f058a8196e068c1ee1f4ed9c09d78c32525305f2c58ac578e53d7bafde163d15

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

More/Game.htm
Size

6KB
MD5

441094f1319e40e4a4b97c022fed6068
SHA1

cbc9b77a340e6623edc2bef2b6fc495dad80d3b9
SHA256

bd2faa86010a4596cdb6d6a5f9fdf5fbe58211ad81e560005eeb3d8e598312b7
SHA512

aa26e5a02a6064781564ce98bd931c54f3546124f8ec6422233ac63c1a0f0133f86c3443cd4c6ea0a426134ea9aafea0481ad016a83e260ba321308328e963a5
SSDEEP

96:IShS3WIEOteX+kfw7WMT39MKc/pzt21b1pUoYhgbI:1IEOMOk+mKcRp2Vn8L

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410546942"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEE99A91-AB1C-11EE-B84A-D2016227024C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109b49a3293fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b4d4a8560669c789baa2e65248532a172813b00eb5a04ca44f0391246879439f000000000e80000000020000200000003fd74b3126d47c27ce098b090746d76323b970cf72e4fdb85c4f10ddb2628c3f9000000025b20ae9216d6a5d7aa1daabb0b390182451823c2eeae03336b0b648ecca6da01f88a1f37f43dc14cddaf3a87b36fdc09a94e06b32c2d9c4be418d50e701558273cf039ed81670a08e3400fd5e4c051b02c923b92c8c4d02a704efacfa6aac9778e96b740eaba34f455280ebc94e1397550de40a41c1ca034a2bfeff458df186f71c415c636e611a5e71aabec8935b4440000000064fad34b3288170dbaa3e8e61d1de0fabbaa5ffc08b59b41a6e4f6296f52157500d82a6c0a2c7ea1ea777de2ecef1a9cc4a456942012a43c33be1ec03aefc56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004d857f36d001d119eee26efee54a495abf0bc35e65b4085c6dfc77e82bc2492f000000000e8000000002000020000000ee78c4b5383f0af08e32c9f1fc4c5a96079eb8c6bf597aa6abc23bd613d626a22000000081ef212e77e873d6a268e16c301b02442f437c03ac7b662183f565f42703fceb40000000f75fc9db15ac45e534cfdc35d2b044b4e765ea15f810f8b6c9f27aeb74affc6e090d7b606c7aaa6337644f9b5d0718641e08880aa14a36b00d078120a57f3e34	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2440	iexplore.exe
2440	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2084	2440	iexplore.exe	17
PID 2440 wrote to memory of 2084	2440	iexplore.exe	17
PID 2440 wrote to memory of 2084	2440	iexplore.exe	17
PID 2440 wrote to memory of 2084	2440	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\More\Game.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05ddeb498f641a33e10fbf34ae2d9cb4

SHA1
45069052bc5f951406a3eb414c58c9e70bc664f6

SHA256
8bc73ac4937c9fdb32e6d32b58539ffc71409bca6c04f5505ef4e4818c967a8d

SHA512
2f10719cfcb90f362072230266ed1a846dc25f9d7fe440640399ed0a18bdbcc8b3354b2058545610d74a1de28999374bcd91180f8def0ea3353cdef7fc6e4d21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1df3ae49f3a7d26a05ec4f3a6fc493cc

SHA1
ffe5a1756cf0c1ac7dfc4f1b956e6e30333b999e

SHA256
9c837cdccefec1ede34a7ae56876be3185e87d4a1b9e363e9dadf0a3b291c457

SHA512
3dcf763bf245e4b0704e029e1c1fa3b517cb3c83f309afaca2f8473000cc061f42778a3debff6a8a9adac55f88e8c814c9da3ce3c214a4125eba0fa9853b5581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf66bdd1b2c4805a6a0f097237d8e76b

SHA1
bfb1e25be51b0b8a542fe312650f406ef03f7b6c

SHA256
b1daad23e9e72118b8142f0b76cd273e085c0f540d0d64e08df5391b12ad4276

SHA512
6104b60f1f9816404c6de8f489a3a5b2c2f5cb91140aeed531b85a4bbaf31af437be5cf73ffa0cb620293326832e721f647ab94cda33eed7a9c9ab05f1a68c15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfff22546903d0497e7000637a10ff16

SHA1
e981dd088302590eef79e2a1bfdccf1a126f2a33

SHA256
a98494413acaad2b681cf7696edfca5fbf935ded49200b640ad499e38e38ca4e

SHA512
df1c74a72ffe1ccf5921545684b7a262eeee841dc2880e350c3e5907a75647e77c1df5dc5138592a3a7d5117db8db0307c52af946866ee80d359e1e177e574a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca0a315dfe6236b92308cc83e6906799

SHA1
73ab51fe63a1dfe57e8e4756f3f4287e2b8b05e2

SHA256
5610293300d462ae28dde6d8751a01c489b2bd2fe1c1a82d114c0c86aabcfe91

SHA512
f7e09c4dd73caa90c05d52edc180053b661ec4fb9481665eb23c019bab514102b51de9fc4f9108f4b522174c681bef1ae512c4e7270ca8cc41aad3f19342b6c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77412b3947d6a9aab4ed5e92959fb592

SHA1
8348c146198dcddd1d448d5e1eb82d2b08fd1dd2

SHA256
c0673d8533480006d9dee930398b33d686da8dc89757a2fa8170ac635e42b075

SHA512
91046fa62d7df18a310d74b9fcc35083a62c79bb3593ca0c141934267863188314382e362fb8152dc3d19fbe4caea3f18d3dab3c82d16d712d0b4ac0d1bb8e61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79b0db1af6c389ac1f1078a8281e81a1

SHA1
b91f09a8e57ca3d729c0cfc2596d688fb657c8a0

SHA256
3834b3cd2dfa56e7d45f2b06d77a5c4cbc71c57c9193a5a4fd610382f1b970cb

SHA512
5cbd9ba7b5b6a281a5d584620616f34c0402a3f842c51f76965146dd083ea7450957276b71b4fdeddb9a3d76f40df48e4d9ad063a35306d74ed632586bb7ae33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93489acc907d10f53dd66314101903ad

SHA1
9edcfb17979a7cbc56e9dd4bb01fe93f6092acf9

SHA256
58a60a506e7cc54a1883d22aca804422f186b182a35441f8e1e44d195b101b4b

SHA512
99d8af8386e99613e2559bb6d645250e82e4f11258a859d33a65139f461f84d9d2ff7b6fb965b22ca0a74a6d5c70ae246246ae036a559f72c680467f71c1c2cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7dedcb9548c16c64e34e22077bdf4d

SHA1
8279db428812599a9f7a25fbe370376eea459faa

SHA256
1613fca7942ffa34f026a78096a28816d3a16bd59029b99e2e5b744ac2f2b024

SHA512
fcc5ec8afd471c95119f4bfeec72572488c208666835d448d73e5354ccabb045a3d4f7a43ede5487cc972bbd197a3988854a75fcd52570115ef967597cdbf9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
464747754fe28c81cf89c2bb00dd2c47

SHA1
9ff4d58f731d6373e432a243e4c5c1b9bf6f89e0

SHA256
337f1360dd61604b3311039289bca09c8fcb47127db653c81ba8d173b78a66c3

SHA512
465ce1d577a25ed6d4ce20b041b1c558b002d9a72048ec56c10b7d4b79e175cc2fad6afdab81366bf520dc2cb47e389988e980257c915f2cc9d7f6ef4be09926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a596f3d0b4efc1660ec8d14b63829cbe

SHA1
c34f66f3be133fa972e46a2056eb126cf9994712

SHA256
7c5f561a0685f2644200c91690befce49b8d57b1176b28589492a111ea554f3a

SHA512
e731a26bd2e8d06693055e03eeff4b9ddede1992f283d3108dc289dc996ed2cb43892480f206981740d27699f869174ad1b46b74c1601a54e3616957202c4b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62059e5966e20cafde673da4c8b041e6

SHA1
a0dd70a63d6f464363929dcc36c98bc56cf0d43a

SHA256
33c884ceb95cca2bd8aeb02437a47a5b87a53e29dc53d036863c194768c0a212

SHA512
a29989f466792854a877e0d203cfa267406de39d4d13557ca4ca2c987685fe4bd1f3ebbec23e45ce0ebf2055435def70ed4663f49581f96b2d8ed8a9a2b26d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c149290a06e30c241b1c88a196b6659f

SHA1
87f3ae7ed17c39eb915c42f0f3f6ef0427ea547a

SHA256
cc3f6077ac767b5d8f5c021ba3b6e989c2752ded2bc83a6f90cc43fa49641601

SHA512
1da27400f4da775ba0e9d9ecdfbb7423a284d78fdface37a0d691639a65b03bfd69e0af4e576aca68518a43691e00dbe30a4c91d56b72bff877580ae713c20aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6df68c33e54da2b99077a1b66c775f02

SHA1
9c7490d8b99e1f53033b41002a90857740015840

SHA256
ee797569524f72c22e318669fd1948ba340c9c34ebd72e04d66475ac83970d70

SHA512
cafc0ea0a01e7cd3f8730f47ad42c1ce0a79ed68abc8e332f958b06a5e68c3126319d9fc96ff1f105a419f6b7d90e2aaf1d8b96f9c3a3e3e485758e9c09dffa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cdd2f937f7eb87e3d2d2536cc0ecf63

SHA1
8ab085546f5d9fb1f04b009c8e59274df0a81df8

SHA256
f4f178b38b3be9b4e8baae0e629075ae296665dd1e262c7d32e69538fb8447d8

SHA512
91eac7d15ba3de57b97f799e04b577c04a9b5f21edf575c54c7c8305ad178191094088fb55e5769ecea5b555a1ae4dcd6abacaa0c62fde555d2973475ae64288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99f8eee2cb3a8cfe853d66b6d93abc95

SHA1
11009d6fe4c084c8ae3974e0cf859321e66e1291

SHA256
ea1792590ddd70e9e8b5f8f38dfeb87388df55656886dceac1af99e9b5502874

SHA512
7c5b97304c9f09355c32bcea43babca0528bfdd699ff57b0b7e13656db52e2a618cd999eb21c3a30905516dd1bfe8cede1c654980703e545bba5cbc87ef5301f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2A9C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BA8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit