39c42e05315d4c367c767b3a00cb3477b4d57536177c270bef214e300dbefa74

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.3MB
MD5

dfa12f4edccb902d7d3b07fae219f176
SHA1

c2073440a5add265b4143de05e6864fed2c3b840
SHA256

501f0b7ebf0be7ed8702d317332a0f8820af837c0a2a1d7645ba04352270e2b8
SHA512

eee3a8e0eeae139ddd9369d0869c29c91007bf6c5b0d7982918d5a013214a9e80b9233e7c1ccb43124152f684f0b782831b0a6b3d126558261dd161230004e50
SSDEEP

12288:FetnJnVncnJnknE9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX04nNWQFna:WbXZ5IoWSL9bcwVR8mf+/cHBBaRp1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95054921-DFE0-11EE-8D15-FA7CD17678B7} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2023de69ed73da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416348485"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000398d104cb151e34b9cd607eb3166859000000000020000000000106600000001000020000000ff84cce2242b91ca7069fd6d1d346c4fd5a4aa9e41a4fbe0a9b24f2dcaa9f318000000000e80000000020000200000000999b60a658fd7eda32798a447bf1c9b204a0f2c0c494146a8530b6f160f2daf20000000e7809192fc4366e4a57a490f31c1b19b1f456302ad6c169dd7eead757b1310ab400000008c13dd22d17d1370d12485e0c2850ee44e4d95a1a26a81f29cfae304d09a620a0ffef86ee57425efcc00613b257a139e8acfc0ef90141256d3af05c23ca7c9e6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000398d104cb151e34b9cd607eb3166859000000000020000000000106600000001000020000000d3495caccecde4fe49191fa4ad6fecc21a177edcaee369d9228ee435a3fe494e000000000e800000000200002000000029f763de7e9afbb95a910cbbba7ce09f6b1c3fdef838a7538886d13d26105e8590000000e0a3bc1a83d6e6472d1cdcd30f652ba66a76f055d17781dfcf916bac9c597bedd70a48eb94c34140b5ddc272c6e4edc5f03fa3e2057932a6cdd36ade645b62d4142775bac52a6307a2dd3939c4ea3b551aa67a2ea9e02a57337b957b9cba5c7f112ada1492982469e76c863b8c5f3fc3669b97fdda19f02bdfa737ad931ba57921dad744190fc3419c4021838e8cba324000000094eebc95b7a0fa967b49ddd6fd54188c1b79547976e6934b2a43c0d109363e7e1d04d9c8e2647ced40d29c8329a8639fcfd80c45977b40493d6ec395ad60b38a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE
1892	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1892	1972	iexplore.exe	28
PID 1972 wrote to memory of 1892	1972	iexplore.exe	28
PID 1972 wrote to memory of 1892	1972	iexplore.exe	28
PID 1972 wrote to memory of 1892	1972	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8b0df07c2409b655b0f8d469ccca13a8

SHA1
fc3afae6ca8b84e9cd02c50a4031cc230d00720c

SHA256
440a1666434c8cf185c7f706cf4bf806eda00b909597d51c79637b1a3f8d74cc

SHA512
23fba2b0c2924afe91f9a304b6b5cec953954bdc83e265449534778120a552cf0c38f2e9d1bbaf0038e2ca1d25ffeb89dcc9abfa5ce5656ab57e88814d1516c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a653fd7c84324351e67485cdf433d351

SHA1
a5f9b9f6db62609ab6fd089c71dfe9746ad4f275

SHA256
f1bdcdf7bd9a85e1ceec503665540b257ae41ed825254ccb87d305519ec7644d

SHA512
c0fa40f622e449064204dfd71e129d1a8713bca41774619a024694a761c5cb108db2d1601f10b1c531ba776fc4aa06405d46fac6566e6f1cb5a85db986e7e92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6db6de49a54b697895351e2f51f8e65

SHA1
7b908db1dbbc03103bddc47fe7934d1053093f23

SHA256
3ec9b1e1ad746da33162e70e2c76905b924e7731c9ca100753791315fbed1263

SHA512
d7709dc2f1b358c5f4723aea4d7f5eacb171c87ad31927e05903b8216d788ff18dca0c414b108e70ced1bfcf41d95487bc80b4b16e6e770ad99348023644e1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44611269289ceb6488f2c235d94807d6

SHA1
e5035f25c74dc8e3770e358256197dfb0a58d1d6

SHA256
47bdef22021220232c65cfbf7acc043c35dd751899690c5da59ae49d0558677b

SHA512
ee2e9608f1d55e74bf6c4e57a32d9b834129cc1f5d2ca62572dffa11c8ba0a237a45d154249342de073e5333865496190a0ba3e172ade3c73120bf2a9b37072d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fca648a1dcbaffca2885e6586ebdb1c

SHA1
feffd1a6448ad51a8d5fa0626b75743673f71d13

SHA256
482d417b920d629b8b34e8dba83eec878c5bc0fe2f31585fdc7a9ef4d18fc827

SHA512
53b9b7a40369485ea2ca2ecc9dd6634b3895786d5dad83c72c672c7bce4b917345bc7d5e8d3c79f0a02e9ecf2fa80b8144243d32d5929c3f8626d165ccc6f4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e6a35feab9e69a54fbe84620209e5e9

SHA1
f5d000850cb16ac724e0103014412ecb4aa84eb4

SHA256
c0df40905c350c7d1d08f2bd068dae437997cd2ba5f2f4db9bee1a0fe08e1556

SHA512
e7138a4899230537332b10aa8b0abf9309178886565e1c9407729abd58a55adb5a7e71ec718d61841a5a78c694c8d51cb84a0fbab32cfbef49818342eba0c935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770ad820df8befbb587dd6fe1a920710

SHA1
4ed4621b18ab64a3e3dfdfbad966c6c8335fd04a

SHA256
a9480079cc74339dc6a1a22c13fa533300480d78c9ad824480bc2a5182a9f862

SHA512
838125a19fa363fbda3b2f556407f5bc428a52527004d9c7e6881234ca1be520b3eca6a29f8e0f3def948df18f17a653ae4367c632968eaf6142dd290a5a5da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9d312a3b1cee9b92e533ba26ab85f1f

SHA1
a5192e78d381295cf345b902de473c1de3b3f1e1

SHA256
8c5ddeee231623d88ed821f1c078a76489a5ba09f2c1f86dc470cec69a7b7393

SHA512
8199a25dd06b49a5eaf9b092e0421454c02a094708f25a788b02b138a8ac16adedf6121658e9037bd9af97ee8c9df6f75137e1758be128140b4a80fdaeddcd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b061a26e330db1d7df2349008023a429

SHA1
69c8293fbf038209939d4c356b352189b2a07073

SHA256
973cdcdc37d86da876ece5799d510e3d7d9b5fd71326935e4ead4bb8a575a1b2

SHA512
f18f5bddef414e519bf7d3cc8330f7fdf7b6f96542edfe56b60d906f528625907c115e500f0ca5ffb2da27261617983d8e35202fa1946fc187e88f16a39a78f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689559b523abb730afb5508fd6a1fbb0

SHA1
2c8fc0dff90ab70a88744cf5046f0a425ac0aaeb

SHA256
d7d62a24c61f96028269f6ffee4c0df58bb5157af35b23e2137f400c334d2096

SHA512
605ff285a290230148783922128a703e98262120de43ebfe97ef044cc43a287425576da00a9dac320756bf4f59188ca3821cbadfb0f75a41edb3cec85f6be0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c45781ec7d0c44409cbc54d0d4b9e8a1

SHA1
02b5c468fe735679d49ebdc29d94d11dbdbf6472

SHA256
907323aeb118a0c7ad9fbd315cbfdbaee769b25b0c67d6b5ccc51865dcbb573b

SHA512
373de61d7af623ab3fafbb9fb6cdacff468a9d1a46f14ee141da6a5084107e2a0853c5b29f7eb657d396a1391fb48a521a67bd47009576a007210af94704f9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F00.tmp

Filesize
99KB

MD5
87b6f212a33be759a00dc829a8b288bf

SHA1
4219e147024b9b5865ae564850e6cdecb4d5b7f3

SHA256
c939cf910464c54ced8718d373712078d3cffda5cb2819dcdcdb785f00d06860

SHA512
be4068da246e77e7e5d44e361876f52bfd2376ecd3af926bcafb384ddb3696b4ca14664c15a672b742b62136c14f8d15cfad8c8937e75cf9fbc8c459302eb650

Download Submit