Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-05-2024 07:15

General

  • Target

    www.3dmgame.com.url

  • Size

    122B

  • MD5

    49cbfed4fa9b3fafdc9d499b6163fa62

  • SHA1

    28decd9138bd3f7b3ef38bf9e40cd0d6305d1cdb

  • SHA256

    03df27e82600098c34c413cc2e45b43638d3ac33666960cfbd913f1c3f9a0b11

  • SHA512

    64e91ed564ef64d7687599012c4728b811fec2661dcb7941374cdd3a8450563073c67c452d97d43545f49182fbda2c26702dd35088723ace21717282d1233627

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.3dmgame.com.url
    1⤵
    • Checks whether UAC is enabled
    PID:1312
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2940

Network

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    544702e083bab7b9c1881bcab84c1195

    SHA1

    eb9321a89d7b1be58a2fbba6463c76720440cbeb

    SHA256

    f7041aa46bc920a7ec05ad6759a4b6cb1dc4694d5df5c8abad2b224bc59a86fc

    SHA512

    030469f1750a3f03f5f89ba4800b5697504c5434e6b0ded7513aa2de25b0ab5aa7a6c0489ee06fc525bfae8ffb7f03975d07e5861157b104e7a2fb803a53269d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    a8683b3eccc82ccf59f4207f242195ff

    SHA1

    21b148175cb3908b27afa1f04438598698e61d92

    SHA256

    b90184ed84dc44ac637c51e8e240bb2f84460c21c095acd39a56b4cbb483498f

    SHA512

    0e0fa1c426ec6849808f331f886e72af86ec29fee528cf6c48d5a58b6579ce45bfa0b63ab2541f2245ed0f4ad424cde404b9b5e187bae0a71b8f49310cca6457

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    3c9d1c920a4690fd5061f4bae51dabc4

    SHA1

    ccaaa2ba789eadabc7e78e2d521641c7025f58cf

    SHA256

    2da88d5428f2767811bd97c06dadc221b8b88c0ee0cf1fd9f8141436438c0ce8

    SHA512

    305d8989bd2b2bd97c674e690f1cc1b2b5a10040afb02dc2f1a93d7570c1c65064048f9947800626b0bf273b9463a923ddd652bfaf59e0ba149326b632b96a18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    644a6120c73f49bf022a1de897bd41fb

    SHA1

    0755bbf4c6a18a5ecaa9b66ed8024558bcb8708e

    SHA256

    98292758a1e9edc0a27f0f7e82b37b003cdad524d4760579a23dc150badd8962

    SHA512

    89e3f074de589c9d1269b38c38dd00dddcdb25639f16d8edbe9da3fafc130aa9db4cea1abb5427acb3c7428540062148b96dd3deb5d3cfc22d76658ce05110fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    7c7423e057e0fd7be181bdeaac39463d

    SHA1

    094b1c4d2cda2c5d9186badb872307b7023fefb3

    SHA256

    6598551ca2a4b8898cb69768760c5a52f42d7ab8cbbf834aad65a164b86b85b4

    SHA512

    8dea47f4c564fb771e13b70d0aae0eda1dd403f5304fd616c5af9d727bbfcccad228b3eeee4b6f9677a046587dc422e33bad21cbefab3b69f943d7b15aa89859

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    aa467ce5b791c0851a8c3ae6b3329653

    SHA1

    7ee14ac43356c873c59f94ac0ff2087afdc2426e

    SHA256

    e6784d4bf2e2dbf5f9a5dbf7d2700fa9d5549bb491e27d62e27a2de9e2e73943

    SHA512

    5673af5f58c226cb4679cd0923b214cbcd72bb25afcf3a7c7dcc6966f22e383da1eb6dd4c2eae54d5890ec9208d28c70cdd81f9446f61f7835f520689d7ca711

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    3b5caca4e3a5e235ed26aef243368322

    SHA1

    5f007783ea83877b3a89d134c3147b8ca23bc885

    SHA256

    bdd7b3dca42ab58f9b8e857f105b0b709de114eaedd6fc24779d1efcc6db8d49

    SHA512

    4ac2e8de06ec70929f9ec9b64e249c893c5fc906ee4e4839ca3889beb9e4ab5642a69c3636cb8138dc276b7d88e1c0b0e2ebca55f59201b61728ec1374c06d91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    87516ba35f3e9a3ccf7a44a56a86bdd8

    SHA1

    35a853db85b291696d80149f058575a1dfac0cf0

    SHA256

    64a021d657fe6644333729c643a91057faa88c5728e2cb987c608edcb70e1ae1

    SHA512

    1518728f866f5ba4008192da91dcb759832063ad4cd4e541586505228e0546b55f9658693ed6e36593cef358c8510b15224968bbf36ba92c1b1892c261f2dc29

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2adee55e9895272ccbd9db38b09079bf

    SHA1

    75c087fa0c4beb01064b26ec9b54ae79bd0c9df9

    SHA256

    f41b6599f1d4fbb4e905fe051cf3ae4c52e1db6fbde06013e4cf15e8c3e748d8

    SHA512

    2ef18f5dd888158bafe3396c0137e9fa494e18ab2df335f5ced969adbf9874932a4c68d376e9e17edd9007fb3344eb22c9f396cd4462bb92b8b88aab0453fee5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    adf60a38b5b2651ba6d16fa260b4a6da

    SHA1

    aae23749e6f9d48f3d9475e2fa8289d0f0e89d0f

    SHA256

    f734f188ffb717a07c5d5db44402d577afe1127c0b3efc43fb39de629f61c1ae

    SHA512

    b361766c199f384b0a49d1bd0756a8517560076bcfa78ab71390991acf7682b68b36c3819a481d221e17b49e09e42c210b64482aa8523ae56e0e759401965b98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    d5b6f180d62f63dabcd4c41e445b52da

    SHA1

    454a67154492a9353b059b3fde9dea5902e76f88

    SHA256

    ab519fd72e13ba85ad01fae850813994120a8dda687909e5cdf77013af699c22

    SHA512

    f575b51f33500817a7f7c0559f8db7997eb4c8134f3c622aa2308fb3fcf8263b0972c947c8a2c137cc7f610a229b0d672e6e47d34600153a7567bfaf0a63da1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    007041c818a4987896d2ce2b8eb9f431

    SHA1

    8b5e40a5d02839651798373cee82172c6c54cffe

    SHA256

    167156c023c3f643d4a3bd7e11a1040b934044d624bafd9304b5d9bd36b8233f

    SHA512

    d5c7f850d4407308d286c34e78cb8045485492da7229d50ccfb070eba54817cdb3f33cf2976ec53589d64b93656e8b7c98a2eae3e1744bd69805649b6a9e5b63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    c9e300aeee8efee53a80721e0dbff873

    SHA1

    813aaae5afd39a9fea6828b3955f6be64c0c90b4

    SHA256

    338eb9e8162bdac506478804654859ae4272a98a4e229966448d90a8662a4116

    SHA512

    d9cc15e34d5af36a1b5c9e09f976057c5085064aa78bf2ec44fdfe42c0bad318d269d5400e8fc40913369dea69219106aea96fc0c6326ee8e64856adf6ac97b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    c6823c5d9acd61bb7082d18e806114de

    SHA1

    81e93af4fd4b1ce4eaf93dbae44b390f8fdd72e2

    SHA256

    e1663b0c794dd30db3d38ef28c1fe2806a2f293ec4be84c99834f98bb43e2d43

    SHA512

    6cd1bf5df2d31763f7219f0375c70ad45ec7e76a36f84c9a3707b4163c12efdab5458218b7e902d25a8bff11054a801ea80c4182abf478d22c8cc96010ebf39f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    7d339b22938c02b6fb43575f88f98642

    SHA1

    46b7c74f8090355401c4fbe82577d960ef5f9e49

    SHA256

    49721758df9b1f7d9ccc1f3bd8ed4c302a58458dbc046b09584adcfc46b5b3f4

    SHA512

    be99dddfcde53f2308827a5418813e2b1db9c1b50fc39c5470084ae55deb9ca91e77fc7a2f2a3fce33068282d77898c9fd76cf0455d626f54802faa2d586351f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b2a9fa26c94d081484f0266de32c4b22

    SHA1

    50a675abbf4759a1a236b4ccf07be2fb4b83b6b2

    SHA256

    d255ea0b7537f0e314e75379173feeb3e7fb294f3b7edc3a45950ae1a25e2f6a

    SHA512

    876dae58a26f1e7357b2af5c6bc8e4c0bfaeb84128a21ddf85cb2555874e70faa5fd2d6eae7c69b901a49cc08d7b541c3cca84f3a79ac94d6855159476588d54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    c08c6aa4c0552e35a9b1b50abad201a5

    SHA1

    7083fd96fbcb1b01503c94963f0d4911d80e4e86

    SHA256

    7cfb09cbbb8f3e3d18bfde67b545624b95da7beb9701e22e6a6e91931c726a28

    SHA512

    66e03bfea602c776153aa4d628d73efc8479a26bda4031fbb0c0cf5e9a8198b391a86af26a7bea914fc1531e92286ea7ee26f6e4a882b10640c9037e98b512e2

  • C:\Users\Admin\AppData\Local\Temp\Cab24C2.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar25E1.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • memory/1312-0-0x0000000001D30000-0x0000000001D40000-memory.dmp
    Filesize

    64KB