cab43de74702f11eee7a9913a355863b17ebba7f5eb051120bc9fce8aafd117c

Analysis

max time kernel
118s
max time network
153s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Combo Minecraft/SLAYER Leecher v0.5/._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
Size 1.1MB
Sample240820-dfry3athmq
SHA256 54ba0c1fb0e81fa1f796531ae506fd184dea10628ab9f35ab9066df86b43c3a6
MD5 b6d2a0e9584d3f7ae696ac83fc94713e
SHA1 46c8381de688107919d2658c996ee3d0a03fffae
SHA512 53fa6d888a0dda49d4b62402f5f1086b52ae67e9d4e18a03eb5cb8ea0b107fc87dfec2f965dbde464c02f6bec48972860a1cdb78c9067e1d9d2e7adc4820c645
SSDEEP 24576:XZ+IA3qv19gf0fMmwG800J2Gjfk22b4ZqqqqSqqqqqqLqq/qqAZl:J+IA3qvv60dZsk2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	pastebin.com
5	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F63F47C1-5E9F-11EF-A19A-DA9ECB958399} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20db9acfacf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430284527"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006838ea28cd1530e0a74f5e7128145928792d21853074f3cc82716c7c2a785d06000000000e8000000002000020000000370c088df5ad0bfc2a59755852d2a081da50a2b90d30ace958d0339097224b2d20000000fe5ce7af4f02f9840ec38e33008465abb54ce034b1e4f8e7a3238c1c6ab5e39f40000000fd862968dea63bca67f3ac9ae6189e24e75c65da6a364dac116bdf54d4ff9ec67e1acb2f73dbf0ff8a21dc13fb258ca46f62acfa21972228b006c84d3d66c97e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\exego.app	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DOMStorage\exego.app\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000082bdaaa3d8ed54244f101c17f50797ce2e0f467df6b219c718cc2572623929e6000000000e800000000200002000000023e6dba8ca6142192cbedeb2c31bffe0d18dfa4016fba8421d1c52acc55628dd9000000000c26943ae0c5009030c87e60b387f12e373286152a8b0e456ce317c3eb2f9796f17955caee569d1576b3491915fd62a512db1ef31351dabb01bdb1d9504bcdbc36fc6776c2cbde0238872df703e2c0b1afb6298e5deacc4193b6daeb2267840b2eb5d174005e7c0d5e412b9253345f50e65bf7ef3820952dddc6dba2b35a911141b5ad95fe2ea9e67a36cc04e6bdbe2400000009742e819b517cfbb8a81c2d1f41c066d72b0206fa9aff3cf12de86026075c2a5d74c78edee699fc619b86b07ef3899ad1c29cd6269d179a06d6df9d14deddc07	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
2820	iexplore.exe
2820	iexplore.exe
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE
2976	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2820	1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe	31
PID 1572 wrote to memory of 2820	1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe	31
PID 1572 wrote to memory of 2820	1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe	31
PID 1572 wrote to memory of 2820	1572	._cache_SLAYER Leecher v0.5 By X-SLAYER.exe	31
PID 2820 wrote to memory of 2976	2820	iexplore.exe	32
PID 2820 wrote to memory of 2976	2820	iexplore.exe	32
PID 2820 wrote to memory of 2976	2820	iexplore.exe	32
PID 2820 wrote to memory of 2976	2820	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_SLAYER Leecher v0.5 By X-SLAYER.exe
"C:\Users\Admin\AppData\Local\Temp\Combo Minecraft\SLAYER Leecher v0.5\._cache_SLAYER Leecher v0.5 By X-SLAYER.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://exe.io/pdbKe5M
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 914B
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
MD5 SHA1 SHA512

Submit Download

F0ACCF77CDCBFF39F6191887F6D2D357

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
MD5 SHA1 SHA512

Submit Download

3C428B1A3E5F57D887EC4B864FAC5DCC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Size 252B
SHA256 10cc0ecabc448b336d9e1fbb06a58299ab522539898bce12709d6cb9a5d3e8fe
MD5 c5c0fc1c342927dde6a17c025823f7e5
SHA1 3884b570b1721a977c93995b56efd2234410d921
SHA512 d7770cbd920f61afdb897cd796e8753d0b41b468993fa17cf4a4d1e87855050559c632dd9c786914e57497c5693b72c0a1b89e4500df3c533a93fead0a660fb9
MD5 SHA1 SHA512

Submit Download