a4c5f72184b8bb06b6202074d1c81469ea56f74dace70d09fb5c798f85d8b700

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.8MB
MD5

2675b30d524b6c79b6cee41af86fc619
SHA1

407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256

6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512

3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP

24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424355576"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000067c8f4c382dec9200ed4cc85f5a4117c38b86a974ae7bfecca5f8473fc45d7f1000000000e80000000020000200000008c3aeed4d287fcd78e9dcce53fbc6745f9c53643272821f6d0874320704000419000000040a07ab3b9a4c6587fae5b565dead8badd2d472b9e7107505a448586413f4a8e47bade2f595fe941081ecc84e69136c70f655a9112b30726618f744307726b14170fb027f9b5b7a3ef81cf2e57dca51c3677f1130b51cd57149f8f4a194b027232c1f2abdd4b4063c57feec2ff89bede4561880bc2316c5a8e47cc81143e5c069963ff4effc6df9e2c3a5718c6e2a39840000000648eaec0b378934d907a732de25edf486f540a0d49b290b8e950cc68943fef74976ed1ed5b1162043cd1674e846ebe559a8592af07d5e6721c7d0ba0da388127	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000054d389699a8cf897c82aeb8f2f617bb1b5fb8399c6a5a78dd71d2c35e33d428c000000000e8000000002000020000000b40790d2071c0fe72c0eef858cc7c05df931f02ddbcbcc003450a32ab571253620000000ead927db4704eb731a6351ef75f586b5ee0d50048b94f220733b672b244a804840000000fbf8578972063fc86688de08786130211197a70d74d8365ad83dc77b182c663be10586f7f15a49c47205867982913a080658edf529dbeb47ba3f36ab76c58832	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0754d61c0bcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C62A211-28B3-11EF-9302-CE03E2754020} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE
2196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2196	2468	iexplore.exe	28
PID 2468 wrote to memory of 2196	2468	iexplore.exe	28
PID 2468 wrote to memory of 2196	2468	iexplore.exe	28
PID 2468 wrote to memory of 2196	2468	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd224227de55cf7ff6deca3ca180b84e

SHA1
1d0e172505b9c71bf84b832be5259fc54c909f99

SHA256
0be196e3c50323f792ad4c05122f9d936e48767a87bd69186f03df9aa4f8ae68

SHA512
a5f432c93aca2012a9d4f2f0b6cf273eb92a5141299c883847680353c4d304c98ca7695e08276ff942e35ea1d1af48bc46f9961c5879a3d24183293d537137fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fe56404e7c73584da530c4a174ddeb0

SHA1
1108e5aebfdbea74bdbfd781bc81653a56710974

SHA256
88cff39142a2c4980e3301e6da637361dec3b4b9f77d7323b564a0d8e969e621

SHA512
0b45a7ff2e8b233634fbdf5ad4fa06e6af32b9dc639a9e80f86c90f700e7686333253fc9fc28775bafe50bac12c8600c212131753788fcfa4cf41e8571deee43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2e38b108461c01d1d8ac5b7ef7bd035

SHA1
88e645d6c7637c87e9fa4c841d82bb7c7845f97c

SHA256
2eb17c9c5ba87a98cef41a94bf9a5291bacc3736cce363e2763bf45072c8edcb

SHA512
bdae7293a1198cb1dc39d8706456dab33ce48ba1209dc69f60aa188c4708a19c0814c07bd934924bec7626324219aee486336f1ef2a8751a4d496dcde1e3b866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
049eb9893185c104e40f3ab58052cc39

SHA1
d041d05a4aa9809f99f8f34f3392e7af2c72f6c2

SHA256
e87962a8b03d398d817169482f376185f796ae8f040d2d540e7cc5ac162e5d4d

SHA512
fdf83d8d88f0e6921bb95267f6a99987bf2def92d0aad8a6f149ffddee95c109b8e07b2a3054c7504b4de4a448274d63e235fdeaa8b1661401abf27940e008e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9bbb58846d7f10dc1b476c182ff6039

SHA1
0836d08a51716c1cd7f69fb2d5b68931cdb82eff

SHA256
8d0bb2c05e005abb368168c3e2155d8ae94d42838e9f002707c36b2df1751e40

SHA512
436214851cf344bd1527e12ec20d19f7dd68ff3f62ccc5c076e1353bcf99d86f9f58b0fc0d2ad6f779ed0c5cdb1be0561d9424ee8ec7f0152c7905e2bf80c611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c4fe063dace3c447eacb3b199e307b

SHA1
a60327d46a222db81e236864faa90e6818e861f0

SHA256
4d71773f4fd19ae3bfb106f7fbfa8075d7d4ce64324ab49b4397aa14dbba8db7

SHA512
5089d4e2ef6925327f75a45e040d3c624bb2f706c8b8d08b06ec414de80d512317140a411306f424bb06156c07349e9db6d2540afde4192aabbb11b8a497a8d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d1823bc41717af83c6cb55b92d56a6c

SHA1
d0654b8851db55b3b0484e0bc177bcdcaafe4381

SHA256
33ad76ccc75ccd9e5bf9ed31b2b7db3fac4180ba58eda1c865a04db5c6221542

SHA512
9482a427cd43fff297bacaf9b32290a861c48cae24ecc47950391c48ea50e96a627de0441ac5ca52e7607c981ebb5064ab74494c90267789b0dcdad9dd76829b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ae1329a1ff9a4c12ad1e7a35ca6e188

SHA1
ac74b98c3f16b026d2530d49ae675ec24c02cab4

SHA256
ee89583dab7301ac9d8cacb9508630773a33ef011a1f70e4f733c8f53203c2d8

SHA512
9e8133ab0c75710a7dbd56bc1db3547381aa421afa13c92c34a30dd318e21d12e8162ea92ad654c4a80ec46020bd33a4e34b689f6306def1b7bca3847ee45c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58ec6d47606783091026a8164c5b1b4

SHA1
a5f83bdd8b77535cb994a87e9858ffeb239009d8

SHA256
7457a6dc5f7c1ed8ed97d926dace1a8ead5ad7bd0bb0b3f04350ad1d0234dbf2

SHA512
0d86671ec04b0fd5fa50ce55b98eb6489064707d59341db0bd3a7ef7b778bdd1140c52f77c7bdc16443e7e1243a62f40f1cdc86386beef181dc870aee24c6999

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab1e93b381367f0c81aa5f6e0a7a149

SHA1
50eca3ed660d749d39a472a67306e68895401ddf

SHA256
1a51a6b8d0217b5ae6e56d885ec3fd0ae2391512bb24b71e151d7de2223c4c11

SHA512
0df497e19f881849961d103165b66307a31f04c73113cf272df791fa0500b6fb2dc8c87201d0ff008b653c30db3760576559ae244fc90cd4f1b45ff5c264dc33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399550ed2b838c140ed8269a559c2662

SHA1
7e879f5f317729eebba479ddd8e30fe27b9baf6b

SHA256
30ddf80c1567620c76e9fe50ce9a931433ed03c34226195a239465e8eda112be

SHA512
798e44f289cf2696133a05d487517fa2676d48c2008382e20c539c15171a10200f5f28efb1d78605f63670efe3534c7375f4b0b3bab881248f048df6f2ced584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51a5a43b5c1413e331d7e6159d594e8c

SHA1
d24113c883655d88fcc8f88844987ebb1ff69882

SHA256
bc1fe93c5e18cb25c085bc6599e840f9ea7e30a5e34d555a06808081f556dcff

SHA512
2f00c98a5cfe937f03b4354e230b5381681206e0a47fd59e9fcfa303de35e21ec5bb04f9b0ba5548ab7e06b8a6f7721d2f75e8c4af733be1470894de2c0cc52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9447e11dce7e1686bb3c623ff9b484c

SHA1
e838246fcdb810bc01f2f2e6f9ee6e35e4ec0557

SHA256
46316957d09bbab0d17a13cfa24f2715f12c1369243f10655e85fa98cba38225

SHA512
e22d4a6f835095ca5d69df92312815634ca48d20d886aca348ee1938d90caa6a6750235f20389466336a681817bb713fef2f12f1fbef750b3c296931647f5609

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar488B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit