c3af8a1cc69a302db7d93211e9b7790954d6c83319f204a53457bdf2ebfcf877

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lossless.Scaling.2.7.0.4.B5/IGG-GAMES.COM.url
Size

196B
MD5

882e17d630d74b64a8176e38e2fadf7f
SHA1

d6652d568db451c03b73eede688e0124e2d54ebf
SHA256

6d905d76e7d807c5831231d791f2510160dd56018ae423a037e7ac88fd19412f
SHA512

2baac743dabdbf133583c4d500699673e0bb2b2ade89f0a660eb17bfb440f1d74814ade3b82eb07d776f6a7c1b1975f25c6c1c500edc589897bc304a9c9fb3b0

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000009333011a9d1d1631e60a3c6bbea7f5fe44361a7e63631a8a31a49cd38c099c66000000000e80000000020000200000002e48e021afe8c88a54fe52d0905a33bf645d47cdd8b6fa0edd61dcb0c38929fc20000000596befe133c5734c4cb22f5ded79f7e582f0a72d52ed695acb3abcac9e05be8440000000b30a56cbecb00e04181ac15b652bf67f459b93a3b29ca2daedd677c752bdb3515e71041ecde09a05bd398c0f55286e25b67a27b1d81b84f1838760d1e0c4c3a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000d2d84f239f1994975215d89b4d8616a7918d549f7cfca39e8dbf6353751f781f000000000e8000000002000020000000ed1ff8d0c3ae9b1be3a138745e4ce477dcfaabd13d0410a591dad7c820508e189000000020adcab40267ddc104a47251d8571a008037ecb0f952b9a16f28d1c235e0f2cbae494d8eb789d8af2622387aef4a0ec630c0cb2317428db395490bbf46c01ab5107f776b309a85e73bbd44af4097229f5230c1cfeb3ccf00f89bb7fe23eda4211eb527981226782d2b1115dc8c4ed6bf61c26392a0abdbd3f9575063851b8216fc5e6227588dd565413bb857122e92a44000000019cd999eb321eb0901b4a836f16992f48d01993fd5954755bbc24eef06b898cd9e33252d9b75680fd0e688781cf9d6bebb24afa0d3675bf5afd9f61e347db15e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5050a3738d7fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA401621-EB80-11EE-BC96-FA8378BF1C4A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Lossless.Scaling.2.7.0.4.B5\IGG-GAMES.COM.url:favicon	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
2576	IEXPLORE.EXE
2576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2576	2964	iexplore.exe	29
PID 2964 wrote to memory of 2576	2964	iexplore.exe	29
PID 2964 wrote to memory of 2576	2964	iexplore.exe	29
PID 2964 wrote to memory of 2576	2964	iexplore.exe	29

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Lossless.Scaling.2.7.0.4.B5\IGG-GAMES.COM.url
1⤵
- Checks whether UAC is enabled
PID:2632

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:2576

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
b7ebc7e728ccf9a930398ef5c0ec936f

SHA1
62b4a0e19ce2bde782dbb33f646cef873f30ad68

SHA256
2ee04d5427e7d304ea02d130c5e15c62fa8c8b5191fc9e4e2d753e07db8b6e45

SHA512
cd835a8c066bb812b3a02ea69d65c770c5be3e00f7f818856177d5fad6c590440f78781e261b38dc152c52a232736d3c1335f35ce9ae05afdf46b4bf397f63e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c480bcae8fb2eb04a9206dadf9c60fe0

SHA1
f54f06d112a4b1d95aac62aca9ff38849f835d53

SHA256
13aee9ce2dc15ecf506803881c66ee41916a9385d016dba6ebe28c3a102570e5

SHA512
4ca176c36d263745462f0eb3b8a8e6f4f130fda82581b2c0eae56d10def6dfa91342f0ba43b9fab63308c48c4aa549fbeb130c6523dcb1951aeba42919d86e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
16ba398ae6bd4b4c470d12fbf127954d

SHA1
675b950d07b1320bdf5f7adfec56db2b35927076

SHA256
26e790086eb60d0dc4ccdcb8136f949f1cf2b01edb373316fbbf6584ef0c851d

SHA512
e128cc3cf08d5c241142aeb11e305f2a9f67516f2d671ae1946838793669dad6614a61618c42613c153e663ef31ce877e4facb6e1ce801106ace07ea07da40f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7613cbf48c5f0b059782224804ed9b89

SHA1
01d29a9f554f5c3387fd6d7f8077a060ae97c179

SHA256
63166074546e10396d47403b4afea1f841bda1f100ddba481e93873bfa75aeaf

SHA512
7ffc30e63f4e88485b063f36d2850f388a63f73f4e21cfc19bc193d4db5bc66fa836074b6df15cb995bdb0b0f3d3759ebed247a1f1cca7043d2329af55c02855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6afb88aa54c9264becf97712ddc79730

SHA1
6b79076485cae1db06544bc28fff37b299a53ab4

SHA256
6fd921fd5b045b62f3577368369ba2f8c9a7e12953e370bb514289a8b92a4e0b

SHA512
99808c535484caeb9ef13ccaff0dab2f5394aaed0cbe854a8edcfcc069a0a273faa5300400ee8a1c080a050b8ad8a3757e8853649b0a0a8b1d2a58caabc6cbfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a4bf39191f5e6bf46cf7a944182aac6

SHA1
bdcf60942fae10a099547d4e3a6d19bf05193d49

SHA256
eca2b85396af39271b74ef31431de6cc77580786de0929eeb18f1e5dfb509ce1

SHA512
7a02329946e054613988c65520e4664d3dafd27287ebc4687e141d5ed6e289f8b61ab170187af995651c04409c500c4cfc4cda534c73873f841bf36a94b7ea00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
89d2a6e61978406dd95ed33bc4bdf86e

SHA1
8f6da3cc390485d2606e3c46bb595cdb2e28e5a3

SHA256
b85c678585627c97269f0aeb5e21d0d51c5d2cfa0ac8ac452c204514bfe16de5

SHA512
b54bebbed8bbae1835022dda320e56fbccfada610414fe6df769f8aced9787b2653e197a6b39e07cc875fb053bfce2f892d6b98e2cd356e193a916e6fc0352ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b9227464b05cea21743d13cadb3ad4d

SHA1
9c4e22d9362d75a3497a90a0889153d76ddd34e9

SHA256
99c8eb891393617d7fdd3f116636536ab5240dae9f9715f0ce23cabf5fa307e5

SHA512
32fe43cc0fb02420835cb7faec9a6ae44aaf66fb2308a3555bbd272dbcf960fef68c3152c102734e2da1ef33b445537478148f4c06c454c75b5f0c2c608fca01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e154557c3a619ff1e545547ee05783f

SHA1
3a9b0e46dec2b667435e7b65fd23d9c11eeb9b51

SHA256
a77f17d9484388d16de653e243f33e6bf06cfbf1227522e9210b7f1451b828fa

SHA512
af55fd2eb5374fa0b668e5d445d298af8c7f7f7aa3e14254f9e795ad5bd653ced9ab594c0b1029e03602232b155489ae82a8e21ddddbc9fefed057031d8711ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
439699688e74214e8f5173ab5127eeab

SHA1
f7b46c931428d5c663b8c89409ea4c2dfcb37ebe

SHA256
636b950366b15e1abd157d52823ffa3d2a2c522349be51d49f6a0b704a56636f

SHA512
7b3d515fcb7fd380136a12f53e3d001e2b34b8930d055382add3231f2622e12c2a56afabe99d16f44673c516da134a2b4bc08ea707cf4e1eaf48f12d96f8e6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jq7rho9\imagestore.dat

Filesize
2KB

MD5
8216a9d6821f0ebfe0afb7716d6560a9

SHA1
69ee52f43515f5003e1d456761c05b1ce3b010fc

SHA256
032034678a69ffab58449aa8aaea4f671df0419012bad0ecccf19dfaa750ae1c

SHA512
91b8a71abc1af14ab2277e67ef01795b8c049ae0dd9782e3eb13bec617d78ae8501414d308d9343fb9bbb0f53e4f7c6e39fc0272361d66333828593235113276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S96XYZ9E\i96x96[1].png

Filesize
2KB

MD5
3df25eb95d1888e160df779d493643ee

SHA1
c4907473c9688b56a7eef2f2e99dfde1b6fa7994

SHA256
c76d5eed7b9849b014957df851fdb3a94a183d56505a4711a90f5bc67d4c64f6

SHA512
c8641a363ec36c355e863101162a34f9104915334d5f9b9cc6a41f2c292af2d161f2f29793a2b50e0785ca600ea7ca5f17e943bd8f9417664bb2b63c599d8306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AA5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8B93.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8AD7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8BD6.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
memory/2632-0-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download