f3beb34cc046e27623b8ed753d3fc50584aaf6f388aa6bb75780d1043326e4f7

Analysis

max time kernel
119s
max time network
134s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

312446edf757f7e92aad311f625cef2a
SHA1

91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256

c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512

dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
SSDEEP

24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000007b1f940b1e8ee195d1f8a84a7edf211028a4294d10e9cc1cd61088569292622f000000000e80000000020000200000006b46874298ee65cf60e94c0252edb407445cc644e99cb9daf27c4f8f5407366f90000000c48dd19ab576fcdcf3d8a31ec5fa5f208f0050008822182c5567bba4e614d38fb8195867e0b141745386e179291ddcbdb956a5bb69ccfdcc86645122021f314bcba1fdd7f12295a5f0312f10129bdf4acfeaaef61dd95d6314a19527b0425336e6374b6b15db7f8b311941072e3c5f0eca1ba1b941c70738fd5e12346ea0461ab65d91332ef86e7c0538a0739821932f40000000c3d5f253d203a0a0a495611e698a77bc3dc1ea6bf543a5859cdb30f44ac5328177f79dec81ceb7d3ed09a2900950c7e1f1c1baf49bc966768a3345890d98f263	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421548025"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a36041dac883f0c0a64b2d502691c67e22434a319b6674560339fe2729587d33000000000e80000000020000200000009fcc08680ce5b28f6110706cc974d89aa22423856dd2c815f623be3f2b85ed1320000000b221850c0380cd9c6e79a49c074aab6a8d6c99063f0d3c9953f02314a73f4f4740000000f5d47d13b5bcc61deb900e25e1de0801040762f7adc6f4da7554ccf1c1d63a25c6122f11875aaa5eb10a691b814b5cc844349f46a25b1cad4f30d8fa48e67158	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B54381B1-0F2A-11EF-8B56-EE69C2CE6029} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2029528a37a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1620	iexplore.exe
1620	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3044	1620	iexplore.exe	28
PID 1620 wrote to memory of 3044	1620	iexplore.exe	28
PID 1620 wrote to memory of 3044	1620	iexplore.exe	28
PID 1620 wrote to memory of 3044	1620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46f4c1a0825fb65759a39f1c90244899

SHA1
613d398cb1c586b8f8bfe954785fa7e5c19335f7

SHA256
a14cd2dab0f7939930c4c9dfc8c4497c92d10623a919d360e0158562a25b5f9b

SHA512
8e2c1007139b084f235be2b55c35f53ca8030851d1dce114c0463a91f6e6c4c53605f0c94919d17acc89338cc3995a5ed5ac12fe3aa79225a96188064d17f931

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fdc01c2b6a54cca35dbf3610a0d8de7

SHA1
5bb05641de342a368da9746d987726a1252eccff

SHA256
c9ef122ef153e7f0a0733679a824e2c4b9303021c0bc6d23d4af17cbf6dc6881

SHA512
6ee114077e0a94f00ad7f6e041c80b8c586a93147a09fac736371ba8d54ccf70068b2a0ec74bafda2c1c4f210f037ca809abc5271bb1f310eca5e728ef82a233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f45c0dfc8c321665545d28a6c96e6dd8

SHA1
45e1925828b7f15928d117387fe4eecbaf61660f

SHA256
148c4df4229e70ceb0143bfe08fc6f1f5a940fdbec89d1d80a8f620d4d016372

SHA512
fde9887f15f3b14f9c3febc39dc0d2857a4cb859b59e689be7df33d89813d234c59f8307359ccc4934becd48f20705f8d7a651cabc6f02b49e8c6faa004423b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e46be761b414ad7b4cb6b2dcc6adf3b

SHA1
55f465a11202163cbc874fdf0b089e60c17ed76e

SHA256
32a081626dfe326fca51633088bb278e457efb1bead07f7b2651457b9d135b67

SHA512
4b7c657517034c6c29f893442444e13645cdd3eedda325ea1fe02fbda0c38ab762e5391df64ccf7c25b1a46ee35f656dc030c599e2140d4de4578dd09d2f4a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb199ff6f7700b459b66ad22b939c83

SHA1
d686ad337a2c76426d94ea142258b85dacd7225d

SHA256
80ea959d4b656743f00865a4ca162238f0a6cf30e03944d5fe976eb083f37928

SHA512
a5e79b9e0ac60f5ec0bf7651cf6e8bd731c9c5781714be3b2ffa5fd7bc5fe18cceda3d1d38c7a8a5a833cf0f72c3696199a4dd9abc8fda552fafc5155a7706b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17929930444c897945eac067dcae35e7

SHA1
72bcec681ce4185a66015f45c83c8f569f63a603

SHA256
83cc8dcbfee36af9c9453c622051b3e71b5ce26d2ceff6bb518e0e143ca85592

SHA512
bfab8b6d1236c6f8c12418428e9cdc6a179c86898f5e0c821c6fb233ea8bbd8ce916c1704bee73e46761d54ba3f557f0d863e67f7baffac53310ab9003b0a468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
acf01dfcaa0566e8f1f8a8773578f8ef

SHA1
d014f7def50d16d8f006acfe0c8b1c6b6e48094e

SHA256
1cd2ea0ab0a4c4180f240ce3e721aaece2bbd972f0d2fa910f749e43cf078fdf

SHA512
c782049f44e5665a6139dc557328c39c44a7f94f624a8c6ab1133456b5659ce341723c760af1ccac30f0a3bf1bf33b11cdeaaa277c78264caa245c66ad18ebc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbe1ec4cad52b3f1aa1122887d2ea275

SHA1
eb116e628e5d1634b9749e183226ae15740d14c2

SHA256
b91418daba4f60d6a11cc2ef2f3a0b2b09402becca09968efb9148521d384c89

SHA512
88e2deccfd435eadbfe6fc08a2a2ed437b6ddbea19e324104d7a5902de00180bb6e103fc4f1426af413b08ef16e63a75327d40775151e9d5a3791b1a94ffe9dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1af0b5d03f2de5da0a6af278d7f574c5

SHA1
8f470b9cb83fadda0fa67f5914d4ffb612ec60b3

SHA256
e6212de9c26c9a71ac9ed3303ac057859bfb3d26e6a928ec69728eff148e80fe

SHA512
3434cde1978e408b1380e86fe866f8ede3d382e5bc6b97454e13b9f514f33ba0127039deb6dae40cb5142bf0792ea2f7b6c43184688d9842d66f26fab22d5a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac86077f793f703e64e517f645d55d85

SHA1
91dab8443c678bb70c8880c0a0981c2b67b5502d

SHA256
6f3de745ac9366de0bc31d3c026b753081f9ac4f60d00b4bf71afd711a75d7d2

SHA512
bfe3d31cd9adcfbdf77cfcabe86d781a614b9fb8757a7e25adbc942bdbc03a594fd7d311c4f7c1a5083fc354f409c9f36295f1329cb53b729165f449cf1c25d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e4447ba213741ccda4ad665302abc74

SHA1
7ccf57795a1bfeb6d16d1c12566ddd3fe75b7907

SHA256
1960eee090215386fd6ff46e8a17f1a07ae47fc81e323811f42234bd11ce8478

SHA512
83d9dff60de4c7727c86ad5c2d1073e67311cccd8fc1934c07c54e390f5025689970c96bcd3a9d6359b004c3a9addfadbdf81f0cba4cea3728abd0df9a545ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38e3d7810a544f130980cc2dce32791f

SHA1
9e26ac290e606a40c6ef4deddb906f11f86dd811

SHA256
682c18fc2ab54968f9b5999a5f81fca94dc11cde3031eb5c258ef2a8efd15fcc

SHA512
093e33acfedf4872855810b5a822f66edf8b73387e0e3737693059eb75425f6825a1a9d4ef41106c7a31de5ef23c949309dc6fbf34ac662d2ac37bb54e0d41c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3152246c834678aa1d2e51b9b163b733

SHA1
7e519da49251c38d14e55e9290d348bf71ac37a2

SHA256
5c59773d5d06cc36b316ddda53acfed3184d361a2df1fd8745970490d5bb9a60

SHA512
6293567d50b24416d34eb643ea8cd429c7d380e97fb858466a8c659847f75acc1bf3744dea1a35b3681c7858ab14f89092a05630c85fb8807439b06f0e1d5918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1635c4516e81e4a1cceb5d9d7b3e0e2a

SHA1
a0bb9e11d9d83044b962e009a76aa25403ec8e5a

SHA256
dfee45add9d42c38b8a8411ed84c9e4be681f8c7f7777799c00d879f9899c437

SHA512
fa8af14ad6f3053fadb5b00c85263b106ac7de8aeddad909f7c0cfb2393ec14e08380c6d3e2e1b65510b5c80725c6e0175237ee5ae1e2303ac71694388cc9624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dff0a41ac1e16b4a82d83bd9a619cac1

SHA1
ea52729c94de029deb214c3253ca50020ef159e3

SHA256
70e469ebe17fe183d99bde02c3dbf315c1a852fda2bbaebc1b300ac2f4d8ede3

SHA512
7aca475a0ea821cb9b03392b6b8823586b297a64fb12334e3abb38b0be095c44b21d0523a7b658f9731a77417c89a5b7530543f2e24485ed7ed56aaa4db62d4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53707870b4cc38cd44f6e4d5a56f77ea

SHA1
7b222e1d75378ffabb25deda13032601e709eab2

SHA256
9afae154e05c9ef2213d04f2f93ceadc7052107e6bc87b3944f95c92be69cf34

SHA512
7e05ef251ea3e93db6bd973b26a7b692a3e78a07262efcf089dae7f39f95e6746580c46ee60b14824b31584d94ada282e8ec4f4641d6500ff72700298ce2766d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F72.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40C2.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit