hxxps://drive[.]google[.]com/drive/blockuser?blockerEmail=mpateidl@lockton[.]com&blockeeEmail=iturtiodrug2001@accesstask[.]supporthepask[.]eu&usp=sharing_eib_m

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/drive/[email protected]&[email protected]&usp=sharing_eib_m

Score

10^/10

google phishing

Malware Config

Signatures

Detected google phishing page
phishing google
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f771e663410e1b4c354876c8ce6b6fb102f491efb7a8b2f54adde73261c160db000000000e80000000020000200000004d10d69d8a58398d8778482d3a7434cc01820bf334c8d3f7df45767f5adbf921200000006572002b20224a68667ffb631fee42f684c8c47ea1d96960d01befbe415efa8a40000000f430740d1e865b4b1340753e1fb8a6d1a9f3e923c187278c28a3b4a416055c793c06877b22acd5543759e229aed7e0fbe723bd7cf753b96825e2825bc975f832	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000005ec12c94550e3f88c10182c7e635137d6760ab17a9d44964c3d96ecedb655c22000000000e80000000020000200000000607598c2ddd0b0bb9ba54e98dc52f342039a4dff339e0c8ca26a192e60549a99000000076c180c9e51f1a593f74ee4be3347b09884c3ab34a0352c2892831e113a56c3455b545d31188ee1e14803e1bd6ff451eb400edd231091111fd27355eefe7aae49074de0f849cf82e1de331806224a3ace41bb05075cef3ed968f6cdce475e0e0288454473263ff90510fec29a1a9d03e899ebed76182100c91cfef9c9e68d0edfc836ce9151e71d0444d60632a797a3d40000000b68c5ed3967be9eefa7bb3a277debc6df95d255057d7fa0d4fdc904fb3e1c8a2e5ec4cf7e5f989571899a06db5463261ba6b426b9341e53248454f245de14ac1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE7FB251-AB53-11EE-94C2-56B3956C75C7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00557cb7603fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410570594"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2156	3032	iexplore.exe	28
PID 3032 wrote to memory of 2156	3032	iexplore.exe	28
PID 3032 wrote to memory of 2156	3032	iexplore.exe	28
PID 3032 wrote to memory of 2156	3032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/drive/[email protected]&[email protected]&usp=sharing_eib_m
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95612e654a2868affd6c6846f5ef8b6f

SHA1
1209358f6051f673d07cdec1ad5ee263bcfe4cc0

SHA256
6ab39a544086510ad388fdcb37c687e5d193f8e4adcbb02896b7f2e8625a1484

SHA512
a91f5e2bb4430044b64fef1165e8319f3e96d1e497dc3f5dc483fe2017e7d769bbfd389a17a010c9ddb7e25845d7198cf30ef6c65961ee6c5910c383e7b1fd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9036520ab8856ff6dc31ec32b56b03ae

SHA1
dfe826b446d4a47ed7218e17ed1f3ddf4f927cbb

SHA256
174f8a3f89e9e30a4a66ca043d36d8759d2d84c898c98e942d10dd7242b3ba12

SHA512
6eafbc1dc0d6a83afc2d9935fc35dbc5b9f79ea383d6785bf4d158d56395d9a57a4e1ffc524e750ddf90333991f8aafa180c0e42f39e96d79ec83819c06c2846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12b063a1e5f021b319bb993bec49902f

SHA1
0bbb7e00eead30d1f9559e7a13666480f8d50ec8

SHA256
85ac6f704f5e2dec77138755f95317ba9fb411b0c1062e90c3b15e3e9066294b

SHA512
f2ece631d256d2600b87fae90908e6a124462c28f2253622564e96a415c0fe6fee5da25a389d0c6b0f5ac2437d8d3d57b97dff59fb51a7ccbd01a4d7bc8ff501

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c868473112591d2019ef605dba87280a

SHA1
e367366d40b769d0be63d1ca5ba0e2b5b5c46097

SHA256
933f2a42e89e07cc740832d77620fc836f6c298dc82c908accebc0c6794b96de

SHA512
2bc02c13804fe1ccc49ead4e61c7bd53233a1dcbb3f915ad03a854d66b39258394a4bbcd7d872021c579cbf7672e3b9dba249d40b540dd41d0cdbeef78af63eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e468e460b49943f606525732dad9c7d

SHA1
d8cf7f59c322c68e56d9839e1f6fbd1af231e6e1

SHA256
bc42c70323b02dc724c1fd99ca16e55bb77a296e799b0521380bbc79a496f25a

SHA512
21573e5f458e6d66127e418626f38e53c2e66201bf278d9e0ab05b80cd73b30465ad00bf14a093bab47153d5fe943696fd6eeebeac25ec99add5f9e48042a83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d382c8f6a425ee04c2f0c3af7120b7a5

SHA1
3ff55287ec43006927ed805a8c0f72588e300958

SHA256
a8aacfc1ceb77776767b5c12f8e76e63d9ec6963dc36b3995c39f006c64696c3

SHA512
01f61719b0ee2753b3b1cbd872345228cf846b8355f25e98e9010021fb880886fdb2bc0cdf0740adff4d2d9ce5b5dee2181ead352ebce8162c45dde2625b936f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4960876698cecfc0cf07a992ff6bab9b

SHA1
abc4421f3d45ff34aa92a2b450065c08d541eb90

SHA256
b3ec53d569e17e9efe17f76c8b4dc602da42224af90c3629b81187ae7f476555

SHA512
d31a8e33b5b542ea0d5d7d9b7b21302852de647e2b6052aca532e82ef7e19219e3367119c341a08e37af0f0eea2fe1de0200b516dfada105d15aca35c4f0233a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88291f55c6e852bc283bf9f2d9dee8a1

SHA1
6d1c0cb2e20fef21d1a65172341c229f59bed483

SHA256
000ba1d6256170fea82795c400d79387b143597cf16624f31bf263914e4b69ce

SHA512
13ecdefeaea53a21c411774bdf0d4e337b566ab40e2405a2a222a10bb012709e1f25195be87407bd32a225427df281e41a5833a8882825b3cb895a6839f7d928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
520dc217b0c20cfdeff7363dbc787e44

SHA1
e1669ba17af099986cb9b40bfad7e5d2146a0b25

SHA256
864acb9e351d0248c890c0566491a1266c76f077c96e89798c36911c5ef0e98c

SHA512
4e492c1e3aaae5a9abcdc8e47d6e026612c21110fc23ac5251c58ac1ce69bc068413cfd2b629380324ae10b2347e6cd7eeb6391b83ff84bc9b48339dd87ad7dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d7f84706b0b23a6599ea909d44db799

SHA1
c06778b5762953b0cd2c5d206b84580bfda06706

SHA256
9fb9b628516f099890a334af435097e594ce2167d426afff15bcd19760c16d61

SHA512
bba5134e65ce364bf3462a4b446cb839480c112c5e7399a4bb7aa2b9a3a7e32d46886660e1f3c55b172e8cd778a0d91aa12b1248092987f252beaa696c5dcf9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60db5db2ea04ae7a663c2418367b7f17

SHA1
6758f46d3c3cab16e25099b0560dba06d8234a8d

SHA256
68f64129cd6d4c9d5512a4e0b7aa439200c5795ef82415ae9575611b416d0e17

SHA512
f880b87416d11206bee8378f1dd7ac387ce56f87212e9314ba3499f2505833ad9aab4e1443039b949001a017a621e8e45349538464dd5e5f1b5c2ca53e8614a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bf70c1b3a823f413d0469c85887604b

SHA1
7f71b1a298025a22c35eb8141aa03e82bf50c8dd

SHA256
a2184c0583154755a22cc9df77271721203e2481d0a8cfd4d9c9406d87f34db4

SHA512
daddb65a55762a050fc9088f44f9d163f6029441f7cfede192413558c198b725a1f21a18a223a0e329467e75929b946bc225440df4f4205ead44d5b8f40065f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc3d52fbc15398ee63c35b4604f89aa8

SHA1
08ca9abe1187600735d5683a809acc3b57f7a3f1

SHA256
b1bb38971fe55585459c1657e0d95227b6a26d102b20f852c5dce48dd25bfd15

SHA512
77852c6724d49ec859c5a6299162997ff27b86958a276c14c2e10a2298f041258a325bbb87eac822a033cc9776a65f07c93f2d451c1a03169cb3c1f049ada3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2d97bab2acbff3c2c34a098a78255846

SHA1
401beefea4a3537ab7cb2277f09e68e69fbd6e88

SHA256
f3a1420a0696ed55c31aeaf9a5073c705dd824306eee9123183f573ad020106b

SHA512
0cd843e1f31b2f061fd9036da737b4ffb3e456bdbb1e80aa99969dae5db057d8a122dea7e3e161c3df27294569098b2d883c6db9667a2252aa12656f0b1e4052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
44f4f0f4480c99c02d9099fd12730f38

SHA1
0e967006138c681b7f7ea86fc667fae71ec2377f

SHA256
cb606147fba66ac29b5ea144df313d00bfd39f6aad2bf2109043d6897d74dcb9

SHA512
b353dc9eec4899830b349bceb82e6e58216cf5bb9ea5a84c826145da134445750a90c752621dbd8114d910a06372f8630744b4b1afb1f5ce42e89120af6c4e7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

Filesize
5KB

MD5
1f7390926a29cbca1ac5bef4140fdeaf

SHA1
9657e6e87dd0d7f095b0817746e7836cee478c77

SHA256
99aa4f8a5417596a307eb6c42e4e9c32e804ecb8d7db9e23a07801e9f208a74b

SHA512
94aa45c96cb47eba127ab16f398e1eee6f046291f5ccc54586a277d8c137638e4bcb3731e226db69f84c7b74b3714bc40b4a49bcf46e4a0e4424eea17cde6428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\favicon[2].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD144.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD222.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit