9c3dd40b4539a812baabc3b8e1cec9ae45a39ec8d799c1bd6e53d9d64a2366f0

Analysis

max time kernel
139s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Graillon-FREE-2.8/license.html
Size

5KB
MD5

6c32024856003d2fa55133b17b6c7cde
SHA1

d12d861c31d0e9620f3bfb521e0280b6099ced2b
SHA256

9145868c8fa75bdb51f30e7b81ff941737ccd9d7535d0a4e5ca3bdb9da2686d3
SHA512

dfbaec21f86870b2822e3bf44bf54c371cd6ddd67875b901d2575a0c7ebfa506dcba4ae022e4ad286f28c88672ac1fb252771b1d3f4f977f8151b36dc19183f5
SSDEEP

96:4U2VNNT8OwnR7XVUNAjzbdZnLtm5EitdgZX5/+8vPQXn1Zro9/HWh:4n3cnR7lcAjPtmCZXYIYXXo9U

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB48BA51-FF0C-11EE-8951-5E4183A8FC47} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fe4a40ea04e7b45967c0dffbf0e82690000000002000000000010660000000100002000000038790b3b1483ad3b9342e8de3c43108d11dd3f5350b48577eae1f58b86908c0b000000000e8000000002000020000000763e42e59bc35e53c3e6aaa07dccddf09a48399c03c5b9631406f7d07b0a3ec820000000c24b016a185b57112d6c5180c37f5859ddb1dfe8521be279492f17ba06df6f1b4000000024f7f74d8d119f087831d1b275a255da85fc68e7e5f5d538730f8ef93d2fbaab1350a1b4975f1fbf240fd7bcdab882d793b82bbf9ee6dc3461090d18c985ec4c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fe4a40ea04e7b45967c0dffbf0e826900000000020000000000106600000001000020000000d4035a0a86dee7547cb7da168912bb45723da6feed9c4d3ebafa5c0db353d7ef000000000e8000000002000020000000aaf77efd6266decd0264e5e866c0b1712e9a63867d4a6878aeecd14e50f3c1b3900000002e9eae126504446a1192d6ff0538d92dfe59cee325e77b986d26af38c43c194e8a647a8a7b82f24751f6ec3cf1a0006caa0dc4ab32b3de2fc7a53a40f1745a9b372b097a89fc2eb1d69a7931b723c9692c25ef84b1378ceeb0fdfb472cbfa11d7e09e0307defb38527387bc81fb859fe1871b530847090d5a7d244f8c26fe5e3715912061312ff1b78dbabc6d7d288804000000075f7e179a5aff817ff8be714fe90537886f8da65192775fdc65006413d87f6c8523eeb4ee11af6b5d0aa8daee12a080d1b7252def78eaae0941f80aa9ed18c40	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419776045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3085d8cf1993da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1748 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1748 iexplore.exe
1748 iexplore.exe
2172 IEXPLORE.EXE
2172 IEXPLORE.EXE
2172 IEXPLORE.EXE
2172 IEXPLORE.EXE

pid	process
1748	iexplore.exe

pid	process
1748	iexplore.exe
1748	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1748 wrote to memory of 2172	1748	iexplore.exe	IEXPLORE.EXE
PID 1748 wrote to memory of 2172	1748	iexplore.exe	IEXPLORE.EXE
PID 1748 wrote to memory of 2172	1748	iexplore.exe	IEXPLORE.EXE
PID 1748 wrote to memory of 2172	1748	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Graillon-FREE-2.8\license.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize
252B

MD5
af5b7be8aca95dabc490cf6dcac2c538

SHA1
c2c1a03a01556c5a2ca88d3d59ecd40fce5fa19a

SHA256
784e83fa3608f208ccdff4c7470909d565300666b65932b560d35a64e91ac156

SHA512
7899b41f65124b0b3f98acdaf2e588e82f6f5725d3aa17f7bef5e739efe3d60b74b66a174553d148067f1cd669045a5c7d497dfac0e26d1f6a19a9eb2c6421ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
a571c9fe5cbfa93be1f516d5ee1eaf03

SHA1
cb5166e5658a9bb8a8bc51e80509b1d9d6795fa3

SHA256
0ba193d0f40fbb178328acb7ec9f6ea63924d3055ef2bbd3fa179e64885fe4b8

SHA512
c309896deebaa2e6b0d7eb149adf177d89106acff9981b11e66b7b3b99c83404104a6224664f6958f6488b7e98b2ff785a447790f441636e59415ed37ecb9712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
281d1eb14ab71ac56a0839f61b68e0f2

SHA1
c5dbd2ac9241d6fda4c30bc67ded482086f10405

SHA256
fab115a181e6eb4b4a11b418f6b0a2110d5c62e4220947ee84c1a6e8b59e94b4

SHA512
d5374fbce9a490481eb20f950c7d2018e4ff3d7591d216c4893a022e38193d231ae27b7440b35fec58a9f3d8586841b48d27cf585a406fd654ac90ddc75b5403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ac5e455244b69557c1d6d6683b0edc7f

SHA1
3ffa3580ab1a7a3e820e83575373021e2a7fd5f2

SHA256
a638629fd865cf2acfd8bac4c3393649cd96b452f6a0788c5a1537686c37482f

SHA512
948349bb4cb3a02beb016d37d0019c50d8bdf8ee82fb140591b4fb113ee842cff0e41184d8cf3e50f156c7f61791c248dc4a56bd3599df358efa76c2fa2667ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dc9b220bbe1b0d496efa49f25a5f3dd9

SHA1
a0dd353d17408c2fed79c5754e22286627c6b497

SHA256
dd0b09916cbc31b817940d29ea3e361b9e774d380fe8526459e73597f9ec6b3d

SHA512
c21d22b8ac9512e80ef05ad9429456cbf911ba2caf2a5a29f2476fa309cabe56aa4491823a1b9df8e33e23aa3f3c7f643d7ff4153cdbce0e00bc4707f50c2599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f48d86f1838ee264c01b014e8e41e995

SHA1
ef5b3566d5918ffbbb9ec37323c669f379b7c6cf

SHA256
54abe6d0facbaf58d770c4d0666b626a65264312e0acf7cbbe25a7e3261bc2fe

SHA512
64a86323fe9caa84d75e5e7f3fdcd804566133266526b248850650eac6f2a3e85c8659c83464816e39a408f11ed6029e7f6512e9a3c9ebd25701e9073021ce83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
72b3a0d4a881d3b612e96571691cc805

SHA1
e165fd4640335b2609e61acb7db2b90c8c5bc3be

SHA256
2feacc3542003389b65aa7da1c2c7606daf02fa23e5a79b1f41a27bf114e13ba

SHA512
0c10c92b4f1b6c8b28e55b8cb6fe81eeb4a430c38623b086258564888d3699cb669a931e04f398206378914357d3f6cce55f7e41f7bd743367ab717e504dcf58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
9c0be985732e3f08320444dfee46ab6b

SHA1
be61540ab005afe29263709c3a7cffef47ced3a8

SHA256
10162e4a6c717c857bbf2aafc677aedebaa94cc48cc87132825c564cf7dc55f8

SHA512
8fbad006c8a27e0c6d561f7d242dfdb2b54218f63b9fe12d1084f3f564604416111881f173c563e9e0b2d4de9e40aa1067e7480811c215f1c96ee208679bb50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
e3cfeba56449a3aa882963a4ae948450

SHA1
025ca810ebde898e3b72617d2ded2064f5097459

SHA256
80c7bd97dc90728a34dc73ceb6c8bbacda7f3b758699aed438e5c079d9bf18df

SHA512
ba34403fe58212926db406a77ba597de8dc9b146939761d0f64aabff0d670ef34f46ca3702ec5f7e70bc1b6ae760f1235e384d20a4b396047185c02af61f73fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5AC3.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit