02a5f48e0286c3462301b1f6f323d79683018bb4b9ca869e2add59edc3762137

Analysis

max time kernel
131s
max time network
160s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183ccd51888da52faaf6bbb22d689eaa.exe
Size

1.7MB
MD5

183ccd51888da52faaf6bbb22d689eaa
SHA1

83fc7d6ec156ee3fe875da13b2946f785f9603ca
SHA256

02a5f48e0286c3462301b1f6f323d79683018bb4b9ca869e2add59edc3762137
SHA512

02c1a1b9725865967acd245ede2334cd785b7f1e6094b699c67ffb0690634af7768f4e9173278d276fa08cb0bc75948832f4c153661d7fa02f710cc2c6560f47
SSDEEP

12288:dPlisTgjgcOB4RRHOJr/TJGBXUx1Qo0Bkr4XbAOeeeZeeeeEhMEr6CX4zistI:dlisTgjgcOI5UoHBkULAuaE6ti/

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	183ccd51888da52faaf6bbb22d689eaa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302a80ea273cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F197EDD1-A81A-11EE-BCA6-6A53A263E8F2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410216296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	183ccd51888da52faaf6bbb22d689eaa.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001c51f847d8be115763452453bba394b4c4270b33298f4e8d3f59f91eef5baeaf000000000e8000000002000020000000e78465b6db1d5343b47666a43cb2241807554a844bea09416b409e28c29ad281900000002ab51ef5003f0771c2e5856b2ba589e5c7dddeba009f4d7b86d043f5c31ce31b5e03a527948e4d45bdd14e6096cfe11d1e1353ea863e3010b1c9b86d140a5ba16cab0ef0203f579491fb3d90b967d65eb5b8b70f11d8eac85848986e059f0686c23816d50215b7cc317e0ce2f02e7e5d25268ec97669259edd263ef5a1d543c7afb25ad97a35753a0bce54f4bc2059a440000000f24b272e097e6197e1bf7e815b7579b67dbe1f1c8dbec858bbc5f446663f8d21e9c2c9e4e4ef6507205af50e68b549abf775ac83a5e60aeb4414743e1b6077c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c0bfd128a051de89de4b89e6764dadcbe1b6a7ce0fc046d9289db8f2e61a0712000000000e800000000200002000000084e8757413e9adb93cad8d50adaeeea722570dc32449e3dd54755323ee4edb5920000000f78fa4ceaa4af7bcf4b34930d288b21519a50ade2c40a933edc72384326cb01940000000c6a6ec3c1d8a3f4c43e708c21a70bdbc91c89a017253bd446d4a754ca0d80475278c21ccc8d26f6b98d6c48fb2df55785203c2399380da30463ad7856e704493	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
532	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1664	183ccd51888da52faaf6bbb22d689eaa.exe
1664	183ccd51888da52faaf6bbb22d689eaa.exe
1664	183ccd51888da52faaf6bbb22d689eaa.exe
532	iexplore.exe
532	iexplore.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 532	1664	183ccd51888da52faaf6bbb22d689eaa.exe	32
PID 1664 wrote to memory of 532	1664	183ccd51888da52faaf6bbb22d689eaa.exe	32
PID 1664 wrote to memory of 532	1664	183ccd51888da52faaf6bbb22d689eaa.exe	32
PID 1664 wrote to memory of 532	1664	183ccd51888da52faaf6bbb22d689eaa.exe	32
PID 532 wrote to memory of 1564	532	iexplore.exe	33
PID 532 wrote to memory of 1564	532	iexplore.exe	33
PID 532 wrote to memory of 1564	532	iexplore.exe	33
PID 532 wrote to memory of 1564	532	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\183ccd51888da52faaf6bbb22d689eaa.exe
"C:\Users\Admin\AppData\Local\Temp\183ccd51888da52faaf6bbb22d689eaa.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.gamecentersolution.com/downloadgame.aspx?CID=21157&AID=909
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2498a7d27f3a23be4222e2deba960501

SHA1
1ff905e707d895a95e8b1738ee31a4422d49f863

SHA256
a58c7e4987b3ce0abca3c58c812c4d0da203ee5397e201e41411e4304a34ef53

SHA512
c2ec69e382469e45b5296566fd6756ba2b9a523033f274ae75dbed7f112f6043ba16cd612645078a01a5150743ad83c14d9a4570c3d2068c792dbc8d522a25d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4193e080738f1ee7277f1aa5659b3d4

SHA1
7257d83e6f4fe8f6231f0b93865a48f41263c36c

SHA256
24a15f062e02b8fbfce758763849c3966061a958c9683acf3d2d32016c6ac0e2

SHA512
6365884b5766e6a99d8abcb4042f7c54a7638766091a67ed5070dbe024fd30113b5c030a83441673c80eb70f93c0a42e980bc787936632ce045b7cb18373a2da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f8ce554808f3e9dc0a5aded8386e11

SHA1
f707782fdbee7ae219eccdf7c4b32560370961d4

SHA256
8346d3a8f878d2864bfb02492f3a27e3de4972dbdcfad463bc59b200407330dd

SHA512
bd9aa64460dcc4b97b55ca44b1b38b51d6f8e53f0f2153ccc8071f6f4d28af6f7b7573f513f49e711cf3a4abda529386968bbe8639d2579d59a03e6106f9c7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d04480c20d0ef22344532a245261c4e

SHA1
5c4a216d6d3da86e5f30737aeb4233b01f3f0c25

SHA256
2f69e5a18f70ef66810278e78b551444cba2e412e3c3444d25189c3966c2df5c

SHA512
c533e1dbafafc296b50e7584190e02fd0be38995786c7f1904e678bfcc6d65406fae3afaa0e60e608072ea8526245de4fd2848eff621413f9ccee4886040e982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
207f5390dafd60734498a7218fd105c4

SHA1
f337ce1e8b708aaa4b871831bf35ddc53b836e67

SHA256
0279e5a7f42578740e00bcf5c6c6870d86284ac6504693a06a1750ac1d6a1eeb

SHA512
bf5a6f648d69c5b92fb58518b0c8c04121d47816556758db28ac5aac699749c19244d134bde3cd5ceb49addf01874e591b4ed77b2928d3c7674289d30478793b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d38cf3488b2eb0d5f344daa1ae763e17

SHA1
e775c96661c26dd124d823317e5b7b0e7e53f1e5

SHA256
91a0e10c19f22253201d465b15b5d342f3fd57038e66ddc1f98db081656b286e

SHA512
8f3675228258c66152e14792ef04abdc6e98935c87e65b12b081b13b48d2eb2ee2073bfd32676e7b012963edacc45d69ae0bef5438ebb3d61c61f38bf0fb219b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02c8921ab1e2f2a233c30bac400d9521

SHA1
909ff6353769126d95d45f6b2f2046845d5e8e08

SHA256
2b89ee386389ef5b0ceed7445e63d7b390c97e82377049721a0cd609352e4449

SHA512
2d467fabf5f2af76a300e39d98e9bfad89c416c21008d622c364326b2db0d578aa0b6d75fb9110db6077c4dcc9ef8f7d4e9786f5d6bf33dfa13abff983414584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f4d21718676ff8d20a7122f3af34247

SHA1
afcf47b2a12b97b5e52578455cc406d59b99da5f

SHA256
f794cbf2c63605e442ab6138ec8e0e7c04774c85dd3f6804118225018e4391f8

SHA512
30abf1d7af31925ac64d243eaeb309b3819d13a3891e1f86809bc8af80010156460154252a50d9505ca3131b16210a21ad3a9b4085261e54d1a2ca8742abceea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd04baaad293182d4f676ffe38cbc3f1

SHA1
6f9d46d4b56350135cd8d96cbf5757c0a55e2855

SHA256
c7af71780e6115949f763aa279044f76729dbb47649ab2bbaaaabe2842e6f609

SHA512
852b5c4ae44ee00c17d69cbeb42b9b0b7d0c8c08bfdbb8278923e205e3422a5b566ba26a44568f7d5af225b9f62662f0edc17bdde81c8a1492ace1ced0437823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d1f3222d6f147cad23bae4d15dbaf15

SHA1
381fc30be552e6b7868769423dff457b0fb8c8eb

SHA256
ed0a3c2c040f0aa4da25c46ad499b5c43cb8f0d45cec27d7e10542f2a64b4da0

SHA512
dce1c6452b0b53bc9840e7a76e0312dd3268369787822f46065f3a9aded8ab122da916171ee38a62238921c187a632478b3e45ba2c6547b93dd06766d6388fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C61.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FG.url

Filesize
192B

MD5
0fcf82b5a915470e8a79d3516f582a36

SHA1
75f81b41607905b231521243129aff3554a58db0

SHA256
076264d4f165cef82f0cb07f6795f1d5ffa74741a943fca42cdeac65823bcae4

SHA512
adf69ec56756fe672677b039cb44bb13fc3adfac569f5ea4eda4e7b35de5ebe0229c5825ca8337aa2c623a773bdf775ddd3689e9fae03a7af1f694576d954293

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D0F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/1664-0-0x0000000000400000-0x00000000005B8000-memory.dmp

Filesize
1.7MB

Download