d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
16-01-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bitdo_firmware_updater_win.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105fd7a91848da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000a9db1e02918cc0c1438363275a906e2a2248bf9f026b1782f4e95fbe0fbe3f85000000000e80000000020000200000006f06e8a460f5a6e6c46edd63ff31f6aa862828cb66a47534e30358e00b6c2022900000002e7340b5059900d29f33137f404d943b4f7f61665b9269e8000bd118d69c01a36ccc1fca2ece40e57dc62eaaee058ac80b4abd7aa38962028a4faa5f4023a2c9d65ded5da61aea2c57369c5ace6b4e213aa106c49bd196a0f22056cc7cce1bc86b35573b8c9d1d0cb576028a3ed278f47fd8439fae230f8e37e048760a49ffa3dd14c0104c5af77acfdc6de35dc36f3a4000000064351cc023acc375e8660de90ed3dbf914084625e78e45a2b2e8da2c1592dec53739d46263742d1fc865e8ca4cde078e10f8f3906fd9c77e34ffbe0d1327bd30	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D50D5221-B40B-11EE-8C00-76B33C18F4CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000005694528d37ce977e27cc58470e7fa6504f1fab772aa4f78c6b5cfd0639128c2000000000e80000000020000200000000246e8d2afa6ca4aaccf684153ca5d832de24e0e9f66fb5472d6f9262a4752402000000029d0b9a23cac6c4271dd7b6da1fa2f4a64359219f00bc17aed94533afc331a25400000003e8b2b3ea61219d8e8bdf8c7ec1983ff379e9d19e99046aa9371c4e0df34cb7a37099bdcc009a206dfd935bf1b68df5696a7f127ef8da4711ae313a100ae405f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411529221"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1728	iexplore.exe
1728	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2188	1728	iexplore.exe	28
PID 1728 wrote to memory of 2188	1728	iexplore.exe	28
PID 1728 wrote to memory of 2188	1728	iexplore.exe	28
PID 1728 wrote to memory of 2188	1728	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bitdo_firmware_updater_win.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edc1dccd292edb3ebc1016735595469c

SHA1
b1d77498304c4cad83231c2f248af5f48cb33330

SHA256
8a5cc71667b7957f3d7bb92274a9962011a8eb9cb69f5eea6235b63b17f4895d

SHA512
0d8b91421bf7a9e8a7ae92dbcfcfb95c872914db3e8c81b7faa22aacbf2db3b5b3f830bce8d2952817061313806f8c26ff43f45644be5003a33da845856c51c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4db9b3ca0828a37d0a699f3c3f63ecf

SHA1
e4323391cbe657a681f289e358e56b310d8aab75

SHA256
9cf5711071f0eec95f6bb38aafdcfc95875d6916b606f5b2fbb5075e25014e01

SHA512
a6234a493d0ef41db70830d30da56cc34135bf78dc4c90608985606e0a1e753c5fcfdcafd12ac49fbd1937e6f82db5d80b15f090839ac51c874d6b2eda1f28a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b00d61a3dccb857f35438d1036b57f95

SHA1
77bb2b63441c4c9a96ca1096aac61e8f695320de

SHA256
1c2f3b8603a77acb45335aedec671c37c98be091f2690a1e23ead31e6452bc92

SHA512
01258a40803801ca4bc4a00eb3c7da49bb15f983b3bf6720a8f87afd8244976e7de0adc8dc0c99049dba9e4c70d828eda38f11d5e481946ab7091a0d06876085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39664b9355eb39ea4e628760d6a003e7

SHA1
6d1cc7869292b8123309933b22787b7baca5a0de

SHA256
a40d9d45a28cd876ce13d768546990c4c4de01c88bcb6803da2a8218747827c0

SHA512
06402acf906955d5d9b1910768f8707461d5b3580025df936d13fa2e69008b03335c0bf716e8ff2e56a983c146effa2e458e90719f2c51b4f8c882d9658e64d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcb500b45216313e96a7026386efe960

SHA1
9b30f85ac630cf3c43ef24c4aab96efcc3a02161

SHA256
3905c260b8eed38a76e3d2bc4531bd1de29261dbcfab1baef17c96e245b485bf

SHA512
79f6ae3390de425339b063c2425c2cab4fdab7f489e89ec6d918ad71dd4fd210678fc30b50e6ae693237ea62a7173bb3cbfb6199eb8a1df616431b9bbeab2284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8e1e30bc004bb1ccd5f08c0af99b9ce

SHA1
9797e390a8fbdfa2528639b9733b173996225dc8

SHA256
9769fa301c0637a193e8c3148e734ae022cc9b688e84fb94855e6eaf77a21ba1

SHA512
40d6fddbf70e56a20bb80a6086cd68f96dd6630d7e5876869b145c2b9297198c2018c833e4596a9db15aab434b4512f13f3708d74b44c053bec4ea0f73ca1775

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7b9c4ed9901e378fa0834a85d05c27c

SHA1
e46492c7c227680b1fd05f6c6a92501ca0180645

SHA256
56df4dbca320a16ff7bd796727d948155a5ab54c1d50c41081287b6abef96922

SHA512
ef0d90b570e68e1ef6dc3460f6986ed973024b0faf834e17f39bee930d7ff17ada03753ab6ad6e80bf04335d8ebce4a1cd9044fc5201efc865edaa2bc593258b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b868fdaef7040f8ae98f00be35afc51e

SHA1
fbd373ae912360d7b229231c268c4c01d3fff563

SHA256
4f10853c6e22c9e43af07f198a79ab3123dd048570de3474be4cff1b7cbaaad5

SHA512
c3d03b42f7d7656ab2c847e660ae529ddf4c0cb29ef2421793c7437106b8c0b18bb24bbdd1576feba6e4f8e645e2da7ef4292be390418cd6a97c9621d57a3fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3871c1de075fbefb7fec95faf1179372

SHA1
a2e3432e1ac5dff9872905a34b59f4a96ced88a6

SHA256
e680058a7578c7dc103fb32ed78430de515c3acaa39d4a8dae86b2649e04c350

SHA512
db8405375b477ae1dbf931ccbc406d15de71e97589f2b8aeea1993f758cfcef9699b26ec10a8f7b124d2bb6c49e0bcfcfee203db4ca599ae63083719a3e13299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e35e61f88b93beaf3120ab1163668cd9

SHA1
71dd12e94b9e5dde96c46cb1f777a973f9311425

SHA256
0d94b55c057719847928145c574a9149ad1133258798dea1f0e55b81c50d0017

SHA512
253559420b17169b8015c1feccc75dc5e7d185892694191540a0b3b08996943e517336eb464100e25a2b5f85f88328bf5ef195b948cec25f83e6dec3fb04d3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c0d62d2f7dd3dd07249e04e045056f1

SHA1
4628f031f911e814d67c0e530ff40df41a7f59db

SHA256
f5e1b87e5da05cffb73d132c85c7778149351d1d7fd6cd2b9c90126c216b00f7

SHA512
db3f553356534600676c05ac2b8737bc89a94bd3081ed10540af25fe23b225bc7d55e88f48ec7fb9546616d247bc0d42ac678e29c93dfc7b2402e24ca91c0823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c26b792266c4a865245b8275d06e32

SHA1
0da38d1fb30ab45ef5c367d94b0a2533ac538996

SHA256
b094faf2993ea7df4409ff510d08fe271384d532fe0645c0d6d3291f8bc26aab

SHA512
e5d4918b08bb2eb55dea8767bcb83e76ae32a92e348dc68fe57573a795c92b980bd6e6440387af231787ebaf76804801b6de949a5db81372ec5cfb5b0bcf3a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec922679f252c61bbf1f644446237b10

SHA1
5d12d27afe10aa8815a49aac48de596364d2bbf7

SHA256
db361fc6790231f2d3312d85f6303abf727c3989403fd082deba70145e58a96c

SHA512
7e7eb21955b32791bc647ad4e72edc110a8209221af3a533c4f39548fc937761a4e00d83ff9f9ffb2570851c7d2900b0fbd71528edfc83781b19af8bd62ea9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a27158af1718316e8e8a75cf5bafd76

SHA1
7d0cdbc93a0379268144cd0ad259c98314d0ad50

SHA256
44cd34c1a7efc430d5278ffd1c6430bdfccd8cbffa3d1fefee8c03ee0e921974

SHA512
aafdd8c673f0f02591d92507c6948fa6ad47e4e9b5dc5957f4c8ec74f11619d9614f30a6ef5579cafdd760b1864a1b34f8220f7f34f03377f139a7c679f872d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4EAF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F4E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit