hxxps://details[.]bio/hai1723-cheat

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://details.bio/hai1723-cheat

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000065b79e0419301daaf08653b160018f0b80f0d69eb94b3bee3c4630e8f5bf6a94000000000e8000000002000020000000133d022c39723a604e9566fd6108b0a510561dc66b790eeca442ed32a9d524dd90000000d5fbf27c6dccaa1ef463c70fa2fa0b244de751222ad7f7721e9fb797c3aac36b6f6f6b83051c1eaf4616712c0d37d0441f4f16261da069a696c666277b5d3381d7988b410d5f2f5f261af55cf223f29e3923c4e62bfeae9fab5e5962f21349138ac81bcc3462c942f46792049eded87671dcdabea70184aabee30f70414e69a14d905df5a8fc0daf1983b4b0d7990b5c400000005c1b8f8aaa2a2be577b37218ad2503ff84b5e9efcf1c5bd477eb0f08213087d39a71ca226a110f964c92c4d15058190e0cc69e564672b6af8affd9eadbc48769	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00e888956a8da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0F3AB71-1449-11EF-9C59-EAAAC4CFEF2E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000511bf850adb40d0c0980ed81e293fb9f9068f842d0df8e335ca3778af325ee87000000000e8000000002000020000000bd101a5c9f0f9f802f85102fb01e70515fb47f27a3db28e35a89a7890745d87b20000000a3a76cdcf8411640fd857c092b60c76aa159e64b1da562b1817ff4c803bfccf3400000002456e75a79fa1add5b7f881d506fe2d9bdacc1dfc3e16ac75a361c80b7362b330d0426d20d7366d2e74b76635d15555f1d5afbe8720db041ec2c05952709ee1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422111105"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE
1096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1096	2248	iexplore.exe	28
PID 2248 wrote to memory of 1096	2248	iexplore.exe	28
PID 2248 wrote to memory of 1096	2248	iexplore.exe	28
PID 2248 wrote to memory of 1096	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://details.bio/hai1723-cheat
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9923a674067d08b358685f27a6d799e0

SHA1
2ccfb9f80acc40fe1a6f6dd485b15426710ed328

SHA256
664e026f6e6401f622f0981707f1635c4b257500b7c88d162acc9572434148d3

SHA512
47b8bd4a8e8c62e2539baddf9d40f2f62f16187fecdc0014d642d47177c5ce1ca4562cff91b003e06455c190d4d91a4a19dd68111824a6ed8531f4ce5de0e3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0832a858bb4c712a7913f07a9f179045

SHA1
83086a517d6c4c7ddd40c2d204c612e804324923

SHA256
5e0a80aed17338f8f9ce20d74993a195c617ab163abee402e4fb0d17e9e1ede2

SHA512
da824a357e990982ce6e5db9fefe6173b5ba675cafe86aace92172a15f6918739c1f031b505932aae27d619f87df9c55a17a560511c11818cd0c202ef69b24d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d330d62e69f7f70335fc3b5aa151552a

SHA1
f76fa01ab39734e452a7ce599dbe99f6ced2a0fe

SHA256
cd045efde5f2ff9a5ee982f35957be03cbb94ddee4693374d91e09b744c6c8c8

SHA512
bbf36d32ffeef4365d60ee23b224fe68ba57da1b860cc39023a6495a1b6fb0e676b7528b89608f86327b9213f02adac524a867e3ee49ee19fa440e78bf53c5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fbd09ddae63e0daf5225dc942ca1fc8

SHA1
317f5ba74426a9fc24ce02a836fa202eef28e539

SHA256
da5a433c8db79d51b6d0172f9a2b9bfd11316e403d42a03cc223fefff595b935

SHA512
843d2c45cdc65ab09bd646b0937225884f7ec80c664c98ecfdb766a245b2d318e0797b851f8124519dc656799a109b6b7e3680d2131669964b8c4bb106b6078a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa0fddfe1f844cbb90ab028b50a51371

SHA1
1cfd6494093efeaa08a771f7ec47631a3ec55de2

SHA256
58bb185694c4a3ee749cfc051a04226d5e73ddae3f135900ebdeb242454f3a61

SHA512
f50a7d67135795c6a3eaf43e897d8ea05105adcd2ef65eba9121cdd99f747ffc2011c0bec6861fc5c66bc9687b75841829313a033f4fa1bed78eaafdefd07514

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74f357e61c84058ed10c7a534afeb4d4

SHA1
85558bdbf15e80508524e6ec5d4c375fa1b4474a

SHA256
62314a0f40a3f4b1eab978cf14ce15eaeffadb4c3cb79c50d6b09d3f3b6d664f

SHA512
b4437a10f91efcbf9dc70b0b355153b42316f645adc59cfe99c9a1ad0a4d61f800cdd076b2b1ddac1aaa1724f5e7237a313d193dd72217ad0b9f65727961c9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f13124ca6138c58469df3a283a71c9

SHA1
4b7805deec84cfc68c269bed6fcc882dd6afffde

SHA256
46eb4bf542b1864bed031c4c64eb3d3a73b0b8733f2a017798697b4028b8362b

SHA512
6d122e1333a55d4c07adb3085485eb1b8d0ca50668af3f5f4ee36765f74c66e4347f286734928a317f16a46f97c0c556e5beae1ff50f9dbbc6bc9da52b91bf4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
30ba162ddf464a6ed026732fd70050b1

SHA1
35a71174c3e464f1acff50a32f8a39a8adf23a9d

SHA256
77541e4b6312c72855f59d91c57bf852a503204a3aa2dd2103cd53a23013796a

SHA512
14615d4c34232de77f20bf738c976537f45d3f2cf0a73dcff0af0639e52d797c60e3ceceed6d81a37d4ac9b52b0e76843bdd30c455014d902ede95c829d3856f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a8691d335e9bab7b61f79623e76de91

SHA1
5020e2f92ba00990a2241de5554597d29854fecd

SHA256
97f2cf24834c80a25faff239b29cb0a7d6622bffa47cba82f1fcf9cff759a936

SHA512
3c407e6717e8319157e8f09858940890beb500ddc9877138b7ee21fcc2b194910a8f91d16e24edba533113316e5b11d04c41523228193517dc25b3b2ad940a7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8220356375bf2e034a91f33653a229a6

SHA1
7e0ceaa05fab7938105970554c4a523bcfc48fdf

SHA256
749303e9b271aa8f33c57376a056194fa8a7a25ea3bda91006b1f6dbeac350f5

SHA512
fb3a99b8aa69b64ff079d24cea11d22b93d0ee355d2d18ef3b65f7360c8e62f8de12357251522d2d6923b8fa14105dcc1bda2398372db44fa24e7712e3e317f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b6e1ca52b072a78c75c3626204b51d9

SHA1
f1f77b7784568f2c3dbd7975a5b5134001019413

SHA256
4e81ea6f9cfb3c799f4f5def61ea5591afb9ad1a00ade0c8b3d0c4542f06ff01

SHA512
f1427f703b260c5879dfc2c7b006336f4313e40a8e9589a3990818cdd9f52d8c7be6db65f856602e669d421c8f43840f16c96a14ed173a0242de5bb455cc268e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
51ffcba3098ea0a1d1d7b6c19f16bef0

SHA1
468cda6d71e8bba36fb7c6183f0ab0cc2933c5ae

SHA256
a1b7df6c660cc36e6aff4cfe7295f2d3fca44e8164065dfc68f4ef0e01de55d7

SHA512
9ccf69f479f64b9f1a3cc75df5710c1852cb3fe7400c89d65e649cf72af048ae99caafb5af7847fdcd6310272ee486d67ea67f921a317ff4e42ddadcecc86804

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\zYXgKVElMYYaJe8bpLHnCwDKhdHeEw[1].woff

Filesize
23KB

MD5
c0caf3a69092fc5c08443b413ea38896

SHA1
86514d16db2e5697d548175bcfe3b54983b24132

SHA256
1df9c953053965fc56c34399bc55ac59f6ab462e6027ce3cb0643d8028319ab3

SHA512
7a7fb7c6e7bf47352a3663c49038b8b0a5bfbf777cd6a15cd19aa8cc6ece33d939bae3dd7dbea2bb2787905ce1165f632f9027e4dd271870b5e3b61ddae4a34c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U8A9A2DI\css[1].css

Filesize
197B

MD5
7b58c88a2916253b9b546d153b6cdcb8

SHA1
1d90cc3526b42bac12087df6f8f6236e844321c2

SHA256
beba2d046497824b8eef5ea55775da133a76e652a69fa3ad81311c151e5e6c96

SHA512
d3cfa2cc6e00c7449c2ca53ff153e876c433050b8e0e9ef10909fa4d5d1e37bd686fdcac572be411edd93457774856f60dec1af56536f56b779e1cd58f188425

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC727.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8EE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA7A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit