737c8aa1e9a435f9a4041a3132ed01595139f5c1cdeff1bc3d3b0ea7b2035aa8

Analysis

max time kernel
1565s
max time network
1572s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boredape/assets/svg/discord.svg
Size

2KB
MD5

b2522c6f3c1368e7ce7378b823b2272a
SHA1

521baba59846a3916e58bc34b3b36dc468ab7103
SHA256

8f06e587a10e57574b1ba5f8c667d21a2f9fab559a661561eb86f51c4d46e99d
SHA512

987b6f8e1f09c8e85570d804dd91ee08eea8abd4b7a2ed516c45f22a866234e8dafb235d80d2bb6dd80cd5982cec4ba15135c8126a154eb7d96a425c64752d29

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000d7a8153c86190d9bbfcf78b2a74f037b5705e4bb815664bfd2802f9ee1684487000000000e80000000020000200000000ae0fdcda1fd2c1daf51e1169ca54fb338a6aa19dcba8258bb07405a306a302e20000000663cd8abd83098c2f037d2e09c612ced61f82b8f381583972a7fd5aa51de13854000000073c35bedc33ee2e54c3cec423c3e3c5192042c40288885fe2a825a0ca20964b1a652e4a86178b2857dfa699d73b0cf4ffd90e6ac6f2cde0150fe360c7a45a0f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406158144"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a0d62d3f17da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca4100000000020000000000106600000001000020000000a60c54831559a4544a0ef3b7beda6639887c53ee400184c41726491f6220dd0a000000000e8000000002000020000000f390efd82106d7c99103a59dd56c57262443d58bd6ece01be71c12e9b4c1d3e390000000ccafd7f4b44c3a40bffeebb0aa3c6f499329a46ca29aa4e74a05110a533531ea6356cf98a4c5b5b3f4537514ae6c02607b0144c4999c659ec85607028a8aabd3311ebd53066be78f2296f593b3347878fad1fba4f8ab864c8f1b371dc169cf7452c9be55b96e72e927c71a4cf0e17f0993b56815393b1e883b339b37ba0513d19282b6be4609c5d08c618ce9d92d1b3e4000000038cd9e2f1cd8193d16fe12c55fb09d446d639ff6ffbbe34b4f2c1bd5b93b527d9c6e9151ab78f524f3216770969f81c0d4f4e6f28077b0d008d63dbb1dbe0236	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58D29FD1-8332-11EE-B323-D227BEC38C3E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2040	iexplore.exe
2040	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2792	2040	iexplore.exe	28
PID 2040 wrote to memory of 2792	2040	iexplore.exe	28
PID 2040 wrote to memory of 2792	2040	iexplore.exe	28
PID 2040 wrote to memory of 2792	2040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\boredape\assets\svg\discord.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30e7cacc3f0989c3bf4349f1ae3b1868

SHA1
c51e39d95ebb0fabdf1312b81028d52b6de50bb3

SHA256
8242813b49e04c21c13e592a2e2fb883641166a9f2e7449ae8f21943f2def364

SHA512
856f793bcc461e707ec02ae0a3a35644292e43ff1774aa26a9c67a8049d9f7c60d7b396ed6191019e97c9d7ae212db25225de0634bdcfd1d3f1cf02027e70488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82df823d94c59355f4447aeeecd4eaea

SHA1
8f68809f74b0cf4dec92428ba74228e378773229

SHA256
dcade82205a466bcb571e29ac5fe31d9665ce4b815101e6d1b3318ab2a9b434d

SHA512
b23868c9c3215fc84308bd3807c2a49b815ed2b80e17b47b18e8cab86ca1ca9dd13997b6beea55adadf29c2b676eaad7682a8ba5bb32b2ab78d4232575d91383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88eeee0b72fb72d8e26e8064ca88d5b2

SHA1
50192f258755ed55126c57e220b10d3c20028481

SHA256
f85ee5c63963a8bbf587904af2d6195483f5668f58595b5c35788b531dc200c5

SHA512
8e621bb4699595704174312f6d27b4c044b6be2933cdcf03f6bc295036127166e2bfbd037f863d144a2674e8800e0d5deb00a8e9b03955ed4bc88704f60e0478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be153c3b4d816b4c21dc0d3f8697c201

SHA1
2d5f9deda4e48e01845f2af08fb392b3ea212be8

SHA256
97d3d0aa4e236cf2e368867d980c8d59d5bc803ae262b539733d81464ba75d2a

SHA512
8b44b3994b6c439ee0386490993cd3d125b7138fe092ead4d53f789b67e12f760bac2f5ce5c3162ef45335db11b0ffe15790e4fb29250a8b0dcaa3af0e377f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a8b6e615cb00ea4c092f8c68c7fc99b

SHA1
4a7d6aa93e2cf678dbb922a01f6fa53e4c305aa4

SHA256
c28f5f64a1ffa18cc975912d16ca4ae742d8f6d21bd93bf936d99e7557b5ac69

SHA512
da9316a9ae3ae32f727184df92f018bffe9ee5117acd985fa2cd0b4d1799e9d32856e46ed3419bfc7d39b661092c94c82af42d6458d58c1e644d5a10aa8263f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42c0c20ab30a74833341487a9eb68865

SHA1
06b8351a06f2bea9b32756bf0bd2a75319c12cef

SHA256
52b35dd71b0805f70d313878e07299e3c4271f029a7c94c3315f5958decd9fde

SHA512
4c1b1042d50e42a2a2657dacaf2bf9edca9874a52a6e745c0e82f1f028355c1e19958e50e797e1c727ca0a291899e6d34187f87d3e97888a6f613951feed1a46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0db42a7321e4f544127133203ae4d7df

SHA1
aca83f6cfbf1f55465c2d725ac9db13cfe94ecec

SHA256
1f59c5de70bd3eba20bb5eda990597d80bd011ea029311edcec4e4124f07db8e

SHA512
c81f37e84bebfb1e9fa960fb7531a04583a2e2d12ef726eeef54aa8b0be23c1fe007a38e17ef476778cb35b87496535921aced0801990350716f7172ef404d15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10bb461a9c010d20438415778bf8b01f

SHA1
c037f5526d667d0707e3c6ed6e5c9c63ebdf83ed

SHA256
b2b1e472b4aaacc0c1d62eb2c6a39b6347f0713ffd5500b2047ff7527860c90b

SHA512
02ab9055e57f1581087720747b2fce6b1098cc1f98304b8375f4e9c4f1c1aeea92bd6eb06aacda63f2c44da162cc689cee82dce5c7923d75d76225e1179547e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae3d38aee6e81bc005c9877f9e079712

SHA1
3b677dfc8546d802d321a9d4e9323c57cb4ea8f5

SHA256
2731609a654a1d03563b705bff4dad2858bd8992a5a4ec1d88a6db7011d4c616

SHA512
2e0e2f9250ce8e1208479b49452c5eec95aa37fa82ff18776abfa9bb747e5e83c46bedbcf03769d6b658acd1d7fd3f9c7fc77e198bf55facd01c704af33a9043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6abbb181ee60db5716eecfc5ad8b780

SHA1
d19079d4f028379fce3de5cdbbd1e9b026e2bb35

SHA256
92bf7992d6b4eb1f915ff54a61f6ec951058c6f6f6d701c47e20799d00fef50a

SHA512
da8a4c1937b051ce6aa1efefa0f5e39311027bf7907f0518c9355f921352d9cb4db29dbe294e16aeea7e15294ca86314ae3f4602031e7beeb3b2ca2a11fcd327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0380b98fcac2ac32e3741d1dd89466

SHA1
25d475a20c69a9fa09761fd72576ce255ed81ac3

SHA256
d0b2264075d548ad82fcc2de6c09c80e04241e8a79a09ce4cbb6d278aefc7ff6

SHA512
848fdcd60a4dabe6819eecbde7de3ef50ee31206754780e3f20332f9e895c3eaf7e440327568957b300c9fab200a471ab88bc2a880d8e646cbe6f95c54cf4815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47769aa5c0e51d6a2b9720482809d8ee

SHA1
e3f826da8bf920d696790fb92397fd0882433986

SHA256
c8e0d6e0db352ef645178869a69989959ac834fe609cd77ceb4791679206424c

SHA512
d34406a5c2e58315021a3991206e8038923f8f0edb34e18e71c6d5eceaa4f520fe5c866aded4294d74cf887094a10dddf0e28bec221684b27756be7b309d6c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2019772084d80c95089ae4422b84f8c0

SHA1
35adfe474863f161108e71cfc9353b673d4d6335

SHA256
db3618145532384894d65d9e032b8d02f81aeae75cda802e5e336145cec60e46

SHA512
a30f15e59be0b1a6d69019ad36cbb4028fb0e6091e02a36bc058b49a1b8aff8628862fd6f86bf6520e5837dd2e6d6616332e9454ef3d1459fc63a6884070040f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2156500ae95c2be5074699e675c11f66

SHA1
41bd9b49302b7a1d1ed63e8f75120495cd7c6dc1

SHA256
71e62c84e0f9137e481484ad04387bc836e6327296ea44bf414dfe32c3aad49d

SHA512
9522e775b1dfd3956230f725539b61b6dd599aedcfc611ac9019142d0a95d8b3cd8b1000a466f39f5de53acece024e6b29184f0f7340100aefc0a354a3466a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb0f46b9047e5be9bc09b4e3a2c9b6ad

SHA1
88b232f2c4d03dc2d7d127a9c322e09813773140

SHA256
0ab305ae69e33d5fabc18528d7f08d8244ed8eba2548380352cd10b808e21d87

SHA512
a49770a62c9dcd59576b9fef718ea597cb80f7ac27820638f0654b2f7f61d5c1b1f1206a55846b7d34950205048b49a693cdfcee3eb7f1e8a099737b0723f8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb5d91cb7b0d11a2173b145888b20b72

SHA1
3c5fd97bbd2a6ca7a72cf13e417b269780e96ad0

SHA256
9ee7bbb28e0f59e83c9647adc56a50f9d595bba652cbab3cb0c684a59172d517

SHA512
0bb3b72fc2a71acceb2b287443738f84153ad788b87de9c9e109166905646553ca0586f38227aac494220ee3168b80529c4fc7d7b9ba5e2afd731bdda746c98b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB05C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB0AF.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit