30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-07-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

bd0ced1bc275f592b03bafac4b301a93
SHA1

68776b7d9139588c71fbc51fe15243c9835acb67
SHA256

ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
SHA512

5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP

24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426890031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8920FD31-3FC0-11EF-9B29-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000006644c5727fca595f9ffb45bad70086dd96b478e6627985696c62a63d2fe672f5000000000e80000000020000200000004c3cb8cb4a930dac7bbeb5303f403ec21ba0f6940441c958f711ffd35dbd01d820000000888327d5a1e6d0c7fcbdba6572bc78dba9575871c780e7017262be865e0ec883400000006f94a1c6a5f98d43e33ae5b59916224037fb6c001dad00fc55f76bcdfe95fde810d193fa5b7886e4d79257ab0e87c422a15a7c9080e087d7bf01f636d09e20c1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b0000000002000000000010660000000100002000000057410f9ffcaad53f0751f051c3d0e1b7da63dcf3712ea8565a1acacb5b40b798000000000e80000000020000200000000303e632836e82608932e204169c6f5ef00ad9c536f596479a73c68395f108fc9000000030a43d7852e9884fc5421cd0b4614611fe93456e45a9c59a0fd512f42743d2cbd5b07ae246d0bae218476910323ff4e9a3d6aa3d8cde8a10747419e418e454dafb3cc080e65381b072fe0e94c015962186f05f53e6915b82051a23520cb6ae72d87cb6ccfc7135441a06b926b99b1687fafc72ec0f3d7615c37720eef721b20220bd40bd92d836ac469e4bbf957d18c040000000dedf8491a978879361f0de61d9694e75b0a1740689e5eecdc1b5ab37bd703907514783bc3b77cd638036db78704304519e09eb506daee14ddeb9f426adb1561c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40090d5ecdd3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1396	iexplore.exe
1396	iexplore.exe
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE
2032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 1396 wrote to memory of 2032	1396	iexplore.exe	30
PID 1396 wrote to memory of 2032	1396	iexplore.exe	30
PID 1396 wrote to memory of 2032	1396	iexplore.exe	30
PID 1396 wrote to memory of 2032	1396	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1396 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dbb9cbf2d7b0f90b668a96f5011118

SHA1
0f05af3771f63695130b338f02d581bebd4c6847

SHA256
8ed48aa6af124f437e1deefa8a7262014717d89ad551d06a77a7fe81e7056f2b

SHA512
f727f465bcb9e6a46551a2fab6a1283e2a7e36f3ac8c712e5b4e5bc30cdffe745f2653ad8ddd284f950d0cfd7576545121c8930bff3ea7139df251d260d2a944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9b414330617d0b9b71bb5f5778413cd

SHA1
18218db155435aa765d6c2880871fab1998c5c46

SHA256
43d0f4476d28a6491ef6a892fd868df343fe6d75ac467530ac577a9ed32adb74

SHA512
5b71e0b07d95829290ab5be7654200791b3326474fdc60aa061758bcc35a93f483d0347a7f79fa64b828f6c96c3c775ed7058510473fb1b9fb07f2d32b834bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20a2972d8f277dc16ece4b63b582d1f0

SHA1
8c6b33eb1fe1bbf5ca5cc1e72e885977f71b3ce9

SHA256
d7554f500c6fb37ba666075f297d1b447f65b6d3029baf53e2a0f0450713c4f1

SHA512
bf6613c3ea8e0ce90c020c54357923f5135ddaa6f320d2bac6340ae27cf489d59d298253953390b8a38c5d8a167423404e2a4fe70838e9a253d3be18bd43cdff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d2f3660d21e243f057bbf507f24ec98

SHA1
7dcbcea6beca7204b062d1f1a45c88e0c911bf82

SHA256
59876a9344228a87a6d9ec729a10a206f4ca737c06eeb46b28943ffd917fe68e

SHA512
51d73a0ddf1e71fdc753ef9552e8c9ce761a161c9b93aba4af341d9541c35b9d7bf1a1f286fcd4850fff115826fa5fe4e0171fadcbc24460e15b96b715b53168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9de78cf7510629c7f3fb9c1dee14a11

SHA1
3cb0dc6d3e47395829004e06e0d6c01795b2ee83

SHA256
0bec7671ba9018b81feb93e61fe9d7a335bfb3d8f825e21e73440885e16cfa0d

SHA512
8a0c4427eb6798a9e9062af55e2f6439a3c8e8cfbc90b7645651f22a475c91602829d30b6b0d0be541441fe4150ca0fd14a83f1a6ace0f07aa48ae766326b64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d342f2a7a75ef527de6f7d4e055d7313

SHA1
42ffb962d268d58bd668b78d05d0f5d01b1c7939

SHA256
15d525244581e0afe39b8ae44ae6d32c056d6c90517eb98dec4a8d03349d1356

SHA512
0ac4265a195eb2aee6e273477a5773a286b96a6fbd2a47f5a85db2336ceb794d1fb414c7998e4b74b920a3eb4d74c813adc194f48b61c3738b9e791049d9a7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d83ace00b8e2a8243adb325d3608e1e

SHA1
d9bbdee999f534248ceea7b86f514f2ef79e3a0a

SHA256
3ac2aeb7a77f7b8d393a5308996ca2286122340e6a74b6aa6997dae130bd3cd0

SHA512
df166476358bc5fdbb8041bca77c018f6ec3d03e7dd417f60219b933a7410cd7abdb314ab75c928bb86b76ffe261caad68025a136de696e89eb81c1989143568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6189753d16654052b361ad84cc049fa8

SHA1
babc96c6251016f356159919ffc7364bed35a766

SHA256
5cbe36c433601019e37958f021b5ac726eb6f4ad6f0f93b2f23b5f6dc5ecb579

SHA512
4d12a1f3cb52baa82776d9b6b51b7b5d96439dc49d8802b16a2f50e9304fd6323b1557f383acc6f8ba14f5e61a4f389e4d6108562cad3aab00f458ac3eb31e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bccbd5ea9509c954cc5bd99ae07da70

SHA1
621787b38f07c9d278300068fe6e2a1d56ecbd6d

SHA256
0a732fe793b71c60d61d1f3358fdf71a3693355382ab32516d90c6a2052015ce

SHA512
1e1c6a6fb5430ca618604d743a96663466323ca408c0580fca4d34a0897b987d2a22191d57658438ee30e7257363cf7a9f11fcb34068d5c59ee65fe598273ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
545ab1d50c2015dc43f8bcd7c0e1f23a

SHA1
9c2c9af3f2f967aab2672a3547b3e6d2a16a8f51

SHA256
6f20bff0c4db79dd5cabfb4ec3a80d0ae7b2adbf2ee8b9de9b83764d248add80

SHA512
93c6391900ba4b39000223a916e8577dd4061c289c5991f3077a08bbdaaea9d0b5e3439450344dc1b6a8f828a3c3d381a3346898affab95f94dc883c9a6d22b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8c5ff1222a57ce0628f018b0aefde0a

SHA1
0c5884eb0826b905c3b76b420de49d2b784c23f5

SHA256
bc3c3966dd5bd5050fe49c5ee26cac2574148d42294f3bef04223048fd63efaa

SHA512
1dc2c3304e84dba9db97a424185e3fa4eb59c808b66f8f7c31d5d5e95620c796a271f70de645bd2dab7cee4fbc7121f50a580ab4d077c1165ed761f214b571df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dfbb53ecfab3fc71bb8d3b44b3e7c8a

SHA1
dc013ad062d39261ee20186295db068cdeada7cc

SHA256
5a4fd34385b8e8becc386021339ee4b3b04c4bf6c58d0105f20ba53f54ced412

SHA512
942a346a21a56fb5f64e3841bc03ed0a7af58a85f05623d6f8183a9d070a17f0b4d2d9cb99c224dcae0ea722207fa66e1bc29e0b7b9980b14ea5e58d8f26bfff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ae9cea33dff4a5470468b7fd05b4bb9

SHA1
055f2c1e2246408f026ac2b5b09d97300fecb696

SHA256
7f15ad2b5117b58bd4eacbc69af9e8b860d5f887b80af10bf723328ca14b17d6

SHA512
a41711d8a88bfafb637c238d71865017b751824c2ab9b0aaca0bba898918b0b289a6008f4c1b6b3dc9a7dac007713bccbf173df25ea3059818c7ecd8def32e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38241c5df8d0b5b02db91a56a26a230c

SHA1
a4c18805fbc7d76dcc5787246efe11a43ad210ab

SHA256
c05986d88d3a523033d1d18c79d1f72a804d320b2d7894242b60f3b4aab248ba

SHA512
d3e5968718bd6616729527a7f43f021f51ede2db4f1d68b467232fb24e3494f4f4c4729e1cd17f924f56becb9a9acf07b3754821a49efcddb981c5a1c52f1682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f80763dc4fad5c14cb2dfa53b34cd59

SHA1
a9978e4e908846da71e24d1a3fc859f9b6828a0f

SHA256
8c98d473ba18030e078b8a39748f26c6cb932df411f00cc719487080d19ddcce

SHA512
50ba7174fe65b0e50f96b9071e1b108bffe23371ec79e18159b5c78f426911bc419e8b43fb6867ff489fd5746e61720d88c61d217e4f528212dfbc4124f6d182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d454edebd1eeecb9459810c54706024f

SHA1
9819194e7ea07b072e91ca08802b194e022f4420

SHA256
63a463bb65bf58323ee4321f4df9a90bd06012897feb302e07e8ec8c2c9f9724

SHA512
d1dfb64303068704d0e62c48a9ffc92dc2454b455ce06d37523b95ac21e9e61b084b869931d2fe804b633d32e0ac822c7b7c2c3d1c71b4fb869d9d4d1743b0ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD81A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD87A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit