d38241aaa6308ef9f79ca6ba87b8f903fd4aa2f44307a45076d0c244fb5c544c

Analysis

max time kernel
147s
max time network
169s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

d5b1f4d67bbb923ae30f5d5ac424b269
SHA1

e751270f329f8f5cc882e615157891421f569c79
SHA256

6bb288835bc59b4550338d8034ef8fb9f05714e890ec08c327149c82142cb4ea
SHA512

b8c5ebcfabf56c85467b27815d7b2cbb0ff922a5bf08a3e619772644fb53049393134d17a849d3191a29b6af1218feed32895bf26c7b77cf3ef0178552ccede4
SSDEEP

24576:dbTl6Mc6T5kJWSSRKb+oFDwmfL8646a6N6z6fkHuVampem:tGBAA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419774729"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000a157d26aa58e1abbcc313e6137547c9a2f63b28231550d6eec15c70ac1c58f24000000000e80000000020000200000009bb6cfec24b13163873e2ca3704d6ff7a2cc0ca27dcdcf2d6d068d746296ba84200000003113eab2ff271aa531f8e90a7721f3a017457ae38597c3198766ecdc76432f70400000009311b0ef61c431f577e2fc094b30722c4901306cd1a19deac7f8bbd7f271264d0e6ac9f7dc00a1e155ef6be06c0b47083464137ab9072b98b26b1a3be2802e36	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000cdee605abea8c334d877bded6711a3819be9033f6a3d7f49359fecd2c974849a000000000e800000000200002000000029db5f77c33375a3b31b3b2eac94a9f55e267fb1981f9f1340e5eb8ef06d2c53900000002737f42093697ff180939e9e762322e4157266b6298b51a237e22ed0a50d6f1c913661101b2e2d6b9ff61323bf81fcb3c1519b7cbc9d27275e9cab13cb5abac4c53e971bd86b1fcdb3c66ff464fa32816a9e243f9adb888e343db95ff70722379e57cbdaf38bcffb2a05ce3accd5de0e287c3af91f9461f2e6fadd3ab8cc7baafeae40193292ed4566167b9bc66c2cfb40000000b4aab6c37bc1ce9573dc5097f8678a0ddb0f44af2c92ed7f18bb4058ea24d5ab4550f0798f7551ced8b72f155b48efaaf6563290b64a564b00fe42fde9a4d94f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC0ABA1-FF09-11EE-A7EB-E60682B688C9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ab56c01693da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2484	1936	iexplore.exe	30
PID 1936 wrote to memory of 2484	1936	iexplore.exe	30
PID 1936 wrote to memory of 2484	1936	iexplore.exe	30
PID 1936 wrote to memory of 2484	1936	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eccdcf3ddfe623b105cb59f89f8541de

SHA1
62748f3e652638c88af1a7b6a32afaf38c8bd72b

SHA256
5345eddf6ee836221cef42d635fdbbcf64aea5a612a1b419251cec865538a4a8

SHA512
ffa8d1a8e42119c34b3f0b658fba2fa878107943f573df398d931a25ea034885ce964c6e573f0375a608dce4752e1e4fdc90d52a33676e1dd649a8bc303f5b1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33113c0a199e9d26568fff3b2600d6ac

SHA1
5bd0b677fd5c9d8cbe97cd1d967bd1c40a397ede

SHA256
d48f96e6aa709535dd284e9761c581872822e21d6369feea185c3b18ad1ae67a

SHA512
c5cf8c14d4e6a1a57126e431071c563439420cc77b9ce3f808ab4d9857d5e993eca4160428ac36f47157459d9ea423c19b4863d0a4a46576c14fb7256b295c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
231a0bf7d8681a72b0800bbeb0a77b1f

SHA1
05bca9705c1ec23d6575dda5f8b023c9ab580898

SHA256
f285be8c7ce01860199d17dd3059dc92320e4b5c586cc643514194e1e81cc751

SHA512
149a6b77a49b0168a12665fda952f38e3362a4fafee689e9f0bd26dff567441812c37824b554b09043516b3cf461cbae35a43934128b5236a239d75a1218ef0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3446ea05131802c8d53d2592dd3384d

SHA1
37f1c54f911bdd125c52d23b2a27b38c4a67b4df

SHA256
061e83bebf38d07f6863f765e8da8a6f91dd65d17b46d061c40e391ce2a8362e

SHA512
1c8fa788d8c7f87940f120316a6b1b8733089d78d9b48580a2dcce13ffb68989219c82ad496497a0c07c41b39364d746d0af5d3bff29f17b57e0fac2a6a085f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ae36a725d98f3a29005f0fb5cd18994

SHA1
00dd877de178a5121491c5fc9bc428ae376dc9eb

SHA256
ecce4a95cc02ead50a5500f17cde06b02255f481d1a7cfb1238fb250942dba16

SHA512
2981ba7e8bce5d8478b2e6b427744f9c5fb1ecfe58d72c3256e275640fe7dbff9066554576d80fc17e61f88165c062b22b214d9c474b3ee9ddd71513c24a1d1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ac96c317616e61e7c99a22433ee29f2

SHA1
42e1d322e520208bb91b060b4373d86fdb82b676

SHA256
5a2e67e56cdea7865620e8c40e1353fc7f0bfa42d6e4f5e5bd4efeb811fff00e

SHA512
b54ebe8f97819e28a4cbfdf2beef332ffb01d11e81761f4c52a4f98902e0cb7bfe3768dec55d5eeab69930194366b87ebe320fa07526686d14701f70c0bccbc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1d05656b1c0b3ae6e204a9723f09581

SHA1
8f43f2e8c00a6e926bec050825a39d37abe756c4

SHA256
ed8b970599bbec7d6538a24b6d435537965e15011a512757d02f6aaec6fafe5f

SHA512
37fa40f88cfc8c8202049c9cd8585d6072aebcc746e101d4e502558a0b1884689a764974cd80a00eee8425169592edd6cb5bb5c1c93bccc260fc552bb6294ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
078295d7469e00999c946f2f19756188

SHA1
87a891e1e67753736cfb1277e32c6f3957f7145f

SHA256
913538e3acbf4a47a4bd36db7634be6472368b95dc12cc727736e3e8eaa13b6f

SHA512
d7c468195cc421f7dd0c143ed0df2b990ac6d92670763ab73bee72076aecf841fa8856c0dd9c16d3aec676c9512656b778b937cc3815c218d9b6835268d81918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f74004b59bedc9fe3d4bf860c38c862f

SHA1
ebb2cde368decf5e23f4f3210114b8b0d3fac1b1

SHA256
6d6609218634003eee6bbc1b856842590d152b98ae34aa9c94c01fe09321a685

SHA512
333e6cc32ded31ace85f8eadf817a66ddbaac7f4980f41b11340ab910a27dbccf8ab26e9dccf49ef486d39e4baf6e578762019ed08bb9eb1a96c60f92e7e5409

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bfac8bc14b9223ea1c7fee2d509d96e

SHA1
f2445572798a75674d2976e3e8a05cdb25107cf6

SHA256
6ce04fd3d3ad88e5347a1a683aea66c1292cf561547140b9d0c75385a5c739d1

SHA512
8600a202db52e9504c486ca623c5b09cf62143bd7944c3bd512b1b4b1a7ea3143466070c2caabfa1e55c9db5179479c7fb76dcc8edaca9fe95253879a7d210a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20e69ade5ba57d35fb5a0c6c30957a9a

SHA1
ea428f5d99028488d65c5eb6847ed45b88ee98ea

SHA256
0e78871a94bb36b847736574459a14eb6d0379192360c0979edbb8c357258770

SHA512
4345a0bef073d9d1232f7019eadd893b0e4c785a02812928b58f815ace46d489080a97bcd9664b399af4f4aafc67c6549b38ccd777468388916183e610f050ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1BFB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar298A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit