d4990f7bcb35710c9a38dfb8c6cb324e43c47c72c6bb9c48d16d6b192fae4957

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.2MB
MD5

df37c89638c65db9a4518b88e79350be
SHA1

6b9ba9fba54fb3aa1b938de218f549078924ac50
SHA256

dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463
SHA512

93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67
SSDEEP

12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4F8B131-FCB1-11EE-9AB8-560090747152} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419517042"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000003f5d24fedf4b863931ed97a51eefd1bc756985571c716a07a66f3f4b797b5050000000000e8000000002000020000000d5bb8bf6a07d132202f3f203d22ce384965f42544d29660abc4aa06236ceeb7290000000ec146df1dd6f7f00e8266f7ff36bb657bc043e77b05cfb04b6f580411b037783fb3f87e9d88c126e35b14f0130dcd7f835b9383a51d7f9cd709a0cec1c12dd1af1687ee4ba2977bb4ad9296ed6e0456340969b037737923ffdd71d3936357b39f3daefed64ea25faec8680f3f4a9350b23bd7f2d1d009b245294af183029b1a2d367807e20cb969fcc28b3e2abfb17894000000095e1911b0664553e7efaddfac1df206e2defdb8bcc8a5e7733cd5c068761d8e82d34b03eec71536efad25a7f980478e74d3369df91d2e561c2864002d24c9820	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000005d5e80eec2dd7f44982c402f8ad640dc2eb3cb83c8e1e626c8bd2ae914b39b95000000000e8000000002000020000000b429040d7d6770805e16068b5699c2589259af600d8bfb1f5b57bf33f351646e200000004571f50dcfa52881234373d3b369871c3300809b5dbc0c954668bd44ec4823b740000000eb0cfec1aeec7e6c90dcf4e4384cc716575134ba6e89631d5d627290835b46873d88e43150190dedd0839f1f5ae3f01f0d459c3a2215d46e50389bf118680480	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6061adc9be90da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28
PID 2276 wrote to memory of 2700	2276	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d17467f465ff34b535b278be5177ef76

SHA1
6c4fa1b63c226a4a16445c33e2198cf6c4b668c7

SHA256
5216b3b0b0e3e57b40ce92e8e9a4d187b48fd3b695dd8051d7a93409ac29af62

SHA512
9a922b8a0247b733e8ea5814af0214a532a3e21be82b8f8b9f901abab705ec3351004c6fd14d18627ec57b35d866e392786a54a18fb3e6c0ce0fbd0b30a8b753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f285673b0a9d4e5d075dc03cac48f9d0

SHA1
e4200a1583533d0bf529d6ca50332c76b93c76c2

SHA256
13628e75b8a5ad148a297232ededd6e27cfd6c344a736ab59db11bee03f9888e

SHA512
b7f719d5a0274372dfa708b51cf243cc7a1516af1c8340faee8d8085bfbc1fc54ab99502261b7c39d8ae368e9f692c4fbb36baec660b6b193344119a84c319f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0d860d4b6fc6beaa50a36da370f94db

SHA1
51d9a7c539031f155b27934eb47d56f16eec330a

SHA256
b428f12f9b63fe7398ea165c486c13f0b7e5286e4d352099dba34518b6cbe1db

SHA512
a5c2bc8d4e8d5ef58f1470f644cceef0080d64776744174f91424c1b413034e6458c4e80da5f8e823789a3ae028eefaf3bdafe65b032dab87bfcb0606281e2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc11a33c6a09f762d657d0406bbc3477

SHA1
23dc7e9576ac808125d3ecf38d18777714435dea

SHA256
2ab5d4620909d8d0a6dd3385c695c56005608862e9f04524fa200dc6e754750e

SHA512
c4c29b0ea954dd697f973502d4c135031b2e0b6036ca5b922031f2ae987c80268ff79ce6cd38ec58b34feda4065782ac45c08a26786049df8ddbb4862810273e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8ab90151c32558b30b52aca0c8e633f

SHA1
1ab6194f31b6438875254b56417de1f0aa4e6b55

SHA256
3559bc45ad17df929325e2438ec318b26a69de7c3fff1b9d72a159c98fbfa779

SHA512
35f39915cbb5a1a71b5610bd58930bb6ec475540847faa00a6d766747a0e9b7d9ec8270c0f6fb0126340890427430a2cd8380151989e1775c32719de80108269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93f6f56d5eb0edce8b639ab8596151b5

SHA1
dc4d3f60688d7cae7d74f8ec3d2bebfc168dd46d

SHA256
54eb71579a990fd698aefd752aa295cd5246265043c6efe7b25aaa011ffd5fdc

SHA512
2257f25dec9a4cbf91a315030e93c357108ecea7539afafb3ad44cd8a49f4530fd93a3bba4877ed3dccd10b3e8d0357556ff1821c560dbe2c636994a5f8c91df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94add099ff15550838b4d6bd585c702d

SHA1
443f9637b9cf1b3f9840bb740cf83be6e026c8ea

SHA256
e60ae39927f96cd5ed44c98919cc954531fe70f047490a848b644102debc5de1

SHA512
861d5738b789d1b547eaec24c7f4f867bba45dd1a84db2a50e7f46a6fc0e4648ce52913d0a7bc3b284bbe0f1056c4ebeb6b52bae3d567d0047650f7af48faba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53a227a49e9b53de2de46b035acb79c7

SHA1
fdb8e576b1b7c8ca780a2396dafeda5edf7c0352

SHA256
7af6940aaa9eb90bb3268a43925fe0ef3d98cb0f8a7e5d215b9db4a7e256726f

SHA512
81d1dd4bd4f114f6020d1474f9e0d882b50c1fc5b5e37c5efa9be2e22903c0fe75f7d2d4f279596326510809c5c299e35c1aa190099db4377dccbe8b7600bf35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59d0e0e1fa5c92ffc28738eb14c717ab

SHA1
bae76618d5d9a1be6b7059ddbae1a2e72c68ebc0

SHA256
254ce01549cff8fc55c67b1cd7fc1a9699a6d42af1194c3d3021f734312d17aa

SHA512
0664a467fe1dd53b22ad23ba110799097a8fa85312e684909f4b0e7d666e7a40a24eb46370d07cc766b0b9246ad53bbb979f856bdb90af241293e4dce630f7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbac1f9fc18fbca61b8d139092354894

SHA1
71c11eae375beb252dfc2e6c4aa9228e9fea3c03

SHA256
9c248760318be84fc756b7872e820e0765871275c31e006821611fcf8ebb33a9

SHA512
09a3d9ff961fff5e600af66122e41a67a9225749e43364417dab58521ef21e25c632dcd0aa4dcdcb374a8c3f4a8ae94ab985b83534d37db19bd9615745ad21c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6075b443b3fdf1fff3030d71d07a99fa

SHA1
83b6499d45262ba4fc7420e5016bec56bfa18892

SHA256
18acc9e32b5aec98b86f66484dcf6cb8a303fd50e1c4644c96380bdf3caaa579

SHA512
79f4e0b54d56868cb1ee8dc4f13b9e312aa9acb0a64cb0655f4abe6caa00ea239cde75402bc430ad2be71a730379e4f85ac7d84f0e79d3506e72f9bb6e4d4610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ff9b2e663438c78468ce682861daee3

SHA1
15cda50a3dca28eb201bc1e7f0a27c8a9f83f007

SHA256
437212faac1f18812f636571bd6110edf267a20f43e289b4317e7cdb99d0b5d8

SHA512
d0ab4b579fb874943aba5aca8f98c8a461a342a20bf711607d1c954796fba2ffd7ceab22f90ecb702d0970b01569f65448087bff1416013d48aaa02f24842d7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e04b42e3808107e16414f38dfffcee

SHA1
fb35ba7b5563b27d00dc7187ab3d1b37f932296f

SHA256
727034615c8653c425d9b623bcbe52c073b8e344bc4e8539819340b05d98602c

SHA512
19e5d8dc49e2a2ce332f7005bffd3d50acb9e42a804749a47691fcb92c6718bb4a3b8171a0ea032857123941e653310dac4d04769038d7b6b502da0dfea0621c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f2672d32e6c4d9cc5d05f52682ed8dc

SHA1
e977246e27123812a3cbd5c793d138365ecfe8af

SHA256
067b8ea7c15ae04312df100736dfd1c7b87e4344b6c088cb8d78ddb8aa585e15

SHA512
e7693c22467addaa6c7029dc5aa0ecde49e4e59f1fa680d71a0f69429e37551c8dca05e8a16a90038dea6f5969055d171ba5b9503b48cf856ca42eb6b39d5c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd67ed5c80d5a613dd8fada9395e79f5

SHA1
32df71b1dbc62c64a4900417d4699e595f5f4328

SHA256
14a0ef7f683f9a6881057f13fbbca716bbd1f8b26247d3a2c32dc36a1eb5e5ee

SHA512
156ea891b0ddbf919d1491996af5a3a2bee6fee9a74bdcbb1dbb99ea3db4aa5d719aeffe4aff742ecd17320f161a320eb5934458ff39120ce6af71b32db3d036

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab391C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A0E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit