b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

6.5MB
MD5

60afa16cbc3798cb1352314311e93a07
SHA1

0a9daab3a20586ab2a07cd2857a2f2cd65c25d32
SHA256

ec105b4cf1588e28ebd596b2c354e44b4fe2cce5e6d5abbc7174ec7be3df6a09
SHA512

839905cb7d697ae77beba74a3c82e65d1d6328c62fea6933fd8d490231d1a6bffd692fdbaffee86483ae967e86fd0772fb2bb327b054d08fc0c9177f3c9c26fa
SSDEEP

24576:kP5T5WfWSJbJlAV8gmfwN6i6w6C6g6T9GHpbUBpUY:vuw9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAF6DB11-DB1E-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5027d78f2b6fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000001be9ee02a2a420d5607d69f9216c541643a40097634294b5b25c4c7708a1ca30000000000e800000000200002000000004351c04ff181cdd5a722b74f450e6bdc24e90e82cad50322693a45ccd5c8c8e9000000055b3998f470c72ca4ddc42785714514495b06e1f1670fb5d50288592c7f20e2013f0d34d83c3741cfbc6bcbc96f083ada376563a7a622b0dcad9bf0d5fa4692824f965b146ec64ae57494edc789fb62689790eef5653b6a5ea1f4ee900cd72fe1f21e8425a32f1c3bf7dcc93ef39eb335329315c2f457bc64bbf668cc49655eda1bcf9d3aecbbe9963a3b9eaca264a8340000000bad7c46e70fe0604f1e69354e5631300920111b144b6a3206e5ac7e057b3bcb5df677556d8b92ad99f39a593136e04dbf4685d390424e4139492c75057aa9cae	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415825422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000c95582b59b70463db0b4a4c4637abd773c7ed921f9eeb942bb111d69e08bbec5000000000e80000000020000200000003b15f44005ff5fc4e1ccd26419160c0e96d89a21ff6126800a036d73eb1409fb200000002a3ed1bee31a16f7c71376ca7c510bff0ff0d653b11a8f2fca606c5b506c208440000000ec6cf2503a2a75f94103471dbeba40548fdc2ac26f2a3236fc81af87fe199fb963bd10a641c665f34aaeb2290ce5d78091af041195799b03a60e16b9391688be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 3048	2240	iexplore.exe	28
PID 2240 wrote to memory of 3048	2240	iexplore.exe	28
PID 2240 wrote to memory of 3048	2240	iexplore.exe	28
PID 2240 wrote to memory of 3048	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b042abf7a7223a92c976bcc7077ded5

SHA1
538e2e8ddcc2758b0d274d6078965867efaa57d3

SHA256
75f97850b442b4c9550d726a6bbb55f7f5ee135b439327cbf5a5854466f7a961

SHA512
7158bb0ff9dd5f01c1412b7ea0570491484e36cb40467c344c6aacf878314c49c6f33534618111d5d838885c5a6df5a6f1d00d79263cee306119d917dfc76ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce809f750fd4bda80f1a148bdf646e35

SHA1
e63a1e18dc5eebeb1b51364b4dbde127633aa4c0

SHA256
d746c69e2f9c477bc0f4640b1152cb059e659d258a41354cdf2f4c982a38dbe1

SHA512
015f242a338f2600036d0c34a4f138646f96168fc6adbf44ec4d4112ddfffa4ce0d1e74dc7e5666c1b282b2e241422a1682fd214bbd92d7b62b6e060a3846ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9ddae10767256fb53db542044505390

SHA1
1e9336f42a38a7c204542a0614f2d33653b700f1

SHA256
f5c00a8e912037835b61390e931e71b70254eaca8fab9ce8e51c32467148a1e7

SHA512
e1dc4e8b92985e533fdf27dbc6e8c4843aa0863fbb18c705bf1e2943d42113220380eea245cf503fbd98c25fcbd22f73c639b8fbce9cc83092ea006f6a0f2333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6298a28a4f1056c77055989502e68a6

SHA1
3784305e28e687f79b1bafe3a2c0ddd6edebdcd7

SHA256
55ef05bbf06fa7d7e0e1f84e3e6e9e76e878e9bfcadde3bff839a4cb296a2df6

SHA512
01685e5e01efb667131c916806756723d05c3397d7f0c89bd175f4220480f59ad5ae5633b523238444af97550ccf0ee6d4a8bc61b4a6c30702652fa61ad68df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a47192d64385ba547080e147f04da9b0

SHA1
faf5016afe47365f903a014b5222fa1d26297db8

SHA256
49f5d335d897f11757ae42c841935e3cc5e76cc13a35666a9c232bcf13a69873

SHA512
c3fd189571ffca29c5e164b974a8793a67a5c147af6217066838da806b84d0a3b717a55bd72e7ad2a25effbdc69facde6f8499a5298e0122a3c200556145c71c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efd1b15f8fb33520d9744e4b2a8c93f0

SHA1
b01e6bb023ebd09cd64a7e1a46eb18881ebe4919

SHA256
ce9823333777fb5c11762d3c6f379ba8dfd2fa5f64a922ddf7357e740fd54615

SHA512
7c853be9138d60e5c53d784c9655985acd59a33526611b3614abfd276901637e550027390c2d90cf8d46a7b5f734078cdec23a46bbdf0861df58b885d4bf98f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6e97b646b5f840b08bc25bba6f978eb

SHA1
b6c297765c67e7dbdea7289e1173748617a46517

SHA256
064963e4630753f8a96b25ed1b4c60518df2e6613374ddf73122e46e209cf715

SHA512
f7d2ac09586eb3f3276788ae8e719542ba8fd53466741cd56ab29b75b8366d2e65345373d57d32a5b5574f8422b3edf39f4bdc1e6b4715e20be0ab051c4ecf99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae9e307ae0ae2467e410755b4aa6ab5f

SHA1
d08ded7a0b59e9197fd1557f8bd96dc79bc4db7f

SHA256
dd9940b353ef1f3c8f85d1596f4d9c8a1a58700bcc48593256badfb9b85c265d

SHA512
0f417249d25f4c1f83293d92b8d04122dc69241c25c0b0e95f020948466f2250dba08352a7b0286d4c187271148776f92672f5cc28e8278d3ecafee0e16d57fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b7ea1e2b7ae7805aa09124c3f913cd5

SHA1
21857d1fa3a9ae6c34b0d1262d6b556818ef1f6e

SHA256
f5113ff9cddc3440739995d78013ec7aaac3d1bda2b3dbd9c8dbf06eadd878a9

SHA512
0eb35f9b6631a10d83a3387960f295e27677e6148a029b61360de8ed6319fd3cffb7a7d36f44dacfa0fa58613834a5644dd0fca39579691165801ec420146786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccfa4ed77e555b52a41ea8bf0b3ff052

SHA1
728f7de291cccb257f2c5afcb4fc15281af9dee8

SHA256
5217ad304d6736f9a18566bdf198f820117070684b55df29e907b338ca8b8e83

SHA512
3c048a3b6ff5d6870297d9abdabd22a4b511262779f3f834e6db46d8de2c7cf59c716ba7237ae5e9051a7c9018243f726e313887449af69ddc97a02fe74f0e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45c02cf5a2be2a815c147854e13d89b2

SHA1
0950da7ff8b28d50fe803843f60442663e4dbfab

SHA256
73fca896d840388e32af629ed610f6f451656ecf95198283fc43617a9fe15812

SHA512
f08ee04b5634a5c47eb254587568eebbff7c76516309c635926149a0ff22dfe6b912c9375421b2fd570a4a8a817bd5f92434979f862200469babc3e78607954d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab40E8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4238.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit