hxxps://click[.]convertkit-mail2[.]com/qduk2vegvgbdfm7vx3clhn4z7kkk/reh8hoh00d0eoku2/aHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9YjgxNTRhMjIxMTkwZWI2NTdhNjkxZjRjNmRiYTcxNjg5ZjRkZTk3ZSZzaWQ9NzE2MjA1MDQ5Nw==

Analysis

max time kernel
145s
max time network
138s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.convertkit-mail2.com/qduk2vegvgbdfm7vx3clhn4z7kkk/reh8hoh00d0eoku2/aHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9YjgxNTRhMjIxMTkwZWI2NTdhNjkxZjRjNmRiYTcxNjg5ZjRkZTk3ZSZzaWQ9NzE2MjA1MDQ5Nw==

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005f3b406f17711da308b6243e99ac78029d78d464881549b56f9d02079a63f39b000000000e80000000020000200000000960c37ab43197f52660c1ca8b336d9caf6ff71e5916ec9031c1fbf59945e96390000000f36475d541e2ba67a5917508e9fb7cc0a80ab07c7a4a81e9ff435ccab14736ae78466feb7271d4f80cf1695b7ae15d4718b5c0dacfeb80efe9f99645952101f35d2c88f00057e64425ee5e74d1fa293106f43b456b8bb8891bac20605738e9133e9e7ddf9ac6162511a982124393be02c7f32ed291ea77d9048faf57641ecfa75425847c10a071e0f04efd1af45f5f48400000004c59f599a8bedad133c14ab299a2f4d7920c81a5853b1c73ea51268d6d9249135df5e828607c58db990ef3ff4d58e781fb7c489c622027697817b42ec9dcf682	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6B2FE11-A233-11EE-9CB1-72CCAFC2F3F6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6065d6c54036da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409567308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000024eeecf45805e9932c4e1304d9669db9f14a1a8c7aada7eeee99118f6eb2f659000000000e800000000200002000000053270695cc36eb0c755b34b8bd03abd896b1b762715fdc31ab746b6a6f15eabf2000000039cca33a3dc1abf43bf908e2cf46e882c9031a91c33e860668f6870306104fb24000000009e24a2f3ffe9f9e0bc34bf5d0afe8da4447fb3ff14ef474e313ce2c333fe082b6af0a5bf21f7bb11d3835a091d99faea9f2fdd72eb28290dbd2094aefb575f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2380	2968	iexplore.exe	28
PID 2968 wrote to memory of 2380	2968	iexplore.exe	28
PID 2968 wrote to memory of 2380	2968	iexplore.exe	28
PID 2968 wrote to memory of 2380	2968	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://click.convertkit-mail2.com/qduk2vegvgbdfm7vx3clhn4z7kkk/reh8hoh00d0eoku2/aHR0cHM6Ly9hcHAuY29udmVydGtpdC5jb20vZm9ybXMvY29uZmlybT9rZXk9YjgxNTRhMjIxMTkwZWI2NTdhNjkxZjRjNmRiYTcxNjg5ZjRkZTk3ZSZzaWQ9NzE2MjA1MDQ5Nw==
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c5f45431fd0ff6a39d1166c21bbc71cf

SHA1
891fa2d6d845ed86c7bab14b341af53e4e005d1e

SHA256
b6ec4b9443dbe4a54f2b0d05bfdce452339bb538a57c724bae54ef48850b9f8e

SHA512
04dc2d47cc5374dfd4ae9cb37c6e74735d7cd8a380c3d74bbaaa597fa93670e9d922f4e94d7457c00c1075f458f66fb7430740167c9b8151f1fb57da2c5987f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe1a48fc5f90601332a0079989d78326

SHA1
67b768477eccf4a97250fe338c0bdcbbcd22dae0

SHA256
2aab802a88a58b8b342f9dc0e93aa68dae27aaa370268bf1c06f2fce9dc8a2f3

SHA512
41541303f8b9238015220707feccade14db285be5de2fc4b50f67e4aebd2cc738912746362b3ad1705c69ed9e5c93ceaf27fd08e107af13b7eaf446ba7ade9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e77330446fc1b7502946c3f7d209e85

SHA1
18f3ef4ed5b9b4dbd397e36ff215428e58f38e33

SHA256
94865641e64361cd3f3ec26ac79eedef9411a40b945a9d8038c3608518793c01

SHA512
6d9af0d21499914602b37cc1bd2a650a7ad6593fee627bd0295c64c5d1d135981c0398aac3142031ab3bd5117cb3af38c762ccb3675184bb0390e917216e9118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c4452efbbfa754d9ffb014b3048efec

SHA1
ebed871814ffd524d8eaf43a91ce4ed76d130609

SHA256
c603e06b247439ad6c45beb1deef2ef6f3558c2a505af9f314a4d1787e5b3b91

SHA512
ab1da39829e8c7c10dae3327e77b2618360043f424a41aa203c2fe372bdb8a7e9440e0afc45f49a35db3f15bbc6d8fd237fa5030eaf78c91cf96c17ee2076880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f8f990272f986a3164c966e9d4edf34

SHA1
a47eb922f4b89bd7ced8b62983da16300e1f891e

SHA256
c70f072f89b059da2c649fe8a197a5b026f3514c804aaa1ae0f9ac2452631476

SHA512
007e1a3a40f9b2a4aa521a4b870bbee85f93ea768fc1c9b8fa5f7f8d89ff4c1744e33039f582d105267e1dbeb290dfc502fb802f9ac1ad6821f42a791cec6972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
533c14bb14cf71cbae4354e426ecdb17

SHA1
fb9f5774e24f0884806b3a83a09b6c15b78b0710

SHA256
64b556bc0d53d97ede1dff5e32166cdaa11930392a386b3b0293bac58a9e2af4

SHA512
1e11638d7e29dc69536ca092f7a99df51e711b776a7026d44dc1d9a3ddfbeff61f0fbe24127cb0c3c9ee3f9c0d225e8e633cb79b0a75a492149fde3674ddd14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5eae8369d2884c77b11ad93b27e329f

SHA1
1c96ee4e3aba31a4e9743a8097b4af2cdc9f14b7

SHA256
81917cbf638a9531e51e29038612774d7bb357630d3740dbedaddf518c59accd

SHA512
058cce3925705a972518909e93c63ae7da9f09c29483d306e9f0b66c3f2596c5b1897bad2e043880aea8d1387bbc646f7f46d20e5a8bb0011b5fe743273380de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
370a22e50531778c4d7ad4162779adc3

SHA1
fa07c8c90c37f287ed2f675aa607ee42af2fbce3

SHA256
fc3abd15cd3be9250e8db5f160402ba0472ea8fa2fb17542010c5570b14cc4e6

SHA512
95be15f39a46699eaf197e2a912be655eab952354362a214b90c1d30a758807f57b34994e3dd4dc49e53cddf1ee5d2fb2b8ef4c2739aad81ceea19d170ea6273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar17D9.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit