ea71e79cdbf76cb6e71ced45a893870a515045f1826662ca95f6e6b36e7c3888

Analysis

max time kernel
34s
max time network
34s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

com.mojang.html
Size

170KB
MD5

b0088157c46a59b7011125e0f1330d08
SHA1

af45d91804019699db096c3b76541269569822a4
SHA256

ea71e79cdbf76cb6e71ced45a893870a515045f1826662ca95f6e6b36e7c3888
SHA512

b25fd4f330b42be1c1ff53490b227d6c7010e0c80931db12160ea3c66ccfe30e42103e41a526b759f433c84b11c7bea0a2a4ad49394fc4507588b2eedb143c20
SSDEEP

1536:BxYhiK/tfis6S+05fOndTHKGugWqoJ1JJXEhV/llaqfmiz8DI7tIoTyyhlkF1u/N:PYUK7fOFHL3p8E7tOyUF1u/OuTff

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05235cf3cdbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000de308040621ac2db525de3043dbd6add53fd3ae800db80b8829b42f70ec6ef8b000000000e80000000020000200000006a678650fa0de82d7a72038dd0c312a7d28fb85be95d0840461f38949d57f8b990000000e9290576623faec337bfc783bf0308a1daf484ec521cd0f829eb9cf3a236561a7962e676909b608f627e419690b22df703608a5e3fc548f266958d3c5d01a4e240ed027a28f0bc0f9dd2353a9c793ff8128359a9073b9e89db9028554fdc4c5031326993214856b37b6ee624c28107243f4d021dd023039cc2bd77a6cc9748ccd5242c7479389049637b7f4425ba10e5400000001cfd7dbbaeab4072063ace6f94ed34b58ff36a8998a3bf9cff2a7ac039993505fcd7c7941da2f4ea518dc99129e4e2ee52c7fc50c829b8ac1ea90e8347302183	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000001098c0dcb40d9b6ee31706b37dad57902132940ce517428a3f245b1897a8b559000000000e8000000002000020000000a043305adbe5fbf36b1f452652ff30dca38360366063f4a59ab2d8bff8aea22d20000000d8427627051d6baf3d08b93fc7e1190cd8f2164473fe2246b36116c62d69d14540000000be3dd81d454b4bc8548a31e2f3b700d7049a0ce38c3bfe671fa47e064001b8ec3c49533176e58a8290a155f557e5714adeb02d93d8685d7452e31711cf638397	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8AAE8C1-472F-11EF-832C-4625F4E6DDF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1484	iexplore.exe
1484	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3028	1484	iexplore.exe	30
PID 1484 wrote to memory of 3028	1484	iexplore.exe	30
PID 1484 wrote to memory of 3028	1484	iexplore.exe	30
PID 1484 wrote to memory of 3028	1484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\com.mojang.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
bec27163b522a2ba9ba4717083f9acae

SHA1
2cafde9a187586fd3345901c7998b8668b5c8870

SHA256
658a709097dfd15a88639137fe600ea9cb0fa6fb6c27e62b9a655a9ab71c45a3

SHA512
39d71ca1428eff69c9512321aec538c2d19c87936ae876d8d0f745a35e6142a912c3a220eab94c410c885fd06c38c5b1c26b70042dbe52a69971b2dfa218e5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C02877841121CC45139CB51404116B25_70F192DEC583222F4684EC46E2295D6B

Filesize
471B

MD5
30b4d9edf5ef882661d9f1b820aca3b8

SHA1
d49dea727d1c8410cb763998a86212960f90448d

SHA256
0b2cc22b03ae1ddf0fa14792e1d085dcd67e88d1dfd2671fcc66bdbb7d4e5e08

SHA512
a3096a6624c4d74879af05346b9b647f724136731a5014b2affe9b2bac7c0ff20cd1e715460b6cff61842eedaedea8c34ac8fe42c3ef15f4ad0aa418e62bbec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
6e3d400e936651e09b70d10326d8f6ff

SHA1
47c6891e366462ad3a960628ea750b9fb98d41bd

SHA256
ef99fab08d6113c7d4fd4ba2152ad72ebc59da5ca0eb7e580a0e7d600c5c884f

SHA512
f9b212364d939bce38ee1fa39607c86e11699846e6d71f6033e6b97a27149b8ffd9fc24867ab2b906483c2b265853cdcc51f81f02f24831087dc1dda7043045d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
c1f0e5bb8582f8b50259762801798aba

SHA1
f876477fa6552235d061dc17d52078133cf6857e

SHA256
716be436150a23b5f34430fdbbfe61175956898fd9a2511caa01f8ab13058489

SHA512
86f306023c8f97976ed8331a8aabb25d78496f138cd4b583f7cba2f80a26175cb9e3a73bf9c9e3136f0e583b1226fcd1c06d2b63e529be555df61ce0ad2b1d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
df57dc9345839bf451122f47cdff3a04

SHA1
a154ddabdfb984fb50ff687773915b57f2faf31b

SHA256
fc670ca49db8bf8b5fa18974ca5db12085f5ad6407c5e2fe04909e671bd4a61c

SHA512
e538854338d1a5f2ba526bebfb7bc0349d4971e487e706040192cc91c4f52eb6db19f30b48adb275fa79e443488e4e6940ecc37faeec3b7194d67c788f363daa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e1ae3106f3f55a802b38332babf64a

SHA1
4a74c6f77609d8bd663f423d79a82c2747b671e9

SHA256
230d8cf91787d5e572218d91fdec9cf428a3ec329d23383b4686df2ffb64ba73

SHA512
7ef4db4dc9ea12479437d92fe92f4eff8d12c924052b2441252153ac2abdd66fc6ff0bd84ea6dab9d4925e353b2264ce50453b109e4b353c99c74f6dfda2af6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
864bedf7730be9944c39f6b55d300a73

SHA1
f3cf4cf5f4d00e7648ed6cc5a7fddc66e7cd078b

SHA256
f71aac7570a53a0e8faa9e173d65b7a374c33ce148c46da7e7a7ca570fd3fbc6

SHA512
b47405284b140c2b8da664c354be29693c9a9d82c019e011d92b85bf7ceef02950f72e9b55bfef183b571f717e627720d909c165c0a151a498a48b3a54276802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d016338362304901147c9965d47a9c

SHA1
4a67abdaacbe46263c0044b72c5f6568560310f6

SHA256
4c252c803616a091f1407d551f6cda2a2a12087b98e337d2e38eb9f900ffa031

SHA512
77c05714015ce63edf62c621492715e403793409fbe19ee460ab446152a389f8c3a89641ed3040f5bd570f9de6f090f5b3e5a93ac6a426af6935e60b82841c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83b1800efe6851154a9c9690be9fe97c

SHA1
5639cd4541bdbc37fefc5dfb7e02b59e4aeaa811

SHA256
e0e58f12c017b22520930c033d9d9f43329d4de2d91782d431d6038eddd4bbb9

SHA512
6a351fcac41f4f364e6097d4f0cb19a2ba96bded1c8b2d03d3f1c838a88dc600e9a8e3ea04ad55bf4a259d83a12a8663f6cf40e1f2f7c3b0509d7ce3e40995f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
168cf423251ea855dc51f1831f3f8857

SHA1
462315d3a50902b916948b0976fbbba4c531e457

SHA256
bf60a9bf2ca8367cd9a8e513ef94ef44fc7aca638ba802cdc2a2c6a257937b8a

SHA512
443cb9707f1ec4c5e4c784c3bd4bc628ebb3e106af4a877fa72f8c8e10a994950ffafe028ae38b21cac3931e52fbd26a09fe7cde39b5bcc0814808bbb255a029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c52987e2e0576c2ef2c2a90489c2745

SHA1
27e1b0b24ffbb3d8ab4d274b0c7bfbf5da0a60a2

SHA256
e1ddd964a14a934e709ca5793fc9458d16e5a4e239c9cce0e4de8f776db811ac

SHA512
34a2fb00e2de830aaca133d6109e9b99f31b4a32360da836242dd3a18234b6d3b465747f12ed43bc4555f75c75e0cc3aef21b566b0da12048e2eb2c055e0d3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
203fd445f41062aa6ab1554195d3bb9e

SHA1
6aae17b4c1095a8eae3a9339681224ce481d5e1c

SHA256
674e346e7a7dc9c33520f654381077771949767f988d27b476a98b66087940af

SHA512
fc90adac344901642d87438e1650be5a101eaeade333d9f902c10700f36fd4933e847c44e47003f62987b9fbe1722307521c8b533299ba95fcb74783148e481c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79d78972872678cf2a1e653dc043e455

SHA1
d7088540a01c5edda7a9e08bc037fdb9e43d28b1

SHA256
db0d4ab673bf8a9d4f3e2a849343ef230b5e0962a5c866d49176e0cf43c0c714

SHA512
8a2504c95ab2c2c3e6d7f5d77775728ec81362c95df45e2e7935e1e294124e33e32a09c240434eeb6391f345d51b7de25931058ceee605734058f436bb0ffb4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02627878268e2b01ff12b951dde7beb7

SHA1
ced7f807776bf65e83e988cd82d199c6bd682b0a

SHA256
3735d36f189bad1b96559a3d95fa28932cae4a8085f5d9df296a7deace4549c1

SHA512
08cf2d6c541b80bb41551c585dbb249e6f5fadce7b5e2a17b9e711e375227c2087545646525562c90f7c60290a26a2790be26e2ba5be792e05a6137aa2483fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503b5d9a83255fa72a3230262166abbb

SHA1
d0b13556b41ccde95bc5d23a8e988bcc89a96538

SHA256
537192610b00adf0a9c9b63831c2bb86ef25ff785f159033dd6d678d42d73a70

SHA512
5e4f12bcb4584bcce555e8c56ff93efd99432441f017ee5e77181be514e2c7b3ec4ccbe9f61295a40c64dc9f034ced1ddd39388500a8728125b3fb3d9b38a493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_70F192DEC583222F4684EC46E2295D6B

Filesize
406B

MD5
d4d421c332bc0a399c0745e79327f817

SHA1
6657a0e55a966d65bf16c9150bcda1693717d3d6

SHA256
b584f3586a10abda73515d4fa6aa7258372028d01fa2e6de0e52cf097d0a2a46

SHA512
a43abcd2fa6ea099de1ba7a026beee7abd1d958a2345c0beb018248e2ecac967b4c42f4045faf7a52cc138eb51b6796a3ed84cdeae7eed64a1b5f46ed539f82b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC6BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit