA256
620a70cf9b739a8675bd01736288c42b4792eb519a177bb8245281db229ae107

SHA512
2117d1bd056ec1f552c75301bcc4077ec9f893e242d029b220ded7161ad6e0cef988b12ed81db20758e7228c7e41879f70223442f72b782ea710d73576efd64c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
290cab3b1bbb2ddfd767a79dc4d5fd4c

SHA1
f631c8a057e0564bb7dd0554fc7fe8f7cad14ecf

SHA256
23e616ed08e57d82ebfa360c200c7f89620050fcdf4b0bb3fedff3cfd045a92f

SHA512
eac962a7b014f0a6eb478cd370a7f3afeb1dc7b8051112b8b5c3d622e91b6869cbe55e4c3e50e924c831f88fba8981ffce8638db519190acc00a63a6212f59fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
993759698d7f29ff1c4df86bb4ebda5c

SHA1
4c114fc0c4d8b30cba79b972dc3eae3e701dd9ce

SHA256
2526aebd7b907d9fd312559855bb4f6879c42490188a00d8402bb8bf45075773

SHA512
c855856c5ff0f8096fa0e9a49e12cee312e360c0b7f0abbbf9296d538b4475dd37b4a2a69ceb3c62988c48e7c701640f21fb051c5b0d63e0b63412c1d3d31aba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
619825597bb5e15019bbd576b060f0c7

SHA1
a32aa537ffe85db63e2cd4dd7e608f0a922e3291

SHA256
aff22e55a7c33afd2a735709856cdeafc60c4302586aab1160127152472d79de

SHA512
9900704912cd89302a6512da7cffde73ceb30fb892b21a8da38adbd3cde43f11adfdc20f129a337716f855e3bbea29a28c5d852fe3151dc62788996c24d37dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eef1b443a2ca76a761e92865faac6b2c

SHA1
476a07b7045a2a2f7a97c99b40dca69951c65bc1

SHA256
813dd9386acc1cd6297e870e71f953f2e357b4a57d152c1c4715623c95280495

SHA512
184d2f6d32ffb27142bf5753b46e034b1b4e1b52d39b37ef8137b0a41268ab62cebb45320313f6cdf3dcdbcfd85989bb0bf120b405850595c8c6bc0756c82c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26dc7a61a5ee31eb1fbf7cfa2c173036

SHA1
9dd03de14d0765ce6b18a703a001687f04d11448

SHA256
8476f595b0e334254df84be93b12e01f55437ba8c4f6f07700429cfcc26ccdf1

SHA512
bc6bb3995bff64043ab4085f2d376ca3eddddf3fc59eacfc282c4b9c7c7861b6c79b260bbd8ad5fa8b6256096610361db75c0b1ddf140a8edb1da748afd0211a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5906bac35baf0fd6e6ae5f736d1fb821

SHA1
71c572b83c228cad194cc7c0bd39881b14a5d3a4

SHA256
4749fa2cfa024c3a1e451798ec05c47b5049c83ce0973702eb8decce6fd2f38b

SHA512
98be6d5d69fecc156a18bc609f3d1937409a44ac9ecf4f971519ed45c10eb6ebf5a7dce88bc7b16f0c9fa73e914b4b095a9d1082d248dfe3e771ee2d017141e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59fa5267c42dc3e948f56798ca222ec5

SHA1
bd66abd3ff2d66fd8937cde04482e148fc9ac40d

SHA256
05937da6fa55ff1e6fbe63e7785e4800d3f8dae5cc7492beae62e275df856bbb

SHA512
68157448146dfbec8a1ca68e4dee6ed024cf2bbed9d4d3240fb38b22cd82ee27162d630a897316660cb9a80c1d8752048383688f38db7ced14115046d3c10eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0805c6fcac55ffc9c2ecd487ac7db423

SHA1
228866d18304678ecbe8be8e8758c029e18595b2

SHA256
d60116a64630652e03628e834a28a8699341a498db9a13c8aa256f2b80d02ca3

SHA512
480713f77561a724a45c405f6ce3fd0afaa3cc684f7cdd2842ffb9d5bf6dbba59052a64b1d55b8817b0fb3650f95f02f23843678f8eac553fcb9fcae090f5fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7707.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77A6.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit