6650dcf52e02ab0459c72bf9bdbdeaa1c3748be49c4a45d04ebb18fae16baa01

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
25-11-2023 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Separate-Files-Version/Activators/HWID-KMS38_Activation/BIN/_Info.html
Size

115B
MD5

ed197ed9d9da84e2dfe3543f075ebebc
SHA1

286f3bb552b6368a347ca74cb7407026624c4eb3
SHA256

f139173b8c5e59967b74782c84cd6f2712d69da506e83c96785cc9f791492b84
SHA512

e7e58a3d9a169a9d98f8b81598ceb0209da1ff00def355b47be3368c5ebf85a5ec1ace811c92b5abc2750ef69fc7eaad148775ed3dbacc0aa2c7a0e3ca17323a

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000005e14afdd7bfdf9e07de482c607d96b2a04ffb9c6c06e398855dd55d80e86a6ce000000000e8000000002000020000000a480dbd8956a46741097d56fd044769437a251bcbe9f68e5341cb8e63dbe1f7120000000a5bde1cb14c7285598d46cf4f3afd82f861f79200d5d5b9c4b0d5620232151b540000000b13ae5d6013cdb5ef55d3d2f5daa96fba54b816f531dec8e179096ea8850663ce707b2535a95b927887ab6515dde76258383bc3e99aa8d5ffb375f4ed2ed1540	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000099b8a3c6ff97044781f9dc0475faca41000000000200000000001066000000010000200000008f7afd210243deab43d96aee402957c21baaf959b787c2736fc16423a1c14571000000000e800000000200002000000085b6cc28bc6fc81e4111067ec33dc4e3f1a0b1eab07ffd28501fcedd7bceb40d900000001c8850c02cab376291caeb7996492eeb610d6364d8754e9ce8754e61d9afa1e3e7f10bf05f8173d38bff042819ae653050fe52f785bee9a6fe49076fcd218c29762b820216e5edc0a50c0ca8df7d8f5a544b9eb80f2dfe3459a8eae237e3ec074f14646cb38fe0d2220b3bbe949f6f8496b4a31acaf5d3aa83476e0f2014e108ba3970f504269710677b89b21669c62240000000aadc4c04b73a11dc313542e6710043e900bef689d5aa11b76a2703a405e40f566a4786051181f92f3774ecc0fff4d54e8531b73a7b595ec94c7f7a341b602301	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505d29df6c1fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "407057407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BFF9501-8B60-11EE-AF89-7E017AD50F09} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2260	2364	iexplore.exe	28
PID 2364 wrote to memory of 2260	2364	iexplore.exe	28
PID 2364 wrote to memory of 2260	2364	iexplore.exe	28
PID 2364 wrote to memory of 2260	2364	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Separate-Files-Version\Activators\HWID-KMS38_Activation\BIN\_Info.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bc291df7d27cac696db7d2c5567c4c2

SHA1
1183a46502c77851ab01af1e416deb4a2c3e14e3

SHA256
589a40bc289648b0740a8597b0bb4bc8d9a5c1baf217b1d30c0e0f0a5c8b048c

SHA512
58041d9fd4c56b8624f36f2f885f1967d7dc701d3bc217b703aa952a2d4a5009218cd24ce5d535a782e08b7cda6665b226c26c30a4bdc4799072a05ab19e2285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70c80d304e835d75841f6227bd9f111e

SHA1
3743c7f80d92cbdd757d4b4c606d38867a3f8646

SHA256
47daca946db9e2d031597281894ff4100b19dee345f60ec57d7ecb9b4ac4e1e7

SHA512
a7b5758e40e8ed63f745e24894a04bdcf6779b086d5d2a464449feb20e09de0a4e9b8d86b8ee90992dc70ed2e193e5b7ed020008651295ec7146a73f83535c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f83a73b490bf5f168bb177814b6854af

SHA1
88be938f9a8cf81a7fb76ef699e6b8db7e33b27c

SHA256
ecc22f6f1c4f20d41213256ea2f926f453a3a27135b86da93a845f738f73a3df

SHA512
b4486bf0d69a1d86ab45837958073231c6bd012f30744e18c28b1f0a0792565ac90bc939b50b76a4250b7349604ffdc5588d557b06d18ab064e911a0a8f92fdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9b942f7e989c0daac6070cb4d8ae462

SHA1
6ba907c2835c7219e8d664a0244ccc5a9537b3e7

SHA256
dc38daf3fe7d9d6ca598e5ee52da5a78d871d25b2568378007e2eb1ba42257e9

SHA512
665c24177b401d2ef67812e9bd9ae9fe19aaa65bdf9fcdb680c1ec2f29e7637f74bfc3bc9a41f3fbff1a8ff54ca60eca9a33945a85ae4c8cb72bff7539913c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d51d758eecb733f6ae9ddf757dc73564

SHA1
88809e5cf92735fbe708b7ae1139f40b856203ce

SHA256
91cd2e8f27bc2ebca165748f4d0e48893c7ac4a18229ba786223ae573c11db00

SHA512
776595b5f89cf8b5e97fa95fd7a8dfc278795df114c8f60a978a4aabc605c2cca50c6c341c2146468a41b05b5693b0460ca5b64fbaad366cbb140a02e3ea09e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03f83656854c27024d499635d394607

SHA1
94028cb7837a3176c87bb2e5910f18bff89bc0ee

SHA256
a59eeac2a48ff100e1267a72e0fcf434a9081d66e1147724c9f4a5f39653d57a

SHA512
a6d0ca05b933c213fb20e49e383bc9a604b0e2156e6f1e0fe4aeac3bcaf0bc830d37647f64cc8f5e97578e3856ff19f4207a2c5ab8e508c5d14231b573ec6f01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf8905621f840d55ac4a0ecd67960b9c

SHA1
3e702eeaff75da80fdd3f46f8d2b74f89df15d8f

SHA256
11e63b05987bc480150aabd53cb35aaa549efb94755e6646c08a0d006656f6a1

SHA512
8d80e5887e4d6a163e6a463e5503179851021862917daa6455700f9878aa3ec3e68ccd8502bedf849c9466a4d0423fff5062a7b82cc5aa1de1b43a48ba3f9977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a984a63226e595d3540479956185463

SHA1
c8ea9234ace7bb7ed4f2af502618d72f1721394b

SHA256
c0632ec1307d46303557212959841348d8cf72f27a8dc691fdecf7629f660295

SHA512
3606a9d1412722acd3bb6e0c8443e4ddd2a297aad10295e54194f6ec709f827b55d3ceb483f041eb908de4abeb9e9493ef6b2a9aed627de1a8c4acd2b6c56ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a323053e191e3e6f0b854f903aa234

SHA1
40b95facef674748501327dba77044b64632da2b

SHA256
445caa54e4e10cf6c9416636cce4975c62b425fc73b95017952544091f9d05f1

SHA512
353967980b1942858870a8460ab0480e0e22e4e529f32a0d96486313d029c21f56e173671db553197485a686e7fe64be3f13a7d586ccb29c2eeef45df3dfbabe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB81C.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB84D.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit