hxxps://google[.]com/#daniel[.]roushia@danfoss[.]com

Analysis

max time kernel
118s
max time network
159s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com/#[email protected]

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000002f00d2df790cf489ecb663b73c72990e0bf29dc0f385200db4d815a1f5ae19b4000000000e8000000002000020000000ce03c670d9df5f0c45581b85f36af55690ba4e38768358e95b6f7c196d67c02f90000000d6a02e133ceadd9c066eb80e3bc6d10217d990b63000747a40db10e69c683119f88b21d39c249411b0b729ff2296438259fd32486cf3da23abbaf9e54264db49557a59f88f32450df54fb3be604bc4b69e86fee149e096aadc59da2455e1712b654bcb8c07ef2c02f4f0038b4c8420eba850bc4a0ee8e86bd2bab2edde6e923f4125212028885a2b7c422a7035813c864000000062067b2167daed827ccd9d4f2d73c7311cc2d4e83e871523edd954e86a9bcae3a1b63202691923a5c3cf071fb54714d136b581cd8a55b4a2020a491c3f6cc1db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c67192b999828100c3e91de810bc17d8889f7871db23b3231e72b2e15f0bcc4d000000000e8000000002000020000000327398d4bbcf8d056b672d5bfc26f56e6f95bcf96fd3fca405a0b217b7443358200000001d9cc2e165a7d899304e91a4c270d797acd1dfc53f9529d6345997d1168ff0c6400000001b1379870c81872cd01a8af2c0fd4e5a7f9769a72a456d8efb03206efb1a761fbf29f9efcdf06858f135b843a03d30200dd5bb77fe779731fdcfa207686ea595	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410592800"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95F082B1-AB87-11EE-9005-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f31c7d943fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2184	iexplore.exe
2184	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2684	2184	iexplore.exe	15
PID 2184 wrote to memory of 2684	2184	iexplore.exe	15
PID 2184 wrote to memory of 2684	2184	iexplore.exe	15
PID 2184 wrote to memory of 2684	2184	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com/#[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b37394fc4d59fa14d006aaea43a2d78c

SHA1
dd6ac97ac109dd8d34ceb047597f5fee5adca7ca

SHA256
8f0f3cd8ee8e33d7e82fb899426912440eea863da852708a339ac03e44ed441b

SHA512
41b2e4c0fbd97000ce46362bd365d3f67a246b4602114745ab547b489d7ef419ed0ee5c0da78adc7d3c247c2809842bd56d91eb42e7c43d3c798f4ad6bab6818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe7ef348fd1e6786d3141248593d0deb

SHA1
03b9f30389bd67eabe77f14689afa42225fadd09

SHA256
81d5e43ba238f1472350000a8931c8aeb00ab45907b75234ef7d53f976d45401

SHA512
cc55a8bd7447a772dc004863fab8ed19e293b0e441fe2ddb7ffa1f44ebdf0db28213d071914699d42e5e7a6775c4fe9e4a12cd317bdb9cdeeffef1561c0915c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c739fd6f77cddb37edefd738f1e283f

SHA1
87e3c28eaa3a6e8242679793944c83c1e0622ba4

SHA256
6625c2d1ef420e01de06658a8260d283c26138ea2a18922ce1c903bbd2c7fe41

SHA512
769df27e7dc05d737a397f94e327fa86c54c8736110999a6c4802e62cff99232d3ebb5e57505860b85838351f2169d85d41cb04dfd86e97b068b612568967b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
45967b3302aefba3b5c2f83515a89057

SHA1
cfbf76cc4843aa7d870fc48fd2a5e3bce0ecdd3e

SHA256
02762bb71e68578ae866ac0c630943ce0c2a77c3455dfc4eb59c3eba1cf52b07

SHA512
6127d7b5f1a5f44757d3b7a1a861a86fa1723d4671c9ea215ac3709561aab8062aa83ebfc1f486fda862423e7e4bc794857e32c1e301bf5ea06b8c930caee48a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ecbcd96605d474658f75942ddf4555c

SHA1
7ad4b9ce266ea0482786c331193a5aff26ee2fe3

SHA256
90799501339ee900bb68ec7d0dbc6f43a1b27d43e93f1d911fab12a8b3c1609b

SHA512
33b19a0e3654400f8ee7b4a3c86b4c6c25136eb982a05eb5af21349b2552b6f746468c830c7a364bb10bd9dbf05b56bec26d0494cd00e0e42096d7813d42b941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b50ae6b1f6b29bdd4a37d956750a9d9

SHA1
b1b2fe8dbcc30054d67545cea113180f8639da20

SHA256
8b40a574be4bd687c2366b2ca22d0574da496b6c6974fccc9fab3d127a3473f0

SHA512
e39a0313053fcf63ed295659152c2585b4e630436a12c96f7aeca8684b626bfd022251439c507cedcaefdd395711fe1fc5adb8e8a44cb318250299b6fb5b4d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3b58860cf8e4f2d205e49f80f696da8

SHA1
b2b923c448bd06a8601ca30b7dd66c4f12add34e

SHA256
b14e03023cfb7612e21f2f5fc1befb7ad1da5cef2b725d813e104aea9975816a

SHA512
55bd9c70dcfd544a8bf7069c374b749737907df69dda0b184cfd03d00e9415cca50525f05dd49b5bf178c18c5055ec5130367afc6764f3ddcfc21604a6ec7df2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d391a42fdf26859f79a1567dd1b4d566

SHA1
ead0f09e822d8116852a9f5333308a6527e03330

SHA256
0463f13fcaa9b0d03ff3a286dea37a6493148b090800988862ec44a77d09371d

SHA512
d834cb77d75f0748edd5f32b85eede3a5dad79d52086828c4e3963fae98b29885272ab79722c98fcbe832d1f7c0525c185ae361953093e51694a7913fda2431f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a714a90a8c55d3f4bdc694ec44772f1c

SHA1
f10d10cd5a136937b4d7cc44e6e31ccc1d2eaa1d

SHA256
e4b64dc744c62bb14ace906818eba6d0afee6eee4a220ebf723c342c7bb4375d

SHA512
7bb6e90de064c28d334b3ef3c4a7537c10eba76f782e9e10d0756538734621e0e3e96dd9a6867f3f203a50cb2a06095c3f3b6804f50f995d6f4522a7defc0c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78b51af285baccdfac13a52dc4780919

SHA1
fabc05489da6fb9e21451a7135cec7c6de3abe7f

SHA256
84f44e0741ef71a7bf5f8fdc9c3e546394a4c87264c9dfadb35f5daf6820b90a

SHA512
6fa260bed4deeeaaab9421a691c203cb7492b629f6fab7bd340bfeaa5e204e1f416e4f132b972e297a75bedd4dc813136246b075e6e82fa38893d7197e490048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3b4b868437c0ab95844ef0f28571b096

SHA1
f28cec79da96635cbe0e9b101f4a2bc7cd6515d9

SHA256
956d77a36d945810b7eda29478cacde355ae873ad7e3cd2175208e88cfbcd858

SHA512
f89ce4905d7c484ea4294cb0b23a0f65b42411e64bdc359eb76099f48e7328303c567ff89d03c05774feb278afa87842ec18021a0e21cb93d489bc6d848b608e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af07a79d8432af9ac9d978ce549de9d4

SHA1
ab947d9f6708cde17eba7fb132dcb25db4d676eb

SHA256
b71563a037aa1f2f4bb527d21b683b40475668e2a497fe93d3e7079664d1e8d8

SHA512
4c04c31e837abb73af0b46362ad8044740cc272cdb57819515ea89bfcc6c4a38d7d15ad271e7ac69eef46a5cf19752c28820ed9c27d19ad26485636a8d7ac28a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23000743f04fb0bf5a78eaefb8c43caa

SHA1
6d78370af7026e07aacd2926f9388208045a6755

SHA256
89d4b54ea5c0775f39936aaebbd94f76d6824a8f0f1ad99725e51fd724ebae36

SHA512
3e8e9ac06e215285852718a3edd9f23c551bf6d08dee23bfd1a66f271369fd51b12baa2d8cc1c2f9ef4516f2a884cb120724d8561fff5642f77c58e4e3d3afd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0336a9c81ae434c1a41b26caa0bb01c9

SHA1
42af31adeca58a220984dee98c31c8827e52c325

SHA256
bafeb9f6ab68055cc45d47434693093f9adc21a690a1feec09ff99182cf363cf

SHA512
c432c13541d2a159fda850df24021a48991e04dbd4b5ae2284b10658277763a6a44ee8b1aa1377f32542999e7a2cd6f8bc9b07a5b22ba7d78b190618a059b23e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
412cfd5784163a2ff00d40866ec081c6

SHA1
43c88a6e0580b4d1c12ece6fac593b894ab3b434

SHA256
7a10be57edffce8bba81dffc8375ebc6c3e5c3699c41103b234e07817db67527

SHA512
161cca407af0d9281dc3bfdfc8520fb9f838c4278133943a9197536e59af0443f9d088b4786eeb8f31a4e75fbe5a8e4f13125b71d6a3699e8b2f1a99b0b41f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2tj7qpw\imagestore.dat

Filesize
5KB

MD5
3ef8ef4096b74ca5ec83628c11cbf6d5

SHA1
51da3ce587e2e56ac04f18c821e1d56657dae576

SHA256
8b66a3741f5a13afc1aa1827f43bc1147e2b60d9388a31959606298950a9f1c4

SHA512
9d367cad24ff90556fdb988f7b1a9755ac696ae7b85a7e6e43d92aba8beeb3c46a98db45047e2fd3e214f7aeb93808e35b773dfe98c68272836beb7fd8bb3671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4423.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5870.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit