d00dbc60cedf79cc659de41ddb47441fef5fe3180369c812f19bb4cb05542fee

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 21:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3de3630f7b88ade13cc99644dd2f2f22.exe
Size

213KB
MD5

3de3630f7b88ade13cc99644dd2f2f22
SHA1

6333a3cc4daf7e92e58834c62a9a36c9ca9baec0
SHA256

d00dbc60cedf79cc659de41ddb47441fef5fe3180369c812f19bb4cb05542fee
SHA512

073758742de63b379bb9f1c4cadd7afbb2e7a641df8a8ba91198f1aca15789ba3a40c02d1e85c77abf6120bf79c32dd318eb681bbde7fcf05083a2ebee0cd1a9
SSDEEP

3072:y62MonpU9tw04VQJM6216XzD8areAEP/lQgWu6OWVcoGgsmOKh/v6nv6DNE:T2MAU9yfoFn7qJ3lm8ct1RDS

Score

7^/10

evasion trojan upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-1-0x0000000000400000-0x000000000057A000-memory.dmp	upx
behavioral1/memory/2212-24-0x0000000000400000-0x000000000057A000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3de3630f7b88ade13cc99644dd2f2f22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e1f421c838c2c47b67c5ad1017cdf5c28f45b770e0a51b3aa1bdb58e32e95502000000000e80000000020000200000006e5b6544473225968a79c82243ace5e2bf018380bd02b36a79b1201cc0b191b020000000118d2cc3875258c8ac86c70066b092543788abfb967432eb850f50e9441b3cf6400000003b609aefacbaa8fea53a59a63e2bdfc3123caa4d00dcda536f3f103ba76c2199c816155cb8e6c10aa0acf2d09311bbad980133ba07ddd0fa1c1cad51925617a5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30989ba5f63cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410305129"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C3C526A1-A8E9-11EE-8837-E6629DF8543F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000059646969676b15cceaf71513b76e12a959d7105c99f0de8dcd2a50f3cde14aa6000000000e80000000020000200000000c1ea7d0a69bb3a1520e235bf3f74505edb3682d148a1062a68ff0cc53d01f51900000006d8189ad113f035270f5fbd90b34917261d821f7e5c0ec8889f6a7a05fa3d8c0ac10ca5b8edff173d5f5c9950ee6a692b4d9e8ef99d7fb6a3f468d74523f3469e94bf9c25c5a8bf3b2ee2250a9101e842ea44f94e456cdc5fefcedbc16c166512c14bbeb0002ba8b37a713e7eae7b5e197dbe6b3b8eaa1a2d8357eb3d87438fa1574ee88c12a360b84cc97152205e3d4400000002fe58b11059eeaa28d4e420eafeb078a1db05bce20ebca53f0d59378fd86eee821a87ae68f5e5d1a12536c82550f207043cb84e04ba8618dfa23baf460dd6239	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	3de3630f7b88ade13cc99644dd2f2f22.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2212	3de3630f7b88ade13cc99644dd2f2f22.exe
2212	3de3630f7b88ade13cc99644dd2f2f22.exe
2212	3de3630f7b88ade13cc99644dd2f2f22.exe
2864	iexplore.exe
2864	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2864	2212	3de3630f7b88ade13cc99644dd2f2f22.exe	29
PID 2212 wrote to memory of 2864	2212	3de3630f7b88ade13cc99644dd2f2f22.exe	29
PID 2212 wrote to memory of 2864	2212	3de3630f7b88ade13cc99644dd2f2f22.exe	29
PID 2212 wrote to memory of 2864	2212	3de3630f7b88ade13cc99644dd2f2f22.exe	29
PID 2864 wrote to memory of 2704	2864	iexplore.exe	30
PID 2864 wrote to memory of 2704	2864	iexplore.exe	30
PID 2864 wrote to memory of 2704	2864	iexplore.exe	30
PID 2864 wrote to memory of 2704	2864	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\3de3630f7b88ade13cc99644dd2f2f22.exe
"C:\Users\Admin\AppData\Local\Temp\3de3630f7b88ade13cc99644dd2f2f22.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.regnow.com/softsell/visitor.cgi?affiliate=36566&action=site&vendor=5838&ref=http://www.fenomen-games.com/files/kenny_adventure_demo_aff36566.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7486e1f3eb53252983346686d165b5af

SHA1
38e0f1409e9d83d5f541db774dd1124b551d3e31

SHA256
1c67cda7af29d1648e46fc1c7c552425d5147bc6d8c468ae675aa0e3b22286ea

SHA512
b80895763d6628137f38a706b9bdcaa9f650c95100088758422186d0fa2b6e6d98f2d75fb639b7c3a6cdc10392c3804f78dfb9b58c110699479a2f433d87078a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb73f40b1624197280855c027b59563b

SHA1
a5299e4b18e56edef312f38e6ad7e7b091e4b8ad

SHA256
5858300e0b756db4f0d87a7818da62ea5342664f9cef067ea60903b5033b4d0b

SHA512
8d36485103ed246c2b6159395d52f63f79d734be73f24b266bcc88ac7c39a1104726f02a7b3f3a07dbf83b7fb95351c2a4c4ec84e833e4f3b208c70c6e5459c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8586545f1b39478f4ce20bb4f99809aa

SHA1
81f964e4735cba10d845ab3eca8277a8be0ee2a6

SHA256
7edbbe02469a82a2bd8acd634e76d8d45ffdb804902aa48b7d61717d2b41c0a6

SHA512
bd5d217ad52da4307eef0d652fd8555f133e891ae8a3e8727bbbc9a7f98ccc64f93190eb24884b0a3df721e4bda335122558418b69a5efd7241c289766f7f0cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58659ea028406e619d6e873ab96e93db

SHA1
253e80b26946c02a228882512bdfd0f59bfdc748

SHA256
30d8893084db063c34f4c5ffe03a807e93aba67d7c7b404bd72cbd17bad7df58

SHA512
c24d420b8abc6116875049d74260bd5686cfc623ad364f9fcdd722c8d9a55ff02f4795ac5e576023d5d511b33d60d5d599f7770b61cbaf227a36daee2ba5ba32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eec517b45e021df56aefdb0c639a58f0

SHA1
d5abf74cee6bb694842362fcb22b824a19e0ef48

SHA256
30eb3c420eeede322f69e8beb2fa5527b1d925fbd273eab0b60428845b546250

SHA512
8247fa70218d785f59319b71afbce76412c2467a569a7fd4bc54162dd203e0851dc8249ea73cb0296e3c261ec79bd3a1fec750763de16c1ab605441cda8c7827

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7C92.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7CC4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2212-1-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download
memory/2212-24-0x0000000000400000-0x000000000057A000-memory.dmp

Filesize
1.5MB

Download