f006540a62bc79c36f241ecb5b1c114e6933300e3d6b09e35e014660914bd845

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

4.5MB
MD5

d4a79b5d46f0931b9eb7125fd40baff0
SHA1

3a38fb263dde2251b9fe157b5fddec7acb07c53e
SHA256

03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
SHA512

17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
SSDEEP

24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07993a3f693da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419870886"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000e10aebe5032e72770d6531a279f83462f7639bef6f9e9354b57f3f3f0174d40c000000000e80000000020000200000009893c6962d2473df6a925473a058ac0144867b9eea626ceea365df5f451f80602000000080da54dc550c01282dc34ae985f824c098debe5a70d6dc499d1874a0c09bce47400000001b1efb0e757c288375de7fc5a7731151ff717ead85e1ecfdedffd7a137e3877bcbca71ea0c76977a938ec01d7f3dd69787fd6537d490b7b1784e3164241fa541	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000513aab826b0b794ec7bf1963ee77d6b95a22fc06043417e1082a6cc8e211f449000000000e8000000002000020000000b046a44897abe2c49fa5d6816fd4c5649eb7207aa7ec5fcbba86c85bc46c53b3900000009a02e6ae515028bb436890e844d5806f20833ece1c4ef680f6bafc36734b5634a611ce7e74ad841c15d5a778f8e29b416164e9e3785345e0026378980b274415b65ac6f096a6f0e0ad545359e6a91514f74aad68aea215b48a8b1c35c018a889dcf3ef277740c0b21e519cdabbab9ba3fecb641c1463221f3f5aab7a7c45829928445920246cf5366dad444a28303b334000000042c4f5aa1d534a41b643329eefd615d340b0be65ca3988ca1c77a78bdbeee2f7f84e6519bae87575892f53d376e8bab891560fb6f1468a69a77d1a7b25581517	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CEC8B921-FFE9-11EE-9A4D-7A846B3196C4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28
PID 2916 wrote to memory of 2492	2916	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f6bf308737d681bc1a71299e4351fe8

SHA1
0a4f1c7355fd9026a6ee3be68670d0b8d552d23f

SHA256
ab0341f0131ad3a9b8442346a021794dc93d627d556659a4d9b86405d1f6720b

SHA512
da260a0bbf6f4ecc1b1318c4a15a703e2102c88adbec34db6434aa157b0310b7c3c39f0f3ee542bd83d7b4e3bc24a956342ee756f176d60d944dbe1626034354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
335f1084aef89a2b6019f2e7bc50dbfb

SHA1
4ac3f060dc37026e3d468e9da193118ecfb2836d

SHA256
d1d1eea2f7aefc652adc329c5fbd90821b6ce902a4daa72fccc85782fe7e9424

SHA512
c2b7c49b4dfff7b72e2e15aad5e32ccac1f1dc4d0310d3aa940b3560b0d10ec22076908356bffa84e89d96213c56c11bb91d7b81222b8916f00698483503c20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08db9c72d655a624a2821253b44d5a64

SHA1
b99b72ff32e2142706762e58e9ce42fd43fcc9eb

SHA256
269d44db71952e6b3479c1e05bb3242111beded7bb0d07a62dbe3ff77d418467

SHA512
dda9c748c4682374ed5d33a212c48690096b6b5cafe75bae09b089167ba400c2543a495626e4f18a8894b13ec869fd685daaf1d91b662e2435aa5867be7c6e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62be3c2568a35de47f033e77307f256d

SHA1
228618e443fbe9e5a5aaeb6d3c6e6961d48051e2

SHA256
9afaaf13ea0e7a85e49936df339ccdd1ab4ec8cdb5a605997b5e78e46d6f1aa4

SHA512
5da0d9c0206d8046e6bc0d6bc9e466ff9d0241578f161358ea49d0683993a2491372a02fe8b22b86e141b772da3b7deca716b7dbf92c68e99e6f571a2e864e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0bba9dd644a0e8ac5bef663917b9e994

SHA1
dd5babf1595ef33242d8fc6353d3246328a71e42

SHA256
6db50f18a2a651edffa6b88b88610be7f19c9428bb0105303d3e09e867567166

SHA512
45f8165ad318fc126031e0b62c6c5a41fe6ada967e763e1bd9adce466eecdf3bb3bbbd99cf7b296d12895384b698e7514bc04f577abcc967b9737c51a35fe2b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
331532ca2cd2412b38b8402f912464e0

SHA1
628863d1a005e4e4e3a72ec6d7ca88368262171a

SHA256
1cbd93685b0d799f5ea52509a6db05291ef4d1eb54599cced2b7dc557e22ffb9

SHA512
741d3f90dfca03042d7c1426be91d9ef0c8d2be80f018fe3edef838b92ba6c5d87d92fa0539c78e0ddb5879496f0862553d45527ffb47777d8366f39cc8f6b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706512bce647e045e9264a5cc6e9f2be

SHA1
7a1daecd610e54784fe8ac0e9edea93ff76cb3b2

SHA256
941334e322cb327e005bb9eb429583195b95606a1022e8c513b4b7358e5f96c7

SHA512
d92f4d26cb43e8ce396685ba9e280763be0fd280eb5c3c8ffadc6ea11eafe33845e91933c7378626bea7036489fc4144948ce12e981da2d2188bd56ffc05eb89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5202a3c72c8c656f67cb4133a7db5d68

SHA1
a41ba096300b1e89807ad9dea4db09e0e2d07086

SHA256
c821053889ff9f477bf778dcb6554e59ca42b981306e000281b7f4f9461dbeef

SHA512
9de8b89020ca5471fc83e03ca6919a2ea511ba644db8be0195ad38bc391332b83c410581cee735e46a4a92ba28967c00b98d49bb895387dedb0383e12bffafd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bc18108232edbafb95bb501401641a9

SHA1
128ebcb6bb0d07515d2942a0f5e3d7e67101323a

SHA256
a1d32940b0e15b9898b02aec9a8456fd093de97944f601e66b98f2cc93497f21

SHA512
9f21fe436f9c50dc45f05a546f38c9be944c6a63dd63fd046a8b8010c44febaf7933806cf4097f496a0ed2e114583b4ece1edecf895e2eb478f9b3fc326da182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46765739300c92accefcd79ca68bcfdc

SHA1
8ffec5e07b144ae70c4c3d6b3d986c1949a80a44

SHA256
ae72e948f1306fe6b36f069b85b60b1f747d67f628db87902ae92dda9111fa03

SHA512
b5634edad1e369143229928497ee879785352c4bcd188e41b2bba064a1737438affcec76a78b4563570a4aefbb6376df2e25fe6f671e58bc63df5cf26735fbb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38A0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B08.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit