24c7d715a80500ca4286152f6f418ec753d5e7e95cd400a56c2df5d63ab1ffe2

Analysis

max time kernel
119s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.2MB
MD5

df37c89638c65db9a4518b88e79350be
SHA1

6b9ba9fba54fb3aa1b938de218f549078924ac50
SHA256

dbd18fe7c6e72eeb81680fabef9b6c0262d1d2d1aa679b3b221d9d9ced509463
SHA512

93dd6df08fc0bfaf3e6a690943c090aefe66c5e9995392bebd510c5b6260533b1522dc529b8328dfe862192e1357e9e98d1cdd95117c08c76be3ab565c6eea67
SSDEEP

12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZb:sPM95FCWStQj6ERs/mfMl6H0skDpS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000b0e231ae871f3d396b56cad466f49e8c7172de627c23f21f15aefbb98266669b000000000e800000000200002000000060a6282ebc354d3c498840425b816ad3f961d6dd76a13b829b011591c1b58f32900000003b48e5425c4820ebf3522f78744786fa4019bdf39d5f0499b12439269d4d77a9bc2e7f09405ef10165f47f8da42fe0e2276d4800be4a4957abe912bbb8ea230fed0bdc4871769ea39ec5f6a2c0e97d8e320f27ebc84d2232c46e5d178713b118772bd7bdbbf912d2a9aa48cfa3cf5b77cf76af8f9671cc20eae3c95e1d3a7d976e95373388eb1f1f18757502ae4c13754000000053efc110f1a8bf36bd3212fab84ebc0d724d3110505ba7384980c7088bb6bc59b376cf8061651ff0ac187401a6bdc5c2b7e630932b21d603b180fe700f467850	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE6E17D1-FDE9-11EE-A3B3-6A83D32C515E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000040467a9967a3a7c42c80818563274387b6464ea1225e0a892ddda4e24b8f9f56000000000e8000000002000020000000f4a18027f2e423f0c4bff4b6fa4c8fa246f6dcc86c7a6f2b920c4d79677bd1e020000000d6b5d313b5dcde3979205405c15ebd58811e10779fd5bf27bb8def32e60332004000000076b252a5060e64f4a82949d6d3c613f58be485ffad96065f9ca22d3a539d1e75a2ada6c91639a4117f744b0196f81f3160a6730f6732a2e234e23bba6fb6e3b4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d60383f691da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419650926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
808	iexplore.exe
808	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 808 wrote to memory of 2120	808	iexplore.exe	28
PID 808 wrote to memory of 2120	808	iexplore.exe	28
PID 808 wrote to memory of 2120	808	iexplore.exe	28
PID 808 wrote to memory of 2120	808	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:808 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb5b43530150a5bf79a62bafb14d6acd

SHA1
94ba86dce1a3170f5c8785d32d3f980c91dc0c2d

SHA256
e6a5eca2ed772e1664f70c48f6d830cfebdcfab8b4e8964edbf828b5c49364b7

SHA512
d0807383a15e4d6a39fd9897b8944ff0602ec43e1240c46f3fd2e13fc1a0983aead5ed3ae97ee1fcd4c35c4a3b56bc48caa58f05c0e83d223639ee7b9de693df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9db023be579e8b6b545bba641280dc9

SHA1
c032f771dab55ff5ab640e3057d5d39b28ad31a2

SHA256
e383c061e2a27827fe71b050fe94a60c879f5ce5da968785054339b341af6275

SHA512
4ccbc390a82beb0edc75d1bc97b466a790c6d29e62df047afd7006160e830034d83657d21841599a993bc893fe85898a8f6d102fb9a75983149a028cb06d06f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba143df0ad5ce551db705f975eab88ee

SHA1
f8d33781a1dcc4d074f932a09b0fda4259b0411b

SHA256
c624e98367043e6a470aa597ae71c79a3c3844431ed691fb82d61e54f899b2f5

SHA512
affa65230dd8a505de7d6d8d458ecf0168586d3372a64f583db237ea5f017a5395c7a79a09aab62e1df7cb4016e2645fe7420756707af56377c144ca5f9f132e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19bc65d026dfd2bcda9decd523e1bdaa

SHA1
a7b612baf3fe2c1353ba5d4de4e81eb09bd04e8f

SHA256
05def2243767bae77a7bcaa37be4f0dfaccc8866d100dc7745a5d23ae9de1aec

SHA512
90f7ef12dd6ba1511bb0df2c18eb287511c19d55c6e17459c02eaa1de61bd601048aaa72ecf8fb11934a8386730fb92196dff2bae2c3d2776b972726c52dff6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
412827abc162c776deb1fc7daa5a0a29

SHA1
08ae845ae8cb6aa9f7d9c90deb6ebc65eff4353f

SHA256
4fffdfb763d871dd87d96c89513eeb80d9fae08f8ea3f9d515089def85901ada

SHA512
0e618d7674584fc1b3853530fab5b5f5e14ace8d659e19f4f01c56843bf6a4e743578f5c19d618f9903f3797ca430367fc046daaa70b1e3a65bad0cf8b7a4ff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7fa288a1fc6e60f6ecf7da7752ce127

SHA1
a2c3c54d36314e04e05713c87f69d841fe0a4b71

SHA256
30fb3aa17ceadc81d1155b6855eb947c9dc88f11f43a3016ba393ff95c1c8fe1

SHA512
2ecf81f3b79c993f4aef585f572f16c205fb40488d44bcb4cf956a528b5c566d5c5d2b64c754f72c7787487dd07db9c4645384bfca1b1b744201b037a0ef0ba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d4a4f3f69b96ec521500f3f2e61ce21

SHA1
7e395de0985cd87e8769ab05bdfceab21d353327

SHA256
996557b05d93e019d1a05ff2c90b008f0e094ef889febc67f4a4983f9597414e

SHA512
93772c8c19196fa504ef7ff963281f2b5fcdcea0cc40af62ea499f01046dede22d7bd9bc4e7045e82d54722c5c60acb7e56f8f3bd37ec4876f21190f83ba70d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2dde1fd9cb1e42b1b52d4f7d6f4fcc14

SHA1
23f9a8a6d070bb47c4ba3c5958ac021d166680c1

SHA256
76a782654f4aabd9992f77e6bb71fb50e0931d86058d47ffd329cbd8e9ab506d

SHA512
93ec450d2d92fdc244b71fe8b49f0af8f093c448262f9699a7aa7f92f2db63f10e55fefefcf5602b6e94f092eccd6a8f191d31f2528743182886c9821d829e9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6ea941d949177cd107351421d478478

SHA1
7d9f9d46863abfa13ba789813879430ba431c765

SHA256
ef024bdf0ed1b0e90a9e1f120feeb9b3246eb155a2d83246af366ea9963d6fde

SHA512
ba5cdfb995e3c6cb692443632f191b874f01c212186ec29867b630ad78f6ca270b24559736bac5a28443e5f2b058389a4f05a9ef32b3402aa56970429f683f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f28f541d5560a8a2fbf7d88ad256ddd

SHA1
d7d07f8856d58e2edafc3b2a7b246a6cbd40ac19

SHA256
8dbcf3b06a6c89c0c846a58706400938ba10a06625a16a5b5867f3369c1f79c8

SHA512
df0bc0c4a08e00be971c9277f53518e8624bd2c54c0940f988542a4cb4b0c2c665fc451ddd05d81b4b73f4faeae949ad7bda02ba31dce9ee39ecdaecc81f77f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ae249bc1583de6520f30771cd7b823

SHA1
049a29823746da854813c5f7c2ae1371201e0f51

SHA256
9928347fe6b68128e04549464df4e354d206444d89539647d50ecfdce1c554c2

SHA512
f9bfdb5db4b486c05c9e3a7017c03631b901b7390788cfcb31ae86ef5584aadad6d23f4cca76c09542c08233e0837d4b04906d6a7f2b2594c7424e158188902b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
540af86c493aef3f8da6f9f61be73c0e

SHA1
657c1a78089a90a954411e27a3d3f52e6dc23e41

SHA256
e0eb2c74314944b3d212d1b28e1c8120ab8621fb5d40092f40675b272fd8e16b

SHA512
503054a0d130fb729b4f9398b34050c4fc5b8165fde56ab88646843d6e68e8dad10f6b21a7829f50f170b966f565ce246d907bec0bdabbbec208e6a40cf6392b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efcccc3f3a0bf042418432e816209933

SHA1
1bd790f2207d8208da22cc487b285c0ca0ef40fb

SHA256
c3be84a1ed74bae7cc20c0438ab8c7901de79540d0a8d2773c2dadc84935460a

SHA512
c0071495517ea7e94a6df3b5ac1a083658ff24307da78880782fa94a1fb689726c54f7dae7785e807105a68770fb1737e13ecd1bcdf6691b93c125ced53c0c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4369.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7411.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit