22442d487765e55be893d7b769b48bdcc193d537aada4435954d6cbdb0563d86

Analysis

max time kernel
140s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

StudioApp.exe
Size

14.6MB
MD5

ea6ab30812126ed8f703ecabe9f89f00
SHA1

6ca5fc27c598eef84065518e7a649dfe9c1c76a2
SHA256

22442d487765e55be893d7b769b48bdcc193d537aada4435954d6cbdb0563d86
SHA512

117b72096463a6a15ff654a36de4f9024cf494a466b4c0fc3ea867f9614c13c98913efcecc2fe690acd6fe006b5517b787570fa3214c7d3313b8a468876a07de
SSDEEP

393216:9kiIE7YoPQJidQuslSq99oWOv+9fg5SE70AQw:997rPQwdQuSDorvSY5S5At

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3064	StudioApp.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19DC8FD1-C18E-11EE-8AA0-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
988	iexplore.exe
988	iexplore.exe
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE
1676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3064	2104	StudioApp.exe	28
PID 2104 wrote to memory of 3064	2104	StudioApp.exe	28
PID 2104 wrote to memory of 3064	2104	StudioApp.exe	28
PID 988 wrote to memory of 1676	988	iexplore.exe	33
PID 988 wrote to memory of 1676	988	iexplore.exe	33
PID 988 wrote to memory of 1676	988	iexplore.exe	33
PID 988 wrote to memory of 1676	988	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
"C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\StudioApp.exe
  "C:\Users\Admin\AppData\Local\Temp\StudioApp.exe"
  2⤵
  - Loads dropped DLL
  PID:3064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f1efa1768f9b978687f555106826f7

SHA1
2db061973c9408a2ed563fffc66a522c85a5d415

SHA256
095885756c5577fd0a0e0c94b49d9f2dbdfa58defc7bdeba9c405d61c95f847a

SHA512
3e46e0a60388f327e3b0d7daf5210d5fc084de6b5badda34a719e7d63da66c77f941198de956f5f993de6a1ee853af7ed57ebacb48d9705d4b34c24f942c3987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01731f5e92face21227394ffd0c413af

SHA1
358da4cb3fd30245c7ba7aed5a2282a6a7ddbcd0

SHA256
ed11d0f4627bd9d80831cfae9abee478eee3841bf02bf2fbfc7ea03bfbd5ef81

SHA512
0df6bfdb695469ca6da08450a714521691b3a28369aadf8be9c58a21349ae3d1bbb7bae1150e22929c4a60081bf17afa0dd5450e7b563d0e7b73f059fe9cb674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7f94711dfca12cd19ff8e623b1b4ca9

SHA1
6b1b5b5e24969551c1423dc86550ae2f123879b4

SHA256
e9e3a27e90a3d2c24efded3d4f13a4caa0dc6407146b6ee8428630c1b726a9c2

SHA512
61cebf95640c7493562bb90a87e120de1164a5144adee741beb14b7f001a8d427f1f26e5223ae4ad8ecb75ba34d70b6c18d49ba65ae8ce9a524212758259a961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71c825bd03228b68a063d93bfc09bfd6

SHA1
c79b9023089cc3a5c08416508744182a4d47fc0a

SHA256
73dde7b8c1dff01e7c54f04ed508638380344be9698f684ef10271d016e9d7aa

SHA512
dd0265d5927ba3e1994eb4b08ead8f67e45a7f35f819241328b210959b79920dab00907ca9cf64caf887806bff8d858730d6b2e721f6da53b82a0f4a31cacca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f3a48e190e435ee1e0eed3bb109eefe

SHA1
e7b47a5e24efdaff0a7069f425566cd365466320

SHA256
b8cdca30d7018ed029ee7256651cb8479c4691127ba8e9f6d26bbc5afedc19e8

SHA512
e87a3ec5575e4509db9bcc6d3f84a4020ccce7df2ca8f423f1639b7fe580b7f3975e9b551152131f6996d451eac5887dbfae437d44efbdf25dd7fcd311397711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed693d54b39857adc0359fdfda722a5a

SHA1
15418e734af0e94dd31ad1f5ed054ef76f2ded93

SHA256
6be2a4a7a9c77e33904e3d53109dbf1e0f4d55f88b114c8eb7793a597b453de7

SHA512
854dce73a274ee7bb172dfed42bbd6e74379a450edbd6a6f1d05184430c3d3d216d27b2606691edd10e4cf2554e55a348a109e53685d8d81ad64bef97f13c360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22e0b66ecc9b7fb10315f3afb363a6a6

SHA1
ea9a8e5caa2c4bb62563e659c01b01f47176a07b

SHA256
0bf22d58cbac17156f0e667bef6a275f3313ef8ae38e4480008a8903bb640f82

SHA512
a96fa5758758a634fe1d8f2a3dcde89a8f2d245fe4e4e2f8bd13427a4cf670bc52c6bb6bdd10d39b075670fa96b497dd0bbb211d0f18bd6e9b99ed2ba6b19ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc634558a27919ed6f0f33b4eafee10c

SHA1
80ee3fec0e1767c4ba5f2ba95c092052a4615d66

SHA256
9f637c276db8e6ab0ec3c60db8aadabf93c6aac35ca74ba1f9ae27a877090cb8

SHA512
267f8efce72728c9e02e71bf2d1dc813d0eff4325aed2561bfeb0e46855d92840b255d42075b2488d49072811e971dbb19e2283f0ad6fcd3b1f75bc0a52dfb01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
772c5ce03154acba001c60d6a454fe7f

SHA1
565b703284d02fe92db2a2906989eb79886279ed

SHA256
63a43335287ca70362c41f9526e1d3e8b455af533600caf7c9d99b437f9132d2

SHA512
9b9182b9a5520b18f85b68a6078c74d50b071eaba01f304e3ced370d2c4f1fec779de652ef1df5ab4d56b5f387d0ccb8cdb628615a394c2fd5de247bc0aeef73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C5A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CE9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI21042\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit