d10c95fb6690c1dc0053749eaa3c98a71cb93fb3de5d3ca3062289031254b5c3

Resubmissions

16/05/2024, 17:46

240516-wcl8hsgd53 7

16/05/2024, 17:40

240516-v9a13sgc23 7

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 17:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

312446edf757f7e92aad311f625cef2a
SHA1

91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256

c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512

dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
SSDEEP

24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000001cfd8b0bb78b2402d1d235c13305c560af58e592b5e480be029ec99237a838c000000000e8000000002000020000000ce9a9ecf1f15703be2707bdffc1bccf5d4acc740f7c6fc013cc77fe7cd3e3f08200000001ee4b06f508f73c86fe122ed2386d503d41c28ddfb695c3c6a16708fb522ef4b4000000074740c1103b29183f846a1515681a164ae6f03b9021da238baea779dcb3c847843461c19ab4732fdf76146140597541a3ac71e9dba468eb34cb4656c3564eba8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422043264"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000adfa166b9d9cf3ae4539b4bd8f5411d98644ebed088328e0b1717389ac19962e000000000e80000000020000200000009b72841eaf5dddd593a8cc93125ad571b497882d165a3d2ccf3169799fbd4f5f900000006783e3ea5d2d4689855c2ecd73fc1395d44c3477b1594d98ecb31f0467fe728206f3e4393fa164bad1addb0d032b76bb679e7198dc72588471c7f11da49038039f4f47f24ee4660126c2cd528013654414592e2e6204f1f542dea23a38a24ab39a3f282739e512e4563ba8fb5ea1d792cd2070a353c9873ce0ca58a41849b198b35b903fa60c32dedf8796e8f31d1a1a40000000805dd4d84653943f93ddc6d558618442dd371632639a37d61089f86f4e6ae4d08f3e93351a66f236e6b78cff1b8a66070c821e4eac3512b844ebcbc11436f12c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a66a9bb8a7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C69F1341-13AB-11EF-9ED8-52FE85537310} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3012	3028	iexplore.exe	28
PID 3028 wrote to memory of 3012	3028	iexplore.exe	28
PID 3028 wrote to memory of 3012	3028	iexplore.exe	28
PID 3028 wrote to memory of 3012	3028	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2410c9d687715978da0306772390a85

SHA1
c2874348b901baf56e60cfd6a206eab0a5b579c0

SHA256
5f69e283e2232d7942f34c7a81b73b1f0b22596f358dac5212bf4d4756a96010

SHA512
dbaf0808951a1ae78d1481a1453679e16b83533291bf83c840ea9065f0b5738c964f24ee77d6e4418fb1ddffc24fbf0d949d7ae6edebc3cb8509a79677134896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e427a6c1455e6181fe4e968e0cbfb165

SHA1
88087704098a9628ef00423e21aa309eff651922

SHA256
3a894d2e19d8e47868c3eb4c677458f791055b6cef68d000f5e2835725ea3bf1

SHA512
9e3b65662daddb6d1eaaf5ba6b49fbe7521db5d342a573df5ddd6bff643254e93662dd2c9760b18e5ec0321a5b5a99c0baad55c5d6d03763944d64598b252f6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35989edff8ec6b0fb1a2252725e33515

SHA1
a676f6c82df3c3dd2727e139356f38b497171245

SHA256
3cca28cc9f4b05fb0f8e1ca4060db3d36b8db2a9af03c351857837c5498dfe79

SHA512
4b04675818bd47a211e80186c017ac795a246ebe1af3efb89164610dbc26b392e4cc421a7f97e7d2d4d38231abc040dbd1128a214cbcca0f318b0883915cfc50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2dd2da53cb7fa3e1ca93c24a6ce09d8

SHA1
fdc6d2ea36ae0e9eefd97d062bdfa75ce6f505e4

SHA256
59c057fe2a5de4d50ba93c42cd8bac2455e4b4a85519acee8285c2c21aa9e1f7

SHA512
2b6cb59ab9579bf6e62c2e4daee0b96512a4fca1bdbdb84397f9a0eec5893b1fbb10ac23e30ecd533a3db7650e180d75c23c60bc3257c1dab4ea302422e52510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b1ac4316795f6599b2d0798b5ddc7fbc

SHA1
76c1ab7a1661fbf2b26007321d6d9ac7fed95482

SHA256
206b510a828a3dd68c8481b0a82b0915f2edb7e5f4e49c70765f8a86e9e0c047

SHA512
4c77fc76e16fe338f17b6bc582cadbdc8f4f9a72efbfbdb482b20306db57dc0b1073d48827c855ab814f6154f317aa7feaba8c6cf3967c496e6cccbff721f4ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02adc7780ee46f4947ae2e561db31e85

SHA1
a42f6daf117a49746a87e7b8ea0b7bb5e87f7051

SHA256
c246f16939079bea01f9675a2d8dc5aa9ae9e3ee52ead475f37cdd7bf356ff16

SHA512
e4788b7d1ecc5490627813af40615344954a5f6927ec56d1f96bffb22c050ae14299390c5c471306dd098998c43a251ceddfbaf93865b5db48d4d4a81583ae55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0f2986a6f898da526878bfdfef5a421

SHA1
7df30b49d8722e18e82aa99c9078c616f043db45

SHA256
bb898582b3f18f25642eea0dae118fef499c19285b5680605b79123a8be65cde

SHA512
e9c2fba7ffe7efbc6e212a5b4d4b75a6a74d3e92b0587581cb3fb4a4c751c6809b944d81232b136635b60fbf077b900a80b142e7513781bcd50d34a9f9d02b2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e7a9101bcb5b93be3f768f3f8cabc70

SHA1
dfe4f32f83355e7451f2358a7f767507e16082e6

SHA256
44cdfff85cf1cffaa1898bff55bfc58b0b0d734440e0b9f363e45cbf5ebfa109

SHA512
06aa708fc5215df26ebbb0c26070ea6d4c11c456f6788fb11c058a8d1e88ba093c592a80ee1df58ac84d044afdfcf3198fde5423f728a92d1b48a33bc46c844b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0df0cd72577fc843fbcbc75849cd71ad

SHA1
c955a09c8357183bf835adefce962cd7a4938a60

SHA256
b5d88b9a0c55d022abbd36a99c11694f55875a8aba1ed2e7e418278ac5a765f3

SHA512
6dcf299132e7fea116772c9273d5d7024fc6727f2886452c5b7ba64c8eb1242f62a83efb981eb7127d1aac192dfcd6b30d32a8b2c0e0286a416c33ad41946b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88ba4eade58358dfc9aa1a851ac9985e

SHA1
9589e0aa56b7c5d6d3b52b79501db867731a7d8e

SHA256
1c7c15dcee55ff09110018ffb5d8802e06466097a3af4db18da5710b794b4e2a

SHA512
ec275adde5d845b6c67196c510cf3c55ac57f16313a41add71c5d7658eace55edf4e1dfc00ee4c0ee87a40ef74e35756c340136997247d0d58024d4b8711c2fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
596f2f8d709568d34cec8ef38af1b35a

SHA1
a3beac664429b5f9196d41116e387705510da0db

SHA256
b40dcb463389a224ad89dd6d59c0e1e16c867019c7d3c2eb6a1e7b710db65df1

SHA512
5178177036a847d6ec6c99f8e6613a1dcd1a7b9d4ccc440050060e8bb1c5e1b5f48b479e8c0bfebdda104febeeebdc571c1defbd2784dc59077a2ae7d5087e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbf005c76a5fa46af26632f60a109e70

SHA1
670dd2ef829acad31896c6cbeb3f04ffe0f66502

SHA256
4ee0f8b223b0355028ef9c4a097002bbf4ccb4afd5ceef56afbbf7b26da6824b

SHA512
58a0dd69f7c7e73b5be525101170eb4149dffe02102018a1ec88169f31ff69267a586e05bbbe3d9a4c00688e75b68163b4007fe3dfc78c4bd2d148ecda64322d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20bbdfbed67173f745a5754757142226

SHA1
dcc96f344c7c360d83c34d6d1e92bae52a072198

SHA256
33b43ea7c6381dd95586aaab4be61d421709ce701252607f961544a6695f5267

SHA512
b4002a1f8304e577e607af741bb01babecfea6b176c439c336268e53ff0de0b9d31f32f6e937b681aac177dcfd48aa27d49290a0e05b2e8b8a92ce21ccf3c86e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c0b44d23fcc4c6ed3518ed1caedf9f8

SHA1
d228a8f9ccb5b1bcd99f4657fe90156dd2acaaf2

SHA256
17147eea13a24d832e625d4c9bb19aa29b4779acad1ce7bb0563c97d810c5d81

SHA512
bc4b1ec6a181f27d635f57dc1e2e7a294418cdce375a592dcaad4ce0a4008d857e5cf23e9f94636b9441574b495cb78b757dc3b7282aa44deacea574043a1f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
760342d89ec30aa61918586d8d8795bc

SHA1
ad9b36db7fee477480a42aba4c0cf098e05458a0

SHA256
0efff327510d2de5e67eb6ecf360d3b5fcd9abf3ac1c5665f4311a2b7269e194

SHA512
e87207377ea01018e83b74a59924fe402573d525ff2475d0db504fb545d71ad97205a81c6d79a77c0d858de46044ddedf3df369d099cda3258b2b246f2691316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a16b025dfcf13404ff772eb2a38515d

SHA1
5c2298419f5879fd657d2bf24ef67836b9afa4bb

SHA256
a627ac40cdf13ddaffa3457c889b991e8a828441eef789f7d6773c236c73e2fd

SHA512
bd898df0307bd16146e28be55467a223cb50cba2c0bf982ec8e726f69d3ceb390ca6d175d8a7e0cc4004ac9a251331d29c07f8c1430f5b15c9c9f9ca2d34fc12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E04.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F14.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit