e3b1c80a7c803366cbd0af1b79524a5baa7f33e211c7ab16a61e2d504ee1a3a3

Analysis

max time kernel
122s
max time network
145s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Vista Activation Crack -100% WORKING and TESTED- PARADOX/READ_ME_FIRST.html
Size

710B
MD5

bcd4a06e9fcec5c9349ab6f4f15d6f1d
SHA1

986a74732b6c46fc1ea285e6c5ba856c3ef986a1
SHA256

f74a0e88ef3aa2441897c57168ad57c59c85f1e7f1f9597bfcfe1fb748b99179
SHA512

0af32487755ccc21a02963c5c695fff1e07da2f7486d8c5150b09eb76549cb5e4dc47343bf5f191492e1d2d8b9a996d9c96e29104a469c771647e915ec7966fb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410283565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000030344b640f36ef7f6f2d9b51cb77d7852f9a04f4bceeaf53c9396558420a9274000000000e8000000002000020000000a37ac7f1022fac78fd3a64297817dc3182947ef1cce84da7028e00fe7098227220000000a61a98bd77cf214a4bfc44db01364c83d493961a4eba976eb63dd89a7311ffa740000000b3e61f2c06aff56bfee09f1baffe0b74aea16aa4758d51c9e5379641890b96ce90bbb6f368258eee1b2823e38919e9cffe0e7ac571e965ecd4c56f4fb426065f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10baee50c43cda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000061e30b8032d4e9d3b951b38203e05cd79d5a5a67bfa51504de54f4f138bc7807000000000e80000000020000200000008e59acb4198bc47e2023e7e4151424e10f031ddfdf9e9ab079b38d4b3fc2189a9000000071d1511c1511e7577edbd5612d8069e5b3f9ce0aff6fa88c03fa97a852cdb793374af2bbbdca14e57f8f79614350e0b8d78f3ae7846cbff0faf40300bfbda37521058d542b1beb595d11a074a2a67e6cee6e09eb9b3dce88e868b54026d10e5e153389f398f1f1994178cb6e8f67f7c60cbb773bb960ae22ba4ef6993355dd408f52171666991f7ada71875c88463c8540000000d9997dbb7f7136dc26cd8525370f7999ff035b19122b08a262a52d8088d4eb670659125412fa7651dae7ac4c991772519d8591bb0b01832646877dd2d79eb28b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D029BC1-A8B7-11EE-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE
2960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28
PID 2088 wrote to memory of 2960	2088	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Vista Activation Crack -100% WORKING and TESTED- PARADOX\READ_ME_FIRST.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
71189bc9ddead0a83bcdd32a557b8654

SHA1
62e09e0e2d29d22cc8f41fa1d69bec32f274d972

SHA256
64d15c72d49ffe27133ca89b876c237b45d088318b462726f1f22d9da47f71f4

SHA512
d9d86bbb9f0d32764ef587c91f5bc0d573b2842159359b6ae79f09360e160871b0d6a3553e44e83b853642ee26efc54f8a2c581398409a411e9936e2691f6018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
82b8ab43019e8e515899f5f0b69f3c33

SHA1
61dd5c10a65efd5e0dc7afb42883eb553bbe310b

SHA256
592e14722bc7275a5404b2dacaaa5b525ad15b47fb5f29fdb8209d912d5466c2

SHA512
dd05888098beedf1ed2a191fce34c8ea479b6518c7302b796aa21ecd7fff820dcc7db63e2c8bc585123d78b403393e2d4dbb2162465d325e9424fc462f36211c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ab596c7c1874f030adda48299fc74223

SHA1
0384c08e49c65caf1e6b00560ae529e800160aeb

SHA256
6cf8d6a839f0194aa2025edf3e92fce8fbaa3a64085253921c1d96a217c80be7

SHA512
65fbdf33740d93046116504d1b125e979b6cf70efa58b87d2dc6a9923dd9f6f450deecf68b7a67b2f124e9cc6fd5706fed2ca3b3f51fcd8c6ea81feff7c28934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b22b96cbcd60ee3e3f41d387999f233

SHA1
22821eee765b6409299675fc59a9da5112544fe2

SHA256
57380e67642fde2d31ae0e50271bc3aa64b782df9f18950a0fed9d71a471da71

SHA512
566f6bdfc749873d49b7d2d46c28a2477df3ebb6b30524fa93d6932c7d50a029f776aef8e18a5f10cbf7bf1d7106db45b0013ef6ea9bc78a0cad3917a3a443a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30b0c86e279a2010e24fccb5320b8055

SHA1
d6fd787f382258380cefff32e764216221623224

SHA256
e58e8e9ba5e088d811f2c2a19dc1fca56456ab4e2c1a0647d47156b1315a70f9

SHA512
4f12f8714a884b4dd8b2cbc1011edcf1493b0d6d86f8f8944e060b4b1ed9559f57d7a9d14946a605bba25a82b3ba98e15401c52086c5d3a3bee43caa9ba05435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42930bfb700eae7fc2ddf8022c9fbec6

SHA1
8be21bf3ac6bc54326804dbb41dd32699e4d9439

SHA256
7ff33ad9c78a8b66701451c2a374348d432c869023f8f84471ddc280851449dd

SHA512
7b91b95d1eb1f23a7e9975ddefcb571a1f4907adf2ca55736ab4362996ae494383b0ed6162c34585d1b68159c9c3bab60a07a294cbe55ba89668224991dc04bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14f4e2874f3a5dda3af307afa22f601a

SHA1
f5519ce71c35dca71b205da3413ee94b826e0286

SHA256
b5da47c553cf9fa7e2fb585bc41a9d3b61b63f4326499755e3690820ae2b0862

SHA512
6302db2a7bf26e0b69fdba7ebc45e70077f0ad88d626b5b868b78e9b04c5e3df4e4852e258981ed3293f1cfb24b9c2e81a486470265a9090db33440bd89886de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f54926d4508443bb8aa77db1e407df90

SHA1
100e62e9258e8195913d39e78d347d88fc469ee6

SHA256
570a4520fe378d89553e77b0bbb105bfa5b0957ec4256f5ff99192af39cfaed7

SHA512
3e18507d1ca0d7df5f0161db7e6678f37562228054ae636cc30839938f712c0ea452c010866ca8fad04fe65c90f13cbc5c78e23148bea29a7c6323f3b6720ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61f6c3fdf441c3735a9860b8df628d94

SHA1
c294c5f87701b4d2ded40da79aa46054a1cc549c

SHA256
f4b30c0542da80e4afcd53b9fc662b95049f6f3577e731cbd7fd95a958b151d0

SHA512
fb6b6d046d7da4e500e683b44c2a6799e26f9f78426d7a864fab067ffc5095db5d5445fb815aa795a357af4e1028bffce0c5dfcabf6e21ffdd0d5bf9091da83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84eee3fb6d3f5722673d663e3a1e80d6

SHA1
9db344dda277589dd08654981e47365934313f9f

SHA256
72f9fd1e2982a6c13eb5321c9dc5cea6d3e5b6a05e78b62e92b23e26af7a85ab

SHA512
64eb626bbca7bb44af1571d125a87b478aa1c25577cef9a7f1eda1fd972cb037855edabaaa3b46ba1ba4d09aae1340c4f9b0e13a94639652ada7523b1c37b2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
54c13c7ac2a3d48ba2282696175cf0b6

SHA1
0add8c49da704b1affa349f1ebee26a9a86699e2

SHA256
f28d1e205f701fc2974977e12c711f0805661fd455963c57ddd6f2d7023db277

SHA512
8f03cbd657c5cbdd39f6e046476048e9a9b35955e5acb8037d810485cc177fa977344448a7478b555c98481a74f87ec720e752fae6289ff8c15e0aff21ae9670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2330.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit