e17f651dbe0f97554adfacbc2ccc5797ebd41d61e3174b7ab825d8d37a114397

Analysis

max time kernel
49s
max time network
34s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tool/Avatar Tools/Avatar PSN Tools.exe
Size

139KB
MD5

18183e2be4fa30cf4f818c7969e4ee57
SHA1

165306852c3c78177eab02b42bed228e8aa0e2d5
SHA256

3b1076a41323f422a14c4496c370678d3f083d9d731ad9aae6c4676a3f32cb6e
SHA512

c419c0f9c38d78b21d66b65237107cdb791132f060195e60c496e2b0bbb33d1697b4c79e8ae0c5166daaf8020e8ab4d1f995a92a9515bbe0d4e81d06f280cb67
SSDEEP

3072:cIzgaYv9HoBifPBPk0AH1a0yIdi3IQox:cEBqjXs6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206f821bf5b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004325a0491e43d540bbf08896f42ad39200000000020000000000106600000001000020000000f5c612f293df2490241a7a9a581c822f17c2266af101f44432ef3f933e1c14db000000000e8000000002000020000000f1469d2179c43d82b23859d48c11d1111650bb11d3524e955219b48193cade91900000000908aca8d971bc30088d9dc1d8b32f6a7b58849aef5fcc6409adf483f9e751bbb2f9407492c99f5bf81744ccd365ae0aa7e299ca537c1ccd867bc4d3983dd097504c5039efb0ca7dbde1a8dfc998c58019313aaaa30c02a3d0ea5ca7339cec1c678dc3764fd6213007e40cc727ed5340a199ac9c1adc75ec92ad713e92b072141774ded983ab98ceb7f1a3fb5566c26540000000afe0e6498158f624336879ff7118de3769723cbeffc6084ab4cd29eee6bd281ad248a5abbbc8da4b35ed3c2d681768f092dc54f0d3408a435293ab433be36b4d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004325a0491e43d540bbf08896f42ad3920000000002000000000010660000000100002000000035ec82588a334833092fc5b69829bbecb2e12ad1e19c5257ef98f7a9da87c93a000000000e80000000020000200000004f4014303182f38486d41ad4e3ac462362f723098ab69d74700e56058be54a1020000000c559d67f3f4124f2b93eceefb0607ac771d2b2ea70230f74a37a0f555aed4aea40000000e05e0282395d6af71b67c1d83fdef70807fb4ed3c7073e7ee5457a5fa7de62d55d9c77d77a7586a476f502aa34025980c130d096c6bc785e382e9ba6c63e7f17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{403EF181-1CE8-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3028 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3028 iexplore.exe
3028 iexplore.exe
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE
2572 IEXPLORE.EXE

pid	process
3028	iexplore.exe

pid	process
3028	iexplore.exe
3028	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Avatar PSN Tools.exeiexplore.exe

description	pid	process	target process
PID 2872 wrote to memory of 3028	2872	Avatar PSN Tools.exe	iexplore.exe
PID 2872 wrote to memory of 3028	2872	Avatar PSN Tools.exe	iexplore.exe
PID 2872 wrote to memory of 3028	2872	Avatar PSN Tools.exe	iexplore.exe
PID 3028 wrote to memory of 2572	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2572	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2572	3028	iexplore.exe	IEXPLORE.EXE
PID 3028 wrote to memory of 2572	3028	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.exe
"C:\Users\Admin\AppData\Local\Temp\Tool\Avatar Tools\Avatar PSN Tools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=5.0.5&gui=true
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0fcaa84a21c211fb96496ea790cf0e1b

SHA1
3c43673657353449d94d462170cde60763b74d8e

SHA256
962a2460711e11b312f5489db68ce8348121631dd8e96d1d633dc8a708324efb

SHA512
48499491a6105413cedce85e70da3e598c5200a6302e7e543c0a37335e4fde519053338bc27b30bf3058d2973f4307756f34614696a80fc8540aa9b5c707b83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86dcdbc90e2e5d450f2324f3884ad35c

SHA1
cd93a88c7d8da37187f4cf43eaae0b7ecec1e631

SHA256
29cc319ec18bf34497ec0f084ef2b22aeaf27ed2b537496b13446aaa01f53148

SHA512
e95ef1f1f4f58844ca3927a8d825886cfcc275e7d368b33b302e3927205375b5951112952c3c032931b4c9c92195abaae8d27f2d285fc30e2f455b57f7b0ac18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
818370241914e88fdaab7ff28fc6269c

SHA1
545a44595b4c9b9dd4522f962fba31eec9f9d7c7

SHA256
411130b0fdd6b0237f3e19e877903a17c1366b8d5b0930c9a3f26200609a0c64

SHA512
4a1f81affe118edcdae4fb004aa46f2f9ea8310faef858f76aabc927cbe2b773310ccb53c3c56946e36a8efe8e1bd5a1d6c3dd938404818131ee62d2ec44f02c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
655962c0f18ec26107e4d0df0b600947

SHA1
8e8b96e20303593ed1b64c56211a73f631feb70d

SHA256
4e555d4874619cd0512fa888bcf3f44249e65d384ba1a43d637125431091225d

SHA512
400e9c0de84bed5b42146aef5b11c50c0cfb3117e585aaf6f22e15939b94f8e9b393c5a098834798a347a82a679aaad74004910587fbea32e0ce2b883fe52c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37afbbf626421e66d609b98145e7bfad

SHA1
fc454d8d3b3b8e9142d25bc93b23290dbae7e291

SHA256
b42659f59674999f297f92d54ebb0d3edce04fd80ca8526d7323b58a42ca6b3a

SHA512
883569e7aab227592046aaf8d1d4fa1e725b274114c5fe01cb1ad0384f834d6b28ea4507271374a2391fe6d525a3e4b955ebd017017b6887cb6b36adcd5f7c93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79a894b6f9d57eb6cfacc3c78f51a69d

SHA1
0b6626cd0eeb130ec54100a5ce556c04330f2bff

SHA256
0fe60bf190e2cbc84cc3a95cc23143c9594f2965344c59248996a772f7876d75

SHA512
5210779a44258b3a6b349437148e10cb253113c4eb874148a412cc04a418607015e2bf82e228467b61edc60ee7f9ffc97161fe974be9232cffb1568e1183887f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f059f2f6c130797d4cbb625ec437b80

SHA1
eca2eb168d82a2b193379ec3d60f7502d382d47b

SHA256
38d57c04bdcb495162ecd81645687ad224a6694e3c4b65d2566bac99befb05cf

SHA512
7862bc440b626112ad14e8c81f73e43ae3b66ad5b3fef0bc4821092539507f4a1f80883f44caa08cd173ebe1835875518b008ef0e1c09497728c4ab2be956602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e3a0874d45e5c5fe77db1d36ed96f0d

SHA1
1b60d39b3a1278c00825c5567d08465b51225ce8

SHA256
0ab94964a33b12b58822ab54681df41d4b9ee48dcfe8d2061609ed93546bcaab

SHA512
dd37baa2f3ddcbdf3c0a7d38b79ea3431f2071d12106581b6e88976e64db1273913535de7bfb93eb25d2ba6b6b254bc23403172543717672202975310de5399d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
abd6a82c7b7f8ac28d629afaae99b511

SHA1
337779f4da7a5972677407ddd96e4ff6822da3fd

SHA256
ccb218f54cd869aaaacdc0c2caaac7dee7f1983da7263766f8f131963832eee1

SHA512
b21dc374ae4e7de28c5462e09c8a801d584c6383a856ef95adb220a482d4f637507f76daa396a3c588de0c91737ee01b9fe71195033d5b5034ee9c81fa37f88b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA1C.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC00E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit