3374d19f61bf83de14f2799b867fc4ee1a262bde023c34f761e1f379c29eb2ed

Analysis

max time kernel
38s
max time network
19s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

312446edf757f7e92aad311f625cef2a
SHA1

91102d30d5abcfa7b6ec732e3682fb9c77279ba3
SHA256

c2656201ac86438d062673771e33e44d6d5e97670c3160e0de1cb0bd5fbbae9b
SHA512

dce01f2448a49a0e6f08bbde6570f76a87dcc81179bb51d5e2642ad033ee81ae3996800363826a65485ab79085572bbace51409ae7102ed1a12df65018676333
SSDEEP

24576:dbTy6TU675kfWScRQfJw91SmfJB6i6e6R626X8HHdE/pG6:tygpj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000047ff02314b8a51c6551d9c968914bad5853e3822ed42de1bc0a6678cc78b6f33000000000e8000000002000020000000cae64bc876314ac4dfe139ba89736f5a579f2c7732dc3b5274cd68aa1a06c85e20000000d8905529a9427c6bca03e22d47387d538432061809b658653795816560c6890240000000f2f024ab035796b106e9a08a8544309aa9d8f894642d592b2459151a5c1d15137493f1393dcf7ccd83a8b93b624e0390681ef964a31fcb92851d81d855c8a597	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000087e2d872382f6cb87c11681d13316880a3b85829aa35dfe8f579f0480a799a2a000000000e8000000002000020000000ba9631ddf76d8836a43198a2b956ac514be0a1563e4200c5a2319396d69f45f8900000004c59617c0ddd882bac0cfdd3e6d01522ded5549a22b3ff616bbee2a4b13572f1fc08450472940b985b16a7705a7abd0b14689ce43abde9c080f9a70564f08bbf316639c3ceadbac8732155dd3a8504127e576dbf4b5f18895d6e7a4688b965c0579ead5c320c02405ba25a9b996c5fb259e18be7dbed9bcc5cef34e2489a3705e57f28f30baf4c5c5f2a12de9c9265ad40000000f2a0e5fb6ea4587ed70013afe9651b3fac87929d68924b034ba7772ea635e9f05633c44f27144f8f0b8305c56e4310238085f4086de39a252f6975b018f386ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E9878F1-324B-11EF-BD6B-4E7248FDA7F2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f97b2358c6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2052	iexplore.exe
2052	iexplore.exe
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE
1284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1284	2052	iexplore.exe	28
PID 2052 wrote to memory of 1284	2052	iexplore.exe	28
PID 2052 wrote to memory of 1284	2052	iexplore.exe	28
PID 2052 wrote to memory of 1284	2052	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50b4829fa78222bc6bbdc96f397b5f99

SHA1
185304e62e8bae06a6d7b054a7916cb0bd911e18

SHA256
c6b719db322fc0bb1e8f3fa9cbf23ca79d1880b8adca8bbe97fdac9f78bc2fe8

SHA512
9090abbd66d54232eb50bd32b2230e982298d438f3e3fffe97d2cf0a1e3ca74c4ee8e1b1d93bc6cd53e6cdd668e54cede3ff64ce3e3ab4f17c5d8ef09a0f0ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17e3f3bab3f0fb29616b64d3940c89da

SHA1
56f0dbcda7698d0a3ece0e3626f37713ed1c98ab

SHA256
dd0a2e81f28ee2c2f3cff2d8c44b0bc1f0d6527ce915fd0929c36a2e5fef6775

SHA512
6ab905052c5bd6c11c101a90242910d52cfaae5f54b41d783cc1dd1412ffcd93fbb9e59c1b0f1af3d0ba5241a7614e4440a197793c106fa35ac8449ae209a1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3bed7242a9b9ebce1a995177b0fd44

SHA1
bdbf324a8acd6b505bda2d26c9fd512fcb9d9d98

SHA256
a5b53d921ec91d7275ff308ddab1a5a9b2a9165c0ec2002ad55ca5e7db72bf6a

SHA512
3d0bca56f95118af9f63ff632d20e94d892c50e188b0315025f827ba9a67afbd8cc7355e66c2866b5a30ef94a2e3903c20e64728404304645ed7e1993fcff8da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eb7c79b9125a11b8c9e137b898e6e2c

SHA1
212f2b184b75f7bd881f33cb5a06ceaa02e5c7a2

SHA256
15dae03ef3841a121ebb7ebf6aa0fbacddc1a2b0edca830c1c6c4a0df0c2efbf

SHA512
f3b17c6f875305d19a975ada12c35ed80145047116f773b67618a325f6461e96c3bc38b080ab16c8f03c4595b6b94d19221dc295166da18b1dc92cb9e0e78f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
977b02ea4b5f18e16ea9ec5f1e7b3cd7

SHA1
e904b259583812ef830b76a01b16009c0c0de2cd

SHA256
7ec65e85589485dc6a53108225b60e043781bcd1f74ba43089281f60630434e1

SHA512
715ab356ffef0ef7c967739c7337b855107aaf8e76194c237a2abeee81216e5341272d2c90ec312007f9f3963edfc0b02f8bfce8668c014d15be1ca427a9ac28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068cfea5f2fc1bbe85ba196e15dd2629

SHA1
1f8cca1ac2ea18688fad0dd13d70d70fdf741973

SHA256
5a1868df289d17598e4f7fd2b74e4cccfdac1c8bd57a98893b14382adf867227

SHA512
79f5f623f22adee09fcfce51e132e3595948789fff7e25c25f63b004c1a3dec174ba1f182fa42d821c4fc28192f9481741155feaa907bde45641b7687ea8af93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75344527568115bab1c5231b9fed3be9

SHA1
79fc9b1f438cbc4d6f44ec783dbe8a0d390ee01b

SHA256
f896dd0bd24132873b8e430fa579d0028e5d2bec2d864a0fbda7f09ccb20fba2

SHA512
1fa32c30b4fcf6085a6194b5733b44166cb9f8629737d2ca691431623711b0f859e750e510b915ade3a349d75fbbbaa5a70cdc5bdcf39047d43617a011b634a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14b70bcaa3915071c4ca72e9b5a29385

SHA1
a154c3903edf10059b254a5d5825006ca7a72603

SHA256
e956b511b521e8f382e990183f702ea7e70d73fd2996e68dd38fb8e6be320ed1

SHA512
f741767acd9f2abc4bc4ac3958250582570198ffef7e8efdf468842d5ca50d439064cdd4751004bdf982792ee8593299d7380e89cbfd006a51fb5fe30d36cabd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89ef747aec9c662ca387af334eb3b457

SHA1
9cccee03508c7914410daedd102e265021563c6e

SHA256
4e9e3d189c0f95ea4b6772d9163582296f29e2dbcdfbdfe90cc215731b0af084

SHA512
ea1ca14fc5e23261e6f2100658b06f58edf91b6f57ba47d0509b3ec068a50a23b21579951e7273430d22b1eeefbe327ba7989364131be8629a54943cdee920bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4ECF.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F72.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit