hxxp://google[.]com/

Analysis

max time kernel
202s
max time network
196s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
07/07/2023, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A82CBC41-1C8B-11EE-93FC-DEF85CD8AB75} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395474639"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e0000000002000000000010660000000100002000000000fe892b7d8402c38870088ec198ae1cfd1669c1554f78f07f0657f26a634017000000000e8000000002000020000000980c6d3256978bd6ca29e8f1cc77d69024a109b1d508b5cbc6f31f3605425e4a2000000062520b87ff88abce434ae9861aeaa7de8001d7d75a4571cb73bbe77edc7c528240000000d2ada8fce3274178f9b1148174a504948d7b835cf19bed773d86be34019480bf570c3b52e9b4353d7ff791de5079c326e742910c6fa227f156afeb337353782f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f072f68198b0d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e00000000020000000000106600000001000020000000efa9ec45a2bb31670738f422adba635ce0a55a0bc3b0560f812328f2af035d67000000000e8000000002000020000000c5fdd8ff1158c8ed800fe5095c52c07445af08e64bcc828f06beca16b0f9b56b9000000027fca690405f720aeeb5c7dc471409dfca912e1c142ec36878ca3a99f8f78476cba446b745e84fa654546cd3d3a6b9a245b02278b6d584f04d5335f5fa9a1e88dfa5335040f96ddbf453d42e1748b5bb5e7d8c0ac0c070eb2e342e6056ade00231f8d4b08963bf07f3706c0e467875af3f6ddf61672b318bdb6556da40d5dd4d091f7343b5a1e9b9e3aeed17ad77506d4000000015f8a623e9f5c855e3721714550d8242f5ee8a939905aa6f960b6d55d4e784869118ee2ba7ae24839102c6ac842e55f9b5b29e5f4df1510f6bb4c2140103a2bd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1044	2948	iexplore.exe	28
PID 2948 wrote to memory of 1044	2948	iexplore.exe	28
PID 2948 wrote to memory of 1044	2948	iexplore.exe	28
PID 2948 wrote to memory of 1044	2948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://google.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8894fa47f0ff6b33211718c01c28fc2

SHA1
4578ee2fb2f4fc34890bc46b61175e929958ed2a

SHA256
8f8bcdd7d05c5ab6e0013915f5b9641d071ea013dc2cf0ea1f709122ab413129

SHA512
eff64dec635f6bed82b90051a1722f4f867cb54833f0d59eb9947898820443d5f79465f5501df4c9ff167d0b5c2ffb62e07461c517bc525cbb8755dc329caff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f0dc2315e6d1174b29c38ea5c06440a

SHA1
dba8014b6c0e7879ec9105257f60170e4710e44b

SHA256
ff2b8acdc069c39de66864eded8dd63f56438711de2e5ac437a17b3254124506

SHA512
cf60b4b8f53639fd2d1a2a87e7ef821c6dd8ebf48efee4ea1c52977748ed6abdbb224b28e67f81746b46bf1c8b27021619ff110a7488c4c2ac01f478e7263abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86bfd3481e0b68fb2ac35f7777f3fceb

SHA1
4cd7c5c75f5b5c936854a5edf9b674b69115916a

SHA256
f10bd42aba31e0f3cb17cd8aec7d479eb92a8b7564c3c531f700503cfb31774e

SHA512
fe5d7dc9f69b25192385c01d2b8ca71c41c280718cd578f1a81a09b03d3cf3f1a7f716047555affdeb0eb3a9a826d2fb140d7aea22844cafabadb0c42fedf4ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58129bbdf8fde80a9b34af39cafee26

SHA1
ea5c4783d4ee82249f0c6cbecfb155a51d053535

SHA256
b0e01c95d1d8e726c688285af14ff68e239461eff09401ba8711b9dcdcae0a7e

SHA512
e28e2856cf9783ce796d3e8e8a8f897938f2c5cc9ba310b05594138c17d2715e86d86f750e34a955ac150aabdfb2694e951cbe1b4889dfc13c5102fa33b4b4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5798a99719884af520681329994929b

SHA1
794ee0534c270e2542acd9c9228fb3198f186e17

SHA256
f29c520f6591f9d6fa2a7d0148d86490e2df05dd8310e4e20411787a6a0f36bc

SHA512
76d248aed00e2b97227fbf3ba7da1f415b185b2c2b86a1dfb2cf1f2233a55f27f0796e2fbc7c39eaea4dc1ce074c1bcc76ebeec39145ef3f060cdf0751a02813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c1af5e99755185c39164c71e30a0f8a

SHA1
33e701a5f255462f8f17e07e4aade6c1c6889623

SHA256
0a2802390b36ec858f8f144fec5abf2c6cb5f543f6ef5e8ee978c2de929772a9

SHA512
f7b207770362bd2f271b2a33137cf16bbb42008bb4f8fbc1e8cf9dca0f8c28458c126a8eb6450a8967e7858598894816f45fbb57b37b77dce3fe262da92e2dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d0a6cf8c0e60094e76a1bd63889092f

SHA1
c413f5b2f4e9680de7256462c3b86c73bff3fcd1

SHA256
c56421c2bb45a0500d21d70f1cd2f7f488750b97e57d91b7e6a8ce0573c23d8e

SHA512
3542d0f2af04b90a5d862a5a21c2eaa2a7e63809b4161813d1dbb78619e7c335d3f33d304c71db37f83548a95d4f73f9d013e9cf245730a459397c25cd3a1b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
493fb33a1b9001214fdf7f5d2dd7f38b

SHA1
30c297034907d0383d7f3bfd484faa9e3a0f5dfb

SHA256
8f1a4fe5bf7b823d3b5a01f62b030c11110a61557a439717c5e3904977c9a405

SHA512
209a80d57617dc5b8aabee43d26e4ad4a53f2839071033f036d3808a8e9e34f11930f1acf3f51a8b3956133e2f1fa6e93e17b5abe9e906ad62c901d70b055ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
217455077bbb52f687f86fd8d207abc2

SHA1
3c831163be8d5bb5d42627029e5425581201a384

SHA256
35f197f12ff28674001e7c48e4499bd6309ff71262cc38dcf9b65eff4e00ce54

SHA512
03ceb752b842ad146a2cf65c93b3deb1d02486f0bfc6f0687786e23d5910587b7bcb7b75a9e34c203e09f6af8e92b719b9b3fc8c64113b09098fbfc8137c768e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\j9ug3nj\imagestore.dat

Filesize
9KB

MD5
bffdb99c9c8f33879a77c5b4f40aa562

SHA1
2af8e8de4eeec5dea149a5a7e0f4b96371d29994

SHA256
2cfc7f0e3c8603a3cee7992de1e8435544f16fd72092e4111d9ee54f4b3f70f1

SHA512
37a497329039c8837f520160ffb110984fa8f670765cab856819f23c17bf91359af454e505623fa988ebda4b8ed622185787d3cf8cc66e697a9df91a997da86c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LIVE0CVT\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZEULFN0\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F2C.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F3E.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XN7ROD1G.txt

Filesize
601B

MD5
53d424b821ad4b8363b19f3691f02a18

SHA1
2cadcc77ef3ed2c56484916e7652e433b6b97e9f

SHA256
bfe9791500908d9eddbba5c3055d0ec6d3e5573ab26cdc84486066ae5b88fd7b

SHA512
b3d5b3b7b162444daebc22b46596a5b224b8de04fa53bfd5d0306ba40d21462cdde9e07b18f6a395d1a391cee00384deb35310ab6afa09cb7fb18b77d6f2d793

Download Submit