7bf7fc8bca794ab6a78f5450d24d312ccaa53fcf4ea60d3efebb4a1a81deb036

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

4.5MB
MD5

d4a79b5d46f0931b9eb7125fd40baff0
SHA1

3a38fb263dde2251b9fe157b5fddec7acb07c53e
SHA256

03f1d245e6a2facca9edbdaad108169e0765dd9101875bc2d123797994b9e80f
SHA512

17cf94805f11d499ff12d8e42cb262ceecbeb265f56338e0837d291f6a7ed7f8135a025dbe99fdb2e2bb299f2267bed9365976ea51269aafd4c3220cffef9339
SSDEEP

24576:thgBBmnLiLArZ62BrcrnKHq/kUkBAwi9QxruE:rYBmLAehN6KK+xV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000fae3d1f867620ab630f7cbd2c5a1d2816923d2d840244af9f555e2fca6355ea4000000000e8000000002000020000000a5b4bad51e9d3f7199669d1c30f93561118bf32708eaa1007139d2c1876676bd900000003a9078b0dbee911d335397fcb5abaf350da21278dd1800cb29e562349df663e812fb76848abc3ede3c98d43be29cd42b8e0653a5de6b26f8b78ba2bd6d7a62a437f097ab36010f148d875886ff320bd751282b573ff2ddb4be78ce52d5707ecf16ce1537758adf9871f44806a5bed42e28b8fb33504006c25ac171199e1c009ca164f850f074f3ccab3c3021d9a02eb340000000d3bd60a30fc13dbb8f1d397176b5a2aa8c6d085774ff4928735e8d18440a4b6db6e4cd140743ffb07067b5e2325a0cab7a2c173fcc993ebad544dc19d34a8f0a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000d2170310f3aa11242eefafa36c1e9fd1427a49a3b4f2ec38ede533459f88fb75000000000e8000000002000020000000420d0ee86675c1aee1d10b896005f3f30e145b7d1d594134624892a5f033b0e120000000aa6a95f3362382132144fe6b83e596b9246bb44308c67af3896851a036d4680040000000aed66d4a81014b0b84712b9a48b5d7bab3c4a77b6f9c3f59515c8bcfd776436242877efedc701975871d1809e57726ddc3ea2b066e2fef279f48797a83ea15f6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3023b6062fd5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427041929"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{321B2521-4122-11EF-861D-F64010A3169C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2264	iexplore.exe
2264	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2736	2264	iexplore.exe	30
PID 2264 wrote to memory of 2736	2264	iexplore.exe	30
PID 2264 wrote to memory of 2736	2264	iexplore.exe	30
PID 2264 wrote to memory of 2736	2264	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2264 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8053caacc00a78d7ba3bba56064f2ce

SHA1
9b31be53a0d351874de68fb43dcd6cd243d896d9

SHA256
df49587512f2ca7a3e5b929be504c8762291eb3435b060244bf1c70eadf2c7ed

SHA512
d1f33fb31e9592820beaf4ce5caa438de8c7290192ffa2273dfd34418a296687bf1242af288cc1099388f4c12d090942dcaf2754b2889d393671b44cf16b3322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
787e20056ed460fbeb2932a55ced1cf6

SHA1
7fbb1bbd9e4c20fd8a2f3e8f0c9ab67ff9829530

SHA256
b07375f9dabd1a0f05f10ccd4a387ddde7c4bdb88a56e2309218541dff16950a

SHA512
47ea51caaf45dc197cbc6740b769dcd734cc77b77239d4483f31040744381d4fdc25c032be2bfca3b2695856558eb056966da278f8cee5b6a5a4697c2c20b921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bd91beebf48f4072b25f0a7ead43199

SHA1
9a02040db395efff9e74cb98b77a788222270a57

SHA256
88fe2def1544f676b5a92b372ccfcb5cb0115d12d5b3763ce58ee2ee398f72b9

SHA512
66d9c5c71cb540e54b773fa84fe92ba4cdb3f93dd310dbb52882c6a9e2dfc54c521b7a11f78b878d35590efbc6137cd8f5a4a645499a3b69e1f748fa6162a0c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8349f8b95bb22279556a5426a746fc4a

SHA1
13c01afff4ff30aee0548845ed056349e70280c1

SHA256
bf35062f11087886853cca7cccfd4c302277445cc53fe78f90c311bbbfdb9b0a

SHA512
13569a3befc87e8781b22305e13673e4aa8b6f423c37104229b681d9118072c9ff7cb2377dcfa737061290a29e945f08039aabf52307def09fc00c9e318bca3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d3202eddc9a59034af7588985b6d44f

SHA1
95d918c7626adf8742daa6d51bdf1d4cb27ddf57

SHA256
568e66b372c44db7c99d28485610fd1a09448215951f2d45ff729c9c136ee627

SHA512
93d9ce8347536e201869c4cbb2a00ea99709b2a0a5bfb9aafce48f3a1ef64102ccc7ea1f5f9a1680f31d0fea6e4dc38b9c90d3d181a6b8d6751394ac2bdabafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ec1bff3721a551f0575de283697b790

SHA1
70bc3c8b9b8430ed307af3f909b159f6fb8d5e19

SHA256
d07bec02c5b6903cc37df6bf278fab4a5c7c4c075cd7b584da9eb054ea2ac35b

SHA512
fd3bbd19377a29fc46c72a25b979ba9d66d5a4a0aedbfeda7449a9809bbbf711ed40b126d3a5014b67c309314790538839826e2f09ccb077b041bf6e4613df04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7721958cad24ff5f57467ef25cbbd14

SHA1
d2e3a004ab01a5f37e72be641ef811c02c131a38

SHA256
057118641aeb78ad6c3c7627d154507ff37186b4fbfefc08a0ebf96c4f5f1e23

SHA512
e788a522f7a543b210f83f84d496ec9815266915f3590ab0138ff95b09c625b2ada3ed1b58bfd69dbefd0d329fbd3ccd3b5cf354611f51b778a089d0846acbea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
838ab02ffc5d893c2acc2a2f72dbd15d

SHA1
d42f1ca98b25347f896838748ff169cb2cd1f8e8

SHA256
ee1600ec8c7611325dbfa33ebf38aa99697294836bf5998fbab2c1bbc3599489

SHA512
a281f7418321279ceb32c8d8cc661eb447293fcaf2843f6003d06a6ee71bb950f81ce4ad455a6cb37f5e37b7dee6cd3b62433231842c2183f1855c9b92be0b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2d14bb39bd69ea928f6c61eb0702be7

SHA1
737ab18f591668caa6f7c5608c8d4d7e6c816fe7

SHA256
de0790fa39effbdc60342cf5a61b5c8632c10ecff8aee69a94379b0e82b10431

SHA512
6e5632a4e0833d5721fea5c0bdb266fe5a8e40d6288938c6fec9fe219561b42d8632bbbd6a9460667dd2fa333cf058ecb6d07ceaf28851017b99633b037cd340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fa6c20c39f1df343abb9e7e49648a49

SHA1
b80bd16552531db6b81544387dc9f5e01c32cf65

SHA256
cd532074497411d87a481bbd0aa50431138af1db3c83d2e2323cc1bb2c75b7f5

SHA512
47f617dec96b262e6cb657c438c9fd397965f3df57f7f657d85bb144a47d700edf65c381f467a1e00bf97512115568a8f238b8018baf1a51a27821c9e4be3150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7600526059505efbae237c4aec33c53f

SHA1
66c9851cfd2cd22c8927a4e1fed9a5fcfb8cfd7e

SHA256
376310724b076035e95bd4970e122e56a39fe840c98f635a818819a642cd150b

SHA512
004087edb64fbc48816153ca79e11a276edefbf352f2f8ba403fc7b4e740a6c84c849e1355a39e8eb149046bd06b7867f898b61eec700e1f4a482931281ae051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb94a0c6d1cb3dcb772a4bc15a04e3a8

SHA1
54aa17d56187f1f1342140b35c39dca89e8c1ebe

SHA256
10f91f7dc3114373857ec7b7c26f2428f196f786a1be8ff9dc8c791588efaa7e

SHA512
b29f603a9202c70576b6b4ba68408f0eceb19ad7b83a442550e3fe11c527aaaa8556a0113e92cd5a4c4d002d4448773a666429d2094a546340c598cb50b4f3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5f698aa1b590e96c1c9d8dc8d137b02

SHA1
956c142603ccd012df47358b49acfefa4b0be282

SHA256
3fbd9d3d73fdb0ba7486a736bef401d1679bbddd16c7cdd3a7ae5520eeed6fc2

SHA512
d2e36bcbae86bf0650bd0317c0152a0ffc36b94a0b01e9cd7437afebc4983db255189c11bee9b999c1e04479e2d4e94cfbe96510673729420b7f109340da2e90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b60181024ae64c3562a569f12b974d1

SHA1
6aa09a0bbc1c7f9f0e9eb6824810ada056daa04a

SHA256
bbacc3d842a99232e89af636a1a9cd687bc52eeb194c9465c8810879a903cee6

SHA512
8e1370136fcba8a9afb54d975f25f8b9ccc924a0178df14ce431db53aa3ac8424e3dfbd51463152ab83ca99ae16d26ab9483525d47fa15d66508ef3fb0b99c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37ced0fbcc6916ba03ec66d746876b8a

SHA1
dc5332f010aa9c37c8c849e32bff90288d53ae6f

SHA256
0af3cbcf9651af00a1f6c8911baf38885868cdcc2810e8651d80001b402fd4c3

SHA512
2272e7dc2eb1b554c1aee22df1572ec19f82b8748596fbd7208ccbafb8d69e596002da3942373378ac5e1731297807ba35bb24cf108a48a5c266b72d44637bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f24ca13a7d7dc8511ab3970deffbeab6

SHA1
fbe2b26acf3e016ff6e1558e228e1fd1c47fc6dd

SHA256
c359dc2cacf99683685c7af65484527610a43b7534c5082a67ec332159bd53c9

SHA512
02330e033daf9da9970e5ec854cf2fce39fdf8fabee52a8da6c67b43393f0195d238d125e044f22f2de777bac454c05dfa27c439350939a21796bd357a1c28ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E99.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F09.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit