a693fff41c4e738cfa6b7f0e9bcf51ae341b276b81189fa698f0c0ede4a8a54e

Analysis

max time kernel
118s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kiwi X/Monaco/vs/editor/standalone/browser/quickOpen/symbol-sprite.svg
Size

20KB
MD5

649fb0a55b0e0fc9d79e6b7872a14c10
SHA1

b33619c9dfd65d3f2e5a5fcb767a752123d51607
SHA256

fcc3026b97068f3d9e1743d36ca26b96ffdbcd2841fa9d804caccc4f249911c8
SHA512

3fb4b07e9313b69c84f887c9ca0464e4c8d06a98a8f2ad7d0b48452d068bd526004c21633d0279b4b5e17ad882acf8c7e99b4c3e7650be43b495b670a87d0cbd
SSDEEP

384:cyPJZCcKWPJuCNoSmvcar1PNY6g2HdSjEc3/WD3:DCdCNkvcaQ6x9SjES/W7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F010C851-E3CB-11EE-AFF6-E61A8C993A67} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c65640cf791db5a516b2d78f61de563f62805ed477c165494ba4dbc618484a1e000000000e8000000002000020000000da9be0dfd4bf1e023ab5628626bdb250c76ac0f2ba90ac0510c3f5915c4895a420000000dacf845d877f84d078676c6ecc386d437b50a5555efa04799f029f230130729d40000000e8032ef0cc542077a93edd4e7b0ace54b0d03a879278ce81cfd98e92a7ed45b54f820103a138f05e2b4de45357c1557d1f72b9669d878e8d02c6da81ad11fb85	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2004dbc4d877da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000016a0f6fe74e5bc82b8e7add1edd3bf93b076479bf219c738d93278742daab459000000000e8000000002000020000000a8de0bb4d66f17423c87d869341c0a2d9a76634cc08ff4c35b8634cf3a40a3759000000013372c4146d7314c0f6b4a8c7feb5d0379099b23c7652057d79950df14136742cfc93fd62f11a77ec75f120aa04ae587dab9c1496840b8867f0b1e6658fd1ae47a5cafb72921639b935eddbf51222e78989995d84354c11b54d576afe26d43f1b58317250f60ab0bf9c751d751425b953de7b2757124c6cd30090ca7d5a6fd02b0d85d940f51ff5db39f9d9c5c6892fb40000000acf58d973dd25490d88142989046080c7a565db09cce50bee15fa763e0b2b040311d30f9bff71f454bf81e7585ac7cf90b81cfdaef7f219b1e4bda83fc809304	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416779431"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE
1404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28
PID 2240 wrote to memory of 1404	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Kiwi X\Monaco\vs\editor\standalone\browser\quickOpen\symbol-sprite.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
159e3285616dda514a4569b609eae1bc

SHA1
f87d0924faafd9b5c62eb0972eed0c10b905844f

SHA256
349974f959cec4d4ff7bcdd87cd730809d6a4046f2a90d84accf48b15288e05a

SHA512
f752ae51b243b9dabd9d8a95cf6cbe046ab5e955ab449ca1bc8de980c325628736a28b70fb373bb19e8aa2d1377a108f1b20123d7b1e76f86539ec24370ffd52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc08606993caf4bd3e74e75a5f0f75c2

SHA1
8e531fa2d0790f13e60ae8ae08f5282deed9e6f9

SHA256
ba22d4fe04990bbbb9f2f77fe22aebbf9a64136be8dfcf95a542e938b7682631

SHA512
33e39aa5adf0ecfad0ec2c8421afd27c015136b3441f98ebea930a39a78ea80a8036ee53e4da11c72377ab0789647c443c381b9894ee91322c29036626bf03cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15a6c3324929946fc4d6a307a255491f

SHA1
6ba7a5b7a0186046dede361405182e8b47d1eead

SHA256
9e2c0b71f330f0f0ca5c2b339efe0f670e92d50b39ed55eb367d5c4aea33a469

SHA512
91c261662a3c4c3695cefd6cdc6cea61242499dc5ca32e48cc81e81b359832154f167df7a4875e1b4d7d947cfe7abca27a14c753b586b215da2e571f17eb5e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d9626d39104c0f457ff69d29746635e

SHA1
e7310b8b8841ec96bf18f26cbe06a88e4ddb3c24

SHA256
477578926f0e675d368adc8895ac9515929033ace36a5c539ab077907196fe51

SHA512
ed624a370da7acce6edfbd0eb4f42928963275375c662191c596348534b43b011b6f269a4391caf345377987ee212ace7a7008baec2d07993475b2f6fd107c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5e3823ce196f1c4c609912bb3dc10ea

SHA1
acaedcc3a325257c2e67bbf12bc185ef237c77ed

SHA256
0caf7b5bb5fdaec43d5402181d2a269e9a0a96b151b6c0c265258c631a36a0ba

SHA512
b674eb4aadc3b7bdb9a634c1a04a5b3463f579d1c4a2cf88e206ad07edceff21b942c22b20a4ba4082cbbf052763c513efb3da0cfd3df88a2bc00181392c9074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b86825d4ef82f957eda20e34af37ba98

SHA1
c095824f805213ff31167be48a23f029daae70dc

SHA256
fb81c6d469a5e0fb4a9c62b064fa18731d461889f436c3fa33509db4a4cd7628

SHA512
afceba2abbe31324916fe567ac6567375c8c5a536cabb374eea10fff4925a40d029597c0992a4aa93fdc1cc08f1ca6726c81bff70e9e52c29cdae2a3b5bba47a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d72192a6a2a028555534a8fae2616d9

SHA1
25973b64ec910914ceb50e46bb7b8bfb7bdf1e31

SHA256
af9be7e29e5cbd3426cd9e30609294eca142cea507f8b88b823e740f2551fc38

SHA512
5cf99e5a031ee6660da13adc526c6200443ed93ac6754f9e972cefcc09004e0aced6002fb226cd33e05072c0b4fc14e23b2828935b081eda91e087cc555f006d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ea41e37645a0838e6e49271e7df7659

SHA1
5c3fa346884f3ab5113ff53513c7845cebdc62a1

SHA256
ea8ec6a51dfb7ab163ce5f153705b3f4b8f8cb6421916074cb83491b0ac2e5fd

SHA512
e1a5cf13a9268f73388b54cfee44d400fdc0084a4b38f2db6bf1ef5a86a1fce01d6d31d2cd103b7f5c48843d0e9bc0da289730baba2b71181da5ed3e264e018a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59656057b0b757cdd54e55a3b74e4dd7

SHA1
e2981f23922fe7dbc02cb81ac6d9129755693278

SHA256
b07fd1e6801cc40787466b709daa66f4ff410da95b404d4708faad11124cfda4

SHA512
1538cc974562fbb0f3da06aac8eda0eb08e1b2e926ef80330b71d4625a4cfbdd10841de147c9427ad0b49163953777b67d9aa4ada94eccb240b61d87cff11ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a73006e02804b29e1f871ae06e2c49a8

SHA1
ea07d7b2dc4a7eb7637a63f8f28ae9852e9622e1

SHA256
dc71868f9b56dde23d775993045a99f8ed69e791663388e6e4ab56b670c90d1c

SHA512
19c1afc3248b5574bc3d932fcc86f084e4b36ae47ea8272894f715afd558faf632c999643e458efef35d36fd94cdccd10a46c76e6a134936d2f4f568389f8472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc7fdb51e465b46dbfc36a668f82be64

SHA1
068b9f3b5e4b282f5219d65351fd56d1d951f8fe

SHA256
d3083936ce92ae8af96a828784988ea3a6f5c8d3b1b77631a9da0e31bbc4b641

SHA512
6bc8798b2bd4f0c4f80481ecbaf6b9864ee773526b68f923c12620685d3e4eeb9fe11eecb387676049e8f63305d8324259240e2499f3eaa3ef17adfe1d3c03b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b6ca50578bb7ae1df70384296b12bd42

SHA1
dbda158107543e99bb7b40a5be8395774ffb69c0

SHA256
2359a1f52957b700d61b63dbc7faa44408483275b11453915b7d64701cae1d0c

SHA512
cc908a579ca2023f17e44996093319bf4218ed2fc17ee5be2bd28fcd6a4e72840feae004cb34f80e516f528de6237b338c7725589d53868a8d61c79e230c81b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE03.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit