hxxps://www[.]1337x[.]to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/

Analysis

max time kernel
15s
max time network
22s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9EE98361-FD87-11EE-82A3-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1056 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1056 iexplore.exe
1056 iexplore.exe
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE
1048 IEXPLORE.EXE

pid	process
1056	iexplore.exe

pid	process
1056	iexplore.exe
1056	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1056 wrote to memory of 1048	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1048	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1048	1056	iexplore.exe	IEXPLORE.EXE
PID 1056 wrote to memory of 1048	1056	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.1337x.to/torrent/1306606/Left-4-Dead-2-v2-1-4-0-AutoUpdate-Multilanguage-No-Steam-OrangeBox/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ef4b1220ce63a9178f9d7dc0bc4002b1

SHA1
a8f5492462e09522484bbcfadf11d59929681f40

SHA256
c8424e6c105473768dba60d1da484e31b5c38a23a1e7c9669cea7df409294989

SHA512
bb7c71019d8864db93d6fb4c3ac0ef0359d9cdcf800b2c880fb89f121e7ebb88d6bdf8af861cfba9c352408fa607d5fc0433e64e9ddf1495129f66876db6ffc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dae1c43aaeeebcafb89db85b619bc281

SHA1
2095e89ee6d8d62f43ca3d60a2803f3a8844aadf

SHA256
c5b6948baa876844f44e125d6bc4621b8ed5b5c552497ff0bef27b69c6f93daa

SHA512
164e15eceaa398fe7110f9d829fed6d6e7e08c3b09a1e1efc1a59d0fc4ec2df97bff5755018ca5c58ca5a59a240cf0f9a85e52c86f801b93f3342c1948036b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a00d9bf3679a1d8342b17374b9d84bdc

SHA1
e1474edff1e67a12e549fc4505647e2d01c9bc9b

SHA256
3cf1c4fac8f45b6f66175bd54d09d4899ce19c1476da837406f3b5ffe325bc3f

SHA512
174c90d85224594c0be6c226c9c5094bde3415457690e4bd8128167a5f5b78c33102eb69c107976bbb78efb606abe32ac45cec7274841c8725ebe3b06d95b50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
63052a20f343c6569b2226d30c7572d0

SHA1
ffa58ebbb8f7aef5433e6dd80b60b75c3114cce4

SHA256
6c2c758a19cc0b82fb393ac394f7144d77e8ad24533d5c5c86384b5eb3b1ed54

SHA512
4f292cf9f0be1b8215e0760ec84245ca837828ab9b215109f629b13b0965c972bc786d8c6f304d2df6782ed0a3383dce140e312ede7ab9dbb3e754ecab4c749e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f8ce6e69c63a5361d78e8dc1a77efad1

SHA1
8074be689c51360b497163609efde0a331e7be73

SHA256
ebe842434b6e6b4a85755c490c7bf566fb624f4b5b83b830fad4bf13033241b5

SHA512
e0e3fd3c85e0a3b1208d73382e5166d940fdcdc6b766d0f9887e456a5db04b8d6d2f72cfd5a9b93c4d6979d4a6a1583e64e222496c2b354d39c00a78b0f1474c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bef1d8f16cc0725af454a020e48c0f8a

SHA1
587ec07a35c5a113cf1f6e5f74b74e1e4fe6ddb7

SHA256
f25fe28591d83f769a5808a97340d590164caf3fde2c0eee6be811f0b8942829

SHA512
61411b59e1f5afa017528b80a5470fb02d4e760eeba8f175fc805f9918caeefa00e39bfa6d3039ec7e85a76f0101c2f287973cc15ffda4b9c99ad4e860a63e85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bd941e383037c40bc384e60b6771c0b5

SHA1
89635beb60a3f53c2d00a27f451751b1a36d4f4e

SHA256
7f6d9da75f618eb744aa2a368723c047d544580ef6ba0ce585e50336eca10010

SHA512
96eb02ccecf70631ec6c399116377952b296f29470c29ac87ac1f630372bdc870dd1ad1ba8df01c75ca35850061d47a739270b4124b457364b6fd35b510e6ecd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c8f4e4ea0c33448fa4f2af0d78fe94fd

SHA1
29e820f67e9d90ca794944612a76cee2376277d6

SHA256
b592e90767a60404d7e9f30b206bf0b95dad0c8e966675d1c7cba69bfc3a350d

SHA512
aed4be1fdda9a800f9e50a554a02ffd28adbeaf9d0b882c5488269231d3e0d3bf7798c068ad023a578b53d3810285158b43f5cf7de5f1504235525acdb4ac2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
38a10a61554227cfe1a3b66468ad4105

SHA1
dec6e4fca67f3ae59b958a155961ba2609abf52e

SHA256
46ccea383829b3d2d57d9014557cdf61b99d8fc8198ddfc77f1d28ee133c2728

SHA512
1ff3b420a2f6ef7588492d4e58d7495dae0638a6e9ac4afec38f0376824617791cab312fd68ee2f14b4ed96ac01622d97e311298a29b19b4e9dffb8b645d4696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fd2e5e11efec7c07302d5ba6bf4e3d9a

SHA1
09028972a2d02fabc907621d66dccc4d1eeb5414

SHA256
d667fbdb9e28525bcc5512ec6f9d7269e84e5fdd76dce4ab3b5f234669bbe7d8

SHA512
0727257bc6743ce34a027637b3e1180972a7de78e1fb7132e978ee7091d7b7b241cc6bcf446be8cfe3b0bb39bd0253caf20d7a70da975c697cf706e3de97725d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b0774852cabda1673db3618802664657

SHA1
342d512bcec73b3ec2fa08e5c9a8f29daa028e8c

SHA256
e96a86598b5d408de5f09aa8cb106bfeed08001fe51a30e486271623075d05e6

SHA512
f19a1bfdac1533b0df149a0c6930b053e0407249e881d5f0d2afaef88feb019c849c08eede4fda11c18f0abb081bfb4477119004283a05dbd7749ca379b9d26a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
2cd32ce371c7db9b361ee91098cbf42c

SHA1
42749ef13272f7d53e5589f712498bc613503b5f

SHA256
8d0d98c9a4e2dc42000777b3bc58c1eb0f6f96c4192028ca2a31444b9c9f9c34

SHA512
f7324fe1042743de52c4ac27648a3a143fcc29c42697953649c8e25fbf628a2cfacdd5cfc23232bbb76f631c57a437bf2c44f72295c2f8ae6d5d9de1b515ffcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43A7.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4483.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar44B7.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit