fe26afec50edcafd4bc0a81ba366ea616527836fb07b4271bac45b1c84ad751f

Analysis

max time kernel
1566s
max time network
1567s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0eb100-geometry-dash-free-game-download.html
Size

5KB
MD5

afdaf0858516fe7bc7e2486305495f15
SHA1

d5c2abf2360614aad303e400657f1bb533a2f1bf
SHA256

fe26afec50edcafd4bc0a81ba366ea616527836fb07b4271bac45b1c84ad751f
SHA512

724e1a460c5c14da98f3707813c6c13e29d6e8343b22add7c20064d1a3c9d9d32c4c227419cbf4ac6f0223f178276e53ae0d6850de5e3030101c3d00885894a3
SSDEEP

96:1j9jwIjYj5jDK/D5DMF+C8kHZqXKHvpIkdNDrRB9PaQxJbBEq0yTMQr+Cw:1j9jhjYj9K/Vo+nkEaHvFdNDrv9ieJBQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609dca57ec94da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419976413"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83559611-00DF-11EF-815A-6A55B5C6A64E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003b276a3c7d366b0c10f7210e9ebb101fbd113258a0dca03599c4b620fcbd909a000000000e80000000020000200000007fddf31fe58f4fee4bb12cbe356411ae309d0ff134e62a612941320cacc68ac8200000007e01b2dd891219b43aea94eed5402732b8e7b37dc5877c39fe7d2b2e6dbb2a8940000000679dae55a5893330fff34406fef7bbe15e1f215795612d0574585ca2df1f325b5ba0ccca6c13432ef18204ecd322272a3996d7ecce80376e73160d0fa6c7c9ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000021d4790f33c38a396dca2cb3cbb0958b6ffb34a83870f894d5a5c9356bf8b70a000000000e800000000200002000000006295c9334ace2ad7cbd6af8d89c721b60f6e75f69f29e7b0420193c0b78525790000000177361f0d2ddd7fe05b0ee1393f50552c1bcb418310bfa7288078a2fe741e1cf00fd5d40962f978cc5fbb6a7422553070f081e2a7091a620884e73315b6a45665e567c5f2d49f16d8ac3fe576bbb17f402bfc298d84a8eccaf2e5c93c9b8d873757db4b32f6ed4e9282fe498397bd6dc52c9ebb1c38c3ed22ee53f96400a6331d056313d7a9fb2c56bc01b7a43abea16400000009d1aea4cd73650f2fdb3091dc3543305b6666c8d75bae8aa757ea2f2aaf877912a5fc7c65dd779349bf627d9d1a43c7285b6d14512d462d9b714ffa74450137e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1132	iexplore.exe
1132	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2748	1132	iexplore.exe	28
PID 1132 wrote to memory of 2748	1132	iexplore.exe	28
PID 1132 wrote to memory of 2748	1132	iexplore.exe	28
PID 1132 wrote to memory of 2748	1132	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0eb100-geometry-dash-free-game-download.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
657e581e3c4f5937ebd717542d3c39f1

SHA1
e35b74831515a88fda9f6895085e8196dd14b9d7

SHA256
8e11964549d9e8042e58506f36b98fd7944da6914247d78a7147a81667a40725

SHA512
c08030f0b2b79e4b81653e74c6a3aa3edee5ca77353aa166504e5c5bf11adc7bca58f1929adc904af2e256cf7630e0a3381b9fe565a853fa5f0c61f657bbe330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda022b381f8d6335f04c0a05e67c4c0

SHA1
89a881bbdabfe608ff99b2d9ea99cc9aaf476999

SHA256
bdaa52240efecd9d43674158b9c3c9df0ada931b49633c409a0fb070ba6e50c5

SHA512
5585d148bcbe27eb368ff3d3e9c7348a015073bd288d65e9fe5dc09d59165f923d754393e116c3d4146eecfce38ab45277c2bb230bef01484814c9cb164db75b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d23ddbe62d520d9400fe9da34d045922

SHA1
c92016aa02240eb18ec7b25775e7af355878bc95

SHA256
fc2df3a00f04babfdaf3f50d9077e2716c20b1a3b9cfd1b94e733f2876d9f81a

SHA512
f02a712c4c11604314138a410319b8914c5701c334cd8cee139034bb6e0f9aac05b616260335c9728a5b44731a74f82c3907a810bd32ffcff2c153a360424b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74a5cf9c42647136946c2f8bd67283b0

SHA1
5ec3e8a9fc2635a3bbad2b00ea3653be0e584451

SHA256
8d26f218a47298e2d5d8c34c8d60b63bb08889f4a1eae65acf68345f8fdd4d88

SHA512
7315ff3a987d54494c3d5bb0204dc0b792226f11105b66b788354d9daa5b917a4b2b7467384dc2c8d669b20c6e02cfbf95d9ea6e596050b7d0f7b0a33703bac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1cdcba01690c84ae582545f06ec5d7

SHA1
f2620215c05d48772e5b8dcfbf4622c6c7c30ee0

SHA256
4bc82e8e7ff2f99a4a3d8db4b2e61c4f442b17937ce1687343af8ae8352edf44

SHA512
df0e6cbf9c84215616092bc717059a9936379dba25eaeb009cea00e8b7256df2cdcc72ed892c605bf3a909b43daa3891bb9ef8f180e25b66df99c094817d9b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db3d250a30f469e631386677dc20eed7

SHA1
fc0c8bf7e6f12116c92f255256a028917a0d6851

SHA256
69f6bf0907a9c9f31605b9e48761d2b3d772f3beb18c690e0d2446cb749db927

SHA512
e8939f96820f63af59e7c34ce85038f532463439ebdee7b8dea1dc78575ad69d61c2f22dc67f5127f18931cae9b81a920765551342217a7b5027312d47412114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7445ec532d22fb3aaa0c409702fed00a

SHA1
48b551c57b7131039a06eee1ce8621e63c7b6cb9

SHA256
280df10c4246a23ff65c3be6e8da01f6b25568f70d5b851ff75b6ada1d78be8c

SHA512
8f0fb1de82ef131c1041a33762afbcb56964029d04538104cfa799f58145e5b6561e299905c588ac5a7f4ae477a2a9359d11864f3dea73f8100a0dddd2b569a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99901292f0fe1607b94f9c84a45daa8b

SHA1
d9cc5a1181b43e52008621a1340d63ef2e36d39b

SHA256
0f36fa327b7325a1c98e4e3a706a3a8ecbf5734b18c01520ebbfe45a04518d64

SHA512
8fb6e560f51235b6d478e043f7bcf68d9c407a721343ed10382a5cf0490a76a3714d9e3237987c010e2d8dbdaa150e4e6dac2c5dbec8d50eef6a2da43b6e55c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f89cc837d1366104b4d3ad3c7c7c382a

SHA1
1e1629e7ce9e8d399bf3fbb02101d0fbd0807c47

SHA256
3e18b299fb8ca2d557080e16167c257aefb5fd42da20f075bfea95d64acca1b4

SHA512
ba970bf4469c9e29c4e539a5205a626711961dd7c789e3a69d9847d1cb41133185705668db6f6ac198e7287fd82656978028a8d0e253be240f02efac10b7ea95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0efdbd3772ca6729c138e90b493261

SHA1
54c6d001735d6ca43a71766e3a7b05b560987d9b

SHA256
8e094445cb1cda2bea6be16e6a8033d4cd5728f69c02443a1350853ac9ebf846

SHA512
df7202b8b5b6d73c28c6733fb00670180993dc4ca29c122e5b5c1bc7421ccd59fd5bd593ce231fa059f29f91da46d648dd3e370c9f9ccdd21e85ea6f167d2d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ff5a0ca023444d203fff4e8dd5d9036c

SHA1
8e81fd7eb2d3d1f5fff4f3057a1bb39b23babbee

SHA256
b826bdb3cd1406c9659de37cdc210874ba5fe63486d107a6ffe5bcc13ab33346

SHA512
f8bca79533b259a55da94518c7f9eb68f178b54b24f7156dc73f90a35d2cd10f7db33a7e803eeeb55c13ae4eb1d589937f623f368a2eef947d68a90a9cc0993f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb91ac339d0449540b372818589fe616

SHA1
e959f7ebc29e2f578f361cbf781901571053aec6

SHA256
f6a4aa386e465ddf27353e100b6501045e30545eb1dc5c3102ba3870e131fd83

SHA512
78384c76dfbc64d93bb91e4df27e8f9f88be86cee9f59acfd66fcbdcab9677a47711b08c9d90bb2368eda2c9dfa215b1664871996c8a82b1366f5ac76c21ee8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e9bdee103dc21d879ac2c1712ffa7a4

SHA1
cdbd88af1ed1bbcff17c0cd2336a70247b5dc313

SHA256
1bc2c15a3a55e34644ada79bfccd368c4d75ee295f811083018bb86ce06cc079

SHA512
7650da248bc97878f4a171b6c2c72bbe06bae0d2c0ac09f32fc27db44a630913ac81a69c4b349909ced557d0c592984dd691d89c3d9a97e28473adfafd0fe8e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c526dcc92fadde3a11f0d3b0775c109

SHA1
2b4639975de98e9e7e3dd8726efbc362130a4c48

SHA256
c92e1df1016e2620d1cb8936871836a963bd9d33d18566977159045e7b77cb2c

SHA512
aabf742feb5e84b12bfb890d1050d57604ae1436621e15427d35d6719c264fc74c1240352bc471367a6326b6b36c76285e8aa10bc735b1e49f8569ccc494f76c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6997ccfdb0d811a69ef97fc4d665760b

SHA1
650e71ab96176c290faba44f3666e895612e957f

SHA256
0d6dd5324462f34993bd85b0a852c38fa02dd9d418a81ef6bf5c1b5915fd2cb6

SHA512
21370d712e3aaf49d231bc1ebfcbd3b34736b587ed8d4ba214e7e271a66bc9c99272a855d1c8a93a401b6f335b2edec7c08f8d0bb89b371010493c4ca18cd1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd925131dc61831a0fa49265498796d5

SHA1
d97931b767a0440b49dbbfc67205638acbfbba3b

SHA256
95b6d19ae356ece2733e48fe29247fae122bce5801e5a38836ba7cf38dff91ae

SHA512
068dc63dd922e47b0d0913e832fd3b7d10c67bee9e825b16f1563072fc241309bdea1a6242608cb757177bfc7427027eca867bbce02c0d4b8f0a1a26f9b6130f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab362F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar376F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit