88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b

Resubmissions

29/06/2024, 22:21

240629-19544s1epm 7

29/06/2024, 22:13

240629-145amaxfjc 7

Analysis

max time kernel
140s
max time network
151s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.8MB
MD5

2675b30d524b6c79b6cee41af86fc619
SHA1

407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256

6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512

3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP

24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a80760000000002000000000010660000000100002000000006d319145603dfbf40f987ae746fb32e95ca13f1684c249867719ab91442035e000000000e8000000002000020000000405305769faaa71d376de91d6c1faeaa504f6c61b51e0ec24ff16c82d86d79b32000000055926925e79fde122eb8d336cd4aba500ee00026bdaaffded08b64e7ac1bc319400000007a209ed9de4176f408447c40e85a1326140180618fe9fe2578832a370fc53b947010aa24faaec2f3068522497e52da6c9c2f956e01b9d83e6394034a288f4ae6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425861262"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000c5867c5d82b9ac7c0016e11060cd78ca6fdf271426e371ef98a651ad9ec9fadf000000000e8000000002000020000000ff582a5fc3ef6e358491f756a75ccf1d935cadc923aec52aa4ebb25562117c20900000003ec095d82f2a8f71421869994d38764556d219a354306eeba42c3cb353064ea0ec72a591d71630dbcf4ce7c206f08dbf4c154e1f89b2decde0d7d828f26dd2818c5d8970f2b5505fdd7e553e018bf0789af727e0d10dc754fc58996c2af5563bb79767182127a98cbf8f278f509361dfae6972f60bacac3fd5103420eaab2af07431f5782291a474f4c70d91fb6ae2c2400000001e3a45cb4a0a64c9a344e85f274fb5dcd441e9a553c9fd6640e4e5ecb334528072792c8d609d10edd56625a850978073ace8f05014ecc0d13a51ba05c646b37a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504a061472cada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D5DB961-3665-11EF-B98D-FE0070C7CB2B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1672	iexplore.exe
1672	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28
PID 1672 wrote to memory of 2996	1672	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77e116505a8b815aa6ffe7a9097729e9

SHA1
e0c2d9c28623620edd1328df9f3ec86a08fb80eb

SHA256
161b50972c629b752d01131b8da083650c02f70c739977001cd0659f0361dd55

SHA512
b5ef135f2d3c9d307df3b7406f50900148cc6641b754b70046c5aa8a48d202d0071c3c639f3087eec45d8406abe1f02143f3590685bc86d7bbb0074bc461b97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a0362ef3941cd3975765f05c3f91759

SHA1
d3dae7d3f59c655faa0cad2b8c7f8ac08ed14d68

SHA256
e1ffcc329e74ce68c5be727b8858eefbe68aa85fa710a91925079155d078c4b8

SHA512
7cc73bb8fce3fd4abaeb3b0ec542fee70f1afa068007c3c1b187d163ba509875ac7878a4b91be0cd3f7d73a8e86464ce00de58ca6c22d4874b9954e3ad3c97a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f3478834696dfcd0fdf4cea50481140

SHA1
07c5edb4f1f71ac937c792194b05a2295a397c16

SHA256
4a3ae3c25be1599b1912938c9b214e04495fa6358f86bc0340773c5f27205c97

SHA512
ad0869786440d0168030b2e8d6171864e103abe796d3706f2d7706c03f434d7f41bc137fb8de9ba39deb55e14bc608360e25155a302dc16a98d37d21add006ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a4fb56c092c4bb33e7c8675390951b2

SHA1
dc00404f8461d9684e229bbfd2388e0d83bc6fff

SHA256
2c3ecac92a4a46304a6106f73d97f5e1d418be73d3f6aa781af003a55a1b9b6f

SHA512
f76a1c5019e1d654b6d8b222445e48d68b6e00e4b57a88fcb0c2f91fc29b964a7c00df80fda660adfca234e9f8791e51043f75abd7dead7dfcbacac05660e4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74124683a3c9927b0d9731cc750890a7

SHA1
d1253f620bb8819093babc10f240551a27270d3f

SHA256
c263b9508cdb319d36b8a8c7a11c644fa6eb1e26ba309ed19538d7840170d5ae

SHA512
485d43276543e40b1d4355c8f7cf908e91385b191e66351587483ef002f09eb35d77a2f48fac2f20024cbb9871cac3d2b8f571276eb017509d60be5e284777e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1020e2e4ef74559fff8649bc3bad5eca

SHA1
401db15670deef95911fcefd6b9bc00874bc76ba

SHA256
33b053702a7198ce0e5fb601eff22c14a4fed36a52e828474644adead26bfd15

SHA512
1503a8bb9d315272d22b4106c0232954db6eab5236db05a67e7a9dd79081ade3ecfe8961fab55d18ad18767ec73ae7597145689e0837f61d8b29896a765fae1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af76355844cf1d6755f98c6295157021

SHA1
73a6035362735b4725a304342811ca41310bf7bd

SHA256
f69b0d0f5566fed48f8d73844f3476e1434c7a348df4ef580e64a2518e139f89

SHA512
d3fc2d78473748a4d55dfeb692db06ac0d3765708579150100b15ce60bb3b48b8d0327957903826dca24e837d9cc7a4f603759403b77245f899a39ae2c2d9901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bc9d61aa749fca3b36061efd462d75c

SHA1
2b41733a19f4c7fe966831297b4777f5513e0b4f

SHA256
c646a0e79a8b2f28beae53993527c3697675678ef88fadfa13eba563506b4c50

SHA512
766bbe5b4bfb315c6baf55cf9c9b392e762b25767416444a780f421bbc593e44e9ad4366aeb2ff4b22dc92e1cf1a3e31f13b3ab183fcc8f041bb2cbde88c1e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7f5053247188ab8cfa0f04221189d1

SHA1
df905e4be8760cf3670fa22eda996e2007316ab3

SHA256
0958a284cd78483c630519eb8eec043ba621a7a679ba31c1db4dabf1b424fd41

SHA512
e90f75338edf32ee985f3ad6921f4ae6c4e46a2a16d3795fd641731195495c75dce205bd99dc108e39cbfc93fc92ae918e66fdccab496e396d58340b3b7b05fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBD3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC63.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit