hxxp://docusign-review[.]biz

Analysis

max time kernel
119s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://docusign-review.biz

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410658715"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03A36C21-AC21-11EE-AC0C-EAAD54D9E991} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2476	2848	iexplore.exe	28
PID 2848 wrote to memory of 2476	2848	iexplore.exe	28
PID 2848 wrote to memory of 2476	2848	iexplore.exe	28
PID 2848 wrote to memory of 2476	2848	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://docusign-review.biz
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
606cbb927a52d2e10b317bf4cade164e

SHA1
c0c29ae6bf95b1ea21a349418df2b8099099b530

SHA256
05ceae2b751ec3b9b0ecbc40dc877834fc37c188a12e25ba96bba9a153246773

SHA512
6f9eb6684bc87330ef9e1ea8f75afbc80acf9d50ff8cd67262946118dcf070053419df5d430a78b900534b2ad093d56fab3f96b5b8840d9ab3554e6c0dca620b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
175f287bb163b619832ef978fb53b750

SHA1
fe7db3149221a7878d253d614fdf29926d0d9423

SHA256
2c2adf25853f6f1f63ab38f9b3a8117e49e88ea6035ccfa8afaf965d61a8c2a3

SHA512
7903fbda694346f7cf121a5301380294f43fe1a00b0103a654946db7b211e683a56cc753cedcc5e82a825234abdcabaa92591c84bf79cae1015388b999965eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31c7af2b4d6502f8ed1e29d34d55fd48

SHA1
0ab8e3ca110cf95e25ed9232f48ef9b99f4572bc

SHA256
0e6c0edca07e234d7436c5739766339220fe4187ff22fa8c825ba09cf57b4db6

SHA512
2d3950e87821651e695bb1253dc20592af117dbab77cb30d4958b9be17fbbc812a839a7753a137c5ffe47d42293cd41388adcb8c5f6a45e3cb4c95702bc6f68f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13da9b71b7d0e03f67b0636a10e35886

SHA1
604b28f9e97706e6335bc77e3a39628037e4d60e

SHA256
6abfaf91527afd4d8a138e878cb4b2f61c309b8e59b31cd58e73570fc9809cf1

SHA512
9e34acb2bf1a072263d95891606c253985c03e3868fe4bedf5f33bd68c673a59f661e79790cf345bcb1a1409129216a1dad5c44edc0dbc8140df24e5359b2be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75aa6858794edcaacd9fa1d9963cb4d0

SHA1
82b8037c5bee30b3b563a5a895a4faf5f236550b

SHA256
f95efa7394541e72143e91b82293b691548f933f50c7b1a812dd064736d6c150

SHA512
2b037ed1213a1063c00d783f2d89bba85d859a87ac293417f7e7a895a2017ab4253803e93a6b0f13ddca95c4f2b5c5383f93fbc00f0c26234d9d5096be9eeab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ddd257e983f1f368b6202310103afe7

SHA1
0aea5691706cd00f57bdf283d22ee382f4bc5d63

SHA256
b80d8496f17b43e5d2199787050cadc415be2d76d3c5c6b55e86bfc78cda2570

SHA512
c03455bd3bc5b32125b3194b9c2fa3cddc67d7cf65ba58dee556e4403a403e7d0c538853cea898f48160560aa3fc9a4a3526864281803af93211f631fc1993d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95a9d20c45b398503c76aad76df0dc1b

SHA1
fd3779ce1a8369b54564052e13ff57c623353b97

SHA256
84a975a02f82b76803d2f3e6609a1d010e005d936bc9c2a0de44b5afb1038f93

SHA512
78ec50af9e8f292dfba4e9aeb26f2ca7ee22e955d1caae993db3355acfd69e2a963006e560b9ae67c2bb85ed438113ce94924341a644236c2adeb1a32beb1c3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36c5ae766c24d9d15a596cf936b3fb11

SHA1
ec50517af195f2498f72f89e1e1b209177def472

SHA256
1cff3f48e7ab2b2f6a858f7e4b7a74f68532f978be77da7c849071b8ab83d6ac

SHA512
84288d6ef0820e661a6d02dc68d1f873e0acef7602bcb8681f27222bf7439d5d50f87b7ce6617371fd854275c9ee405243bc7906056e614a0512cf2604b8f121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa1fe85fad920b7a69d69ab51a24ee61

SHA1
3eca499c07cd424394dfc8e887d1982dbd9e98a4

SHA256
5dcd2f2632e2ecc25fd093d714bef320cdde51222b9bdfff57a61a886646ecac

SHA512
4891480d77c6f1a7ea754d32f5a118d191e5f98b4d79450fbefe23cffc629e73aecbb59f4e80dbdef05e577c5dd834569bd6f40fb4a203439e06a1a96157135c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7E94.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7ED6.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit