hxxps://protect-us[.]mimecast[.]com/s/WSCgCG6KVmu0nxK0sQrt4B?domain=dropbox[.]com

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://protect-us.mimecast.com/s/WSCgCG6KVmu0nxK0sQrt4B?domain=dropbox.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{197812A1-AE45-11EE-AD67-62DD1C0ECF51} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000761d2701789dc1161044938b28590a05604d736f768f216a09d9bcc8b585b71000000000e8000000002000020000000438c4245e5eb579a3620ef779e6d5560ed1a9532393cd09c1de734e61ffd56289000000085e38db6dd8ca7ce98ee8386a7c94c897fe521b9ad694e7dc190839ff80398a7417c4cff823c20f8dfd8027870cb49f2be18e82247462ce5ec7a05c7b3907b7561bb1685fefc1975cc53de0a2b8464bfda09e461412595419ab1f1368146f5fb85416e4598785830140882e1994382c2a4a4c8638e9aea4721aab6f62d2d60df0014ce821577dc33b15eb7b3c40b64f940000000c2e5ee08d419b2c9714f5d7d620d17b3d5403398ed82d292721914e300f255e27c444e3a645d1bbdaf425063d7d4369b25513174b7821570c0e1e5a64078ca29	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006fb54d8435a438f5d89b6bc96c3e79abe1d81c5df8dc7f69fb93ff8453c429b0000000000e80000000020000200000007726c918d952f624ed22c0090d4c671eb058f357d9e3ee5b0a127f388ba7da5120000000a264b65fa4afa8bd2e475079efb38d6c74bd3e3931976cd9ea823510f2c479f24000000074a23d146f78cbf4fef1711aef8f3f1ae701503e0aa217c7791b297ac22458daf5df5cb5fcf49f6b72ae354cf2bc972c6dc5d684239e71a436ccfbf1f3d6ab50	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0e286085242da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410894146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2032	iexplore.exe
2032	iexplore.exe
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE
2132	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2132	2032	iexplore.exe	28
PID 2032 wrote to memory of 2132	2032	iexplore.exe	28
PID 2032 wrote to memory of 2132	2032	iexplore.exe	28
PID 2032 wrote to memory of 2132	2032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://protect-us.mimecast.com/s/WSCgCG6KVmu0nxK0sQrt4B?domain=dropbox.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6333878005012d2278097755226ac67

SHA1
44a4dcecfd36611fc53e608b6c6c4c2279a3d45a

SHA256
c18d08050501c8abae477488689557294f93474ccb4fe9d4f70db2e12b0b8980

SHA512
5073275ec045991d223d1c5273ebb0bd877f56524f3a0e6814a0ef77dfa9db74e8c843e90ce136de500f1e51704c3f9490b5b10147fb8d2685791f075c77cd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9279e4e026b39c24e4a40da7c8931482

SHA1
8172c6b7921d5b361e2cf5a4cd1698a8699d1e70

SHA256
b86ef383281472c969b89074f56d8257b57fdd0e13f8f3a36d674bf398db41d9

SHA512
81aa793ae60dda719b8d8f9f77df81255d1df15670da79785d92a73889e9014ed167e989e5cee0f1efeae1e050aad4c7e8f7965d60e368e189965798a72c0e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9de6bae66f312cc5ca5c264d505fc6f

SHA1
1023ff7d78071b28216fe448457cd4bf5eade0cd

SHA256
8a6b03df153895e9dd7cf78ac50ce3dfd8b59bdf7568628f94c15a8285b915a3

SHA512
1188a2afdb599587d380e648f93c58ad4915318ed86615a606e8c03924524c86e8d98da957f48cee4de93f5bdd3a99056bda92dddbfa75a8e94e5622e0b9dba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03f6cc812cf2bca1a1e636797842ad8f

SHA1
0c0cac8d2623d825233dec9527e2937532c37ecb

SHA256
6fa1db6e005869a624d1f2e075fe1508510dadd191cc5a46b8df1d0cd33be2ea

SHA512
054792f8b921eb2507d3bef27e9841c6c0f94d407617ea537d1430d01baa60fbe858d6ac6861dedcc3f3ab26b5a9cc047bf5f20f28e8c98789fd158c5f2fb728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6938a5da04a163343ea408a71591464b

SHA1
7b4c0c5a8b3976259fcbf7260fbb9f06b103a73f

SHA256
0e33388c552fea9a2bd10bd245d7050c1f6b0d153620092d91facd4dc836add1

SHA512
a8795dce9adb86256947daa0dfa2b559c5bbc3cb1e3f936386cf1a7cad84b32d361c8cf94654993f5ee78be2edf7441a72bf827ed217624c665c48358262296c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7c4a5c4d4f63e8746da5df04b5b39c5

SHA1
85235a79798b5e5e1dd34175132d6d4c4d13f2ee

SHA256
cfe16e883c98e8ae34470e9de0ce6373661152e54f896be0ae18fb39e2107c23

SHA512
2cf076ad65e83e8b0f12c85941923a37a0ac32b911dd86d9715583b73490d185db5fdb63d9ff517553519b4205a80a81e4fecaddc41aeba236fe423a3262b1d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2802fb5432494d732df02e2edcadb0a8

SHA1
ecc4f9c774493122d30f01a3c1fb7ec0d6dcf7f7

SHA256
a4508051a7e70ae44ed1772efa682f86111817ea88af4c8e0d53504119582afc

SHA512
3e5a4629762f8c062a73099b5bfa27be328fd47021aab9e7a907b2e0e9995df30898e6fb0885ba1c4089c7afa2bac8042892af450b05cffd09895c33c9d9b508

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
808fd69ab809ab77a8962fbcb2cd97f9

SHA1
1cc61389b521b786253bf5ded53d2459257dfe30

SHA256
ad188a55a22c58586a0b8da1366cfb28fd4d6cc02ae29793e6956d0288b439b7

SHA512
0715e4d3627cf6034ef82621e85e298bf68c408dbae6e716a758bbc07fc5d65bc050b778791ad7eaab94d5c8cb996691ef155dc779d6529898979558fd0503a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93cf95a558e428e218273cffc2daa654

SHA1
1046330498f2527bcde43d99edcb34f4bcbf35d4

SHA256
a4cf1ebc2bfd2748097c8b32c52a0b2acfea845d6e3dd802784e9617efb5ec38

SHA512
aee5c39bc7add559e1316e1f29dc26eb6fdffc61172adfdbe1cbf62a69bcfb30539fa63f4c1694887d50b9af7b96b701f388afa36d7dbd5041fc8ed16880ac53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78c36bd6f80b3f3181ba76813e0d76c1

SHA1
e9f8a09cf5ac906238a70fce24d06023665f6afe

SHA256
f135ae426bb41a62414290848ddeb213a6c5d053f2a3a7cdc9ce2a4821f33c45

SHA512
4511341940e742537ff01861bd78c3b1efbdff27e267eb534ac36d2aa0c6af5c64d87ab9eb390102f2013f2090dc0be9503b22861b679e9c559d88f1b191e68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5084.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit