5dfa7816c521fa59c1e558ca48e39632257afa88b97b901160e2ff97ad63e681

Analysis

max time kernel
117s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.2MB
MD5

df37c89638c65db9a4518b88e79350be
SHA1

6b9ba9fba54fb3aa1b938de218f549078924ac50
SHA256

dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463
SHA512

93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67
SSDEEP

12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ceaf6a63b19c3022c729d8005061b0dc20479150c400346dba6724177f505012000000000e8000000002000020000000cfea21972c41801bfb9d5bfd7c13e31af396fe2374152cd46adc58e341dd050b9000000051454b06ceda7c5620c69e52a7a5939d7b5167547b13ebe41daab1edc53097e3019ac36b9a0a684880ce0569bc489404d0c8fd783462d21f44e55b75eb4879d31459a8213170b4765fee4eae87b1de3a3c09d76ff477536e7b072931f9b5eca2a00b7736b8e72cd7e9ae8524ce928aad989f51d0dee7af4833b482205f998a689e282566d1cd765e58ae0a8e77b8bd2d4000000046a5c880a48702adb4fb2bd8369aa42ed0cea6874fa3a05db4d5a3bf79e2b5a1865f0422cb097993c30caaa93f0d326ff2086f77c6022af074a879f4a283f969	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0360DF1-CF54-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414529236"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0070e4a56163da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000090bf8ee689dfd646d5066891423fd00b4f346794e75af7b58be1ed442042520f000000000e8000000002000020000000e5b9e65ed2fa2eeb09a12125e16778070fed2350fe4fc4a91ca78edb61b4d9cb20000000363b06f8243b0c6f86e97518cd3e19a8b6ee6d585a93bfe2470b75293b59de3140000000a0cac0d072feff5d900bc1ff6a956e62c907c9b8f2fb030e72a2640abbe1f72b742d16c4a2a17f17a4ba666b1c0ec957990bb2e2d9ed52ee3ff576b6701717d1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE
2292	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2292	3052	iexplore.exe	30
PID 3052 wrote to memory of 2292	3052	iexplore.exe	30
PID 3052 wrote to memory of 2292	3052	iexplore.exe	30
PID 3052 wrote to memory of 2292	3052	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6897bd32c8f8eb0dec9905eebbd31b45

SHA1
11935d86e19db47ce8d54a7f059589ea6b6dc534

SHA256
0d996c4be2588651956beb608a58aa6c66745ffb6a0aff65e75d10aec72d9297

SHA512
e5ce3af4a326ddd11bdf9e5e48e0749270946f34cf02cdeca2bdae720625a94e16a50ff734ea2edccfe3688d0214fd47c58840ea952fefb2c9468c0093ec1342

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a62394c9bac8310c618042849db4a27a

SHA1
dcba2eb598e144a91a0cd87ac7229de2b32fbc5c

SHA256
c4881789ca17c26ede68d8b4977c314d40ee3e7ec459172cbc14a4a4aa7b1ba7

SHA512
c40db682615a9b879aa0bc4e68ea013951fdfdade0c67260796e77cfee4acd5e05462f43dc6b7bc52ebeafaff8ed8ffb2ee5eab51059e226d40b96209700da77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c28691a808f2506e36a1478bc073d7f

SHA1
b7835f73f7f5f291c20623dd8a5a003c33aea9dc

SHA256
139d23231dfed5a3f4e07e0c22a65f2151d27113c370be3a3dd5a2aa8b957ccb

SHA512
29778ff72eb980915d7c6dbfb18498bf854fe3177e5856b026c707b5875ecafbefb84c6c8e98e853a92a457f751eb60a1cd03f71adb75b022d16eb15efd9f93f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f648310439e698791c1148ff13b01bc

SHA1
1d89c5e2052634f4faf0c96544708d1fb46df707

SHA256
8bf49a6e9a3263bceb97bacb98a6fef93761261d9059c3887b501e399905efb8

SHA512
f6eb610bcbb7b26521f8e73bba6263deab44518260a76346268e5d50e3227dd16e3a35f427afe1d0259281224e4cb874a10615f0f04d7d8dec013c1f2d6aab26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aab69801a2c166520b3d8c3c7a00a62c

SHA1
8b50e2a9c0836953d98c963857efc135126db3fe

SHA256
7d8894fc9db633922dc23be20ec3406249174199ef2aaf2539e63f91e2d9dfc7

SHA512
5a4635b5f08bb1814dab80144c1a48f4d7736afc475f2244af5008cd5df9d11e91d4c88169bdb7ee511075faa372b348b01eb5848f4f961368d4d9e499a97640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e170c656ce9e16fdcd08d04157a6f119

SHA1
0207ecc640d0e343609ec96329b6df36de6482eb

SHA256
1b9abac192595dc939786b96ec35c3e2a49c465964b5adf2a3799b3e6b4932cb

SHA512
bda7ed673392c439cb587b5acaf4291244a4db97ffde33d70251eb5e24d268cdfe8b70badc932589eede920df4bf0c6a9301f6263a796a7810e577e63c9e83c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94ea3010f60060e5c8d005c4ab4d5918

SHA1
bafb91ffd2d929abd50c9eea61716759d320acb1

SHA256
5863aef8f86b82313d8d65c00be58ec7dc287676961254603d2b029e466b370a

SHA512
d2c86b7ff49e9a2637a57905ef435a250bab65adfc9cd619dcb2e1ee28809df6918809f18b59322c57ca3a5b94136c9b1f004276f39b4dc1c8bdd01a7d974371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0943eda7fe79cb394b5915a14150dce

SHA1
f3762a21a103f7169bf5d3e8ffe6428e2c118360

SHA256
cf39c447fece694eabb73a1f25dc7d7d712a475a33bb0ff98bc204a05b60e46f

SHA512
4d641133223b6ecd1cb8e59cdc07970a7d6bb5d67132e6a21506fbae7b3c37e1c642985ca80e1cc14efbfd2a1473045b2b5700c6159318dffd7be5d904672b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d859527b2c74ff4f2d609df7a6a538c2

SHA1
d8e54861f22fdc2ea467c78cbb0bc1049cbedd90

SHA256
95d286c67d77fddee08095c736bd71f6f799c1f94ef8ccfa205d3c6c8dc06279

SHA512
cdb78705a25ce4024142f0e6e50aab58afd78a2f6015bf76edb1006e0fa4bd4a6d3dccfe57d8a8a08a278c54910dd62399737d116d2b1287e036259af29b983c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17ea04665b9bb42b5ba9d456a30b7086

SHA1
0fce8db885b521376303c9b86f26ea3cacc2403a

SHA256
f378ca0d3c4371dc72e79468099405d12836cdd191a27313f4ffbeb4e77a24b7

SHA512
b2bbbb01d6c79b3ee038a97907dbedabcce34e896ce1f2a05597334426d919a875226c0dd7d687f906a00c7fae74fb16d19253e0176f8e5f51bed73d53bb06e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43999980863a7cd6fd639c48564aaf61

SHA1
e17385614e1b8a258be3d660aa738208e23077fa

SHA256
fded0c7205b3e678b55f77f742a1d91719146696e2ae7feba74c53581402263d

SHA512
2db1708d6eb438c480fc62338dab154f6c6efb48e3f3b43c9514cfb253e48aa31eb7603eef4f92a1684eee2613fe86c08e79707071b0f7173ea86ec4dabbd8fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
765623228a8f1901814dd6db09c90b9f

SHA1
bda5f9137c8c40d997cdaa57fa112fe497363fda

SHA256
1d26e6ac8717f3172918bc500256c57a85a870ded918f4f3a644b5b2aeaa7b60

SHA512
fd493d4ddc9ed1fcb69bf6c77be623b7b7b21aab68f817b14bcc104ea26f1df6380d486e701c3617117727a1da0e340dc104dc1adaacc1d5c9cc50076e62f3cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e14c6cf0ba7541b4be60854048da855

SHA1
c2e42b9f23827b6e07d58901745e1e5b5c0546fa

SHA256
0088b6f19f1224a47cec77e46b722aa6ec9b3ab73bddba4920f18a0058360235

SHA512
25e80054bf830167b7b69a527847200da3a067a825283c45398d5f8fb8cbb6a927d8076dacae4421c9d9caf9c129e086a6f1c702bc64d2072a8a504c6a8272d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit