hxxp://google[.]com

Analysis

max time kernel
1561s
max time network
1561s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b02c0b0043da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410968883"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33B46B61-AEF3-11EE-832E-DECE4B73D784} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000570c2bfd8b11a1de5f047229b7e3e8965532e908f1bec97b2195de8c93d91fb9000000000e8000000002000020000000a5ed85c4d1e452fdbd68b57aaf3741769b8743fe77d8f8838bc336ff57378c8e200000008e7e31a2dcfbee735344310398a127e48beb0aeca9681a75a56ec0401011159740000000826bc25226ab5d8c57241a7ef53d3dac327f0886eebcb31c8accdc0005cd60520a5f490122910f81f8e2b8baeee0aa8e2f17978fc96a1ea95b9eac5499f48124	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d2aef5d5652e6d11c3d6d7f749dc6be43de4b94215cec3dd3bf6ce1619deaf59000000000e80000000020000200000003110e68dae869d29a18e3f775bcabd7cec9fcd4307b63b37bdb07d7289c016099000000045c7ddda74250b6eec19479396db7e80d377a7dc1374b4af53ec9ef4edaef0fd2dc8bd02f844d753bc85daf54cb20117921602fc456a80b8547468bbb162ed08463e853f1358a483babbb49ffcf415cb55e4d7c2e651ce0ddccde44431dbd616ab7ef1054b569b2a1895ae7080ff96fc497e54918b9a7ac5b054eef0d8c598413561653140b9bec6d05bf7bdfde8fedb4000000060b02cbbd7cccff9fd8a248291558d71f3e886d0eeea6c6409b80c15e37e0628327c6a62aa189fd0edfedea71d95a21fc3ed656daaacb3f4f2de06c20ac2c25b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1448	iexplore.exe
1448	iexplore.exe
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE
2192	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2192	1448	iexplore.exe	28
PID 1448 wrote to memory of 2192	1448	iexplore.exe	28
PID 1448 wrote to memory of 2192	1448	iexplore.exe	28
PID 1448 wrote to memory of 2192	1448	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://google.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1f896f8af2d00f14312bff31f8c08e09

SHA1
bb448e4acec4198e5c74d19a666bba7e4b50df53

SHA256
1d21052008733b343e5a3055f416a2f34da3c1e26f00792b258f83217efcb01e

SHA512
93d8d10e3bc0af71e6f19515c91b629999dc1d083a6fdb78a680cbcf4284e05230446c59f073a386c500e68712a2d65c8a08591c0c0dde76765b509384973971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd697c840e3a0eba32b3f52343ffb09e

SHA1
521f0db3135ddb266e7fe28290de35df3df4e970

SHA256
7b333099ab6163f96505b6e8c803e54d6f721141162e49839755778d5bc67e5e

SHA512
2ec78e55026584ab34e97b5261c496a2bd329130eff97ffd5cb77f1e954733299e6ae3686212510b4031534ba7f1bdb18ce39bc8c543f774a091452b35293043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee8e937dcd3efc6da7b82bbb6c9abc88

SHA1
67565e0b09f70259d089f887507e394d59c50569

SHA256
c4cbb260412878549c35b9686355bb1932c33b19ba173b9c52c8323ccfa7f472

SHA512
e8c0239d6f1a0c5e1321f49bd6016586ae58f3ca8daf2e71c4f69a66bb8636952f84e41bd0ed344377955ba9393166900079a51138a135201d233b3e87034951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2ad7472b8e8cfb8926a1c2d41289fb

SHA1
3d48c35ec6f67b44a8ce94592b4267be7adf4f75

SHA256
b1f7b4574589856695f159a931e0b23468ad1cc790965d8880833b9c2c2e4726

SHA512
bf52cde713513104c1b4197c8e5399f3ab137771de2e269445cfa69c40016dd06c934b6f4a24596e1e1a2486c2c5399d5076793c58448c4451ce03999fb6752a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfdf2ea3fc70aec2ecd9d4a4d5e3a04d

SHA1
bcb37012ce6d7311a64109ec356a06cd9a688043

SHA256
dbf9d2579b6b15d0a99b035c7d76af1cebac1a9b1ed1afbc6d2a8126b7755f5b

SHA512
e46fc4163295a1f1d83dcf762d6faea30e3bec5c67d36e4e007c65078ad20404143400c8af242a7d09f6c59dee6eb33828312f9c14850b3adabcec3513cb9893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd20da66e99ad2da4e791f0fee2c8fe

SHA1
88794f09c2fc242e7f6f683fd003c3ad6868713a

SHA256
de4082962fe9f9feefea3dbd9b94c06d7e76161e9590fe7f3b576df13176abf4

SHA512
82cea6303ea13e7cca565801355a9dc90591323f95ae64daad2c46eef6c3635a73a832d9e46bee2abd1c3fd1ae77596677621909fb53943c6a896fad5067c2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bd57b5573d08ff8b8c88cc1ceac2798

SHA1
19bd9029a9311adeb9d8c6c3e02131a3d3c61c89

SHA256
f7b3069a3a179be73cfe422e962e6e74db319d040fb119f4ed3ea3ddeffe7295

SHA512
0105f90d4a65356f231716ff776b0e763ce2d6ce6c04c264ebce141752ae00f58991bcde548cc06028381ece96c94d4d551b361f42a5af221f0457eb50a74e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
872990968f97009efb3ec4cee205ea07

SHA1
40ed3beb87ceaea1abf498410f3307a9fb3ddc2b

SHA256
10eba1513f46563f520574a8317752ab0208b5eb4fb1567ac98f1423310bac35

SHA512
a0c29916328f236dff595fd8ede24b0dd7fac13f6d5c6b8ae3be536ed0826db2d29015ac8cb5ce2a9168fd3c0eb1e90b82564e3e5c4d75019b2bfdf1fbd90e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da343164fd1f982a403f323de30c4243

SHA1
62b6e715bd5f8c36a700d2092883ef15add785d0

SHA256
6989b7dd42004550af234d016c6b3e3ad6b918c9f44d07dc7ffc59fbe6108bef

SHA512
677ac4a03e4ba0ac51f0dff3c517bc884759bd0ef9dfc7327c9757717e5d0a251940e7d06528478e6c1d856688e8b96b7ae7d9123d753b71721c4735cc11ba6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8b0d5d01c99b90701f31f1b014b2ff5

SHA1
107ccb48c2e44a6ce6cfee29907e1e3cef7c0241

SHA256
d992a45620b05a4f49574582e21e2b590e5e24834ef7c4e7bbb388a856cf2175

SHA512
8debf595090022f7c19fedbf012257cad0f7daa83719635203a0eee767d2827c0eb7fb2d5f375b603beaadd7edaa319628fc454872ec3b02070808a254707ee3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eaf63768c6bea7f2746d59b523dab74

SHA1
b6baa5a21e3f4054c7082aaaec905a3aea9d4eab

SHA256
46edcc9de5c81a7fb1d0203e6bc64a51456c8798dec7fdd0d6f8db814886af34

SHA512
2f9d1147abc5cc765d64f0cdf85ab0c172106faf33b443ec127fcc36a19b5df8744367125a025752d5c92a8b5e1319eb8fc144bebc52796230abbf3f4f474ac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2febb4b8f257d4187bc764eecefdef

SHA1
68ddc13d6b469c0a4a9e195437a73a000f87c232

SHA256
a87293bc821610ffa6fd45f5703e3b3ccc7d07f5ba310dcfab145ccf58d48368

SHA512
7a7b8da98bb0194527504643d322ac4c7e56f92b7a8ac4d89772883d524588e0092dcb30d7994764aaf7f0745ac6ea73dea70e8c7af55862aff5acc918f3ff41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0c94801eb67a7d7f16a450b1b40317c

SHA1
47e15570af2db968d0d431da07fb928da9dc66f3

SHA256
35ae23a3ccae98dfea45f768f59e326f478e5b3d4f0202a284bf98a1fb15a6cf

SHA512
2f652999e515ed8beb8aa2d6b823c7649c9fb064a888f7ff037f09fe5413cb9942583c39067ef4c9e78b10fa5c646739477deb110aab2c5a8856dbe7c1cd73ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

Filesize
5KB

MD5
05fbfe698f700b0de1d8a0e80e2a641b

SHA1
f137962f421f6035ac3b1bf5b2c07c92af3cc41d

SHA256
240d7940b59bc1c20122fcf03ff64db6e0d3e4825e3ddbc75279680ddf3e03dc

SHA512
264eead1a465e18fc3ca65dd34d1ce89e98321170b3cdfc5ec2104e2ad83574d1d3988ef5ea91c03d7813a695eab93c560a5e47eac73c37bb51f517e06a9dd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4396.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4399.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit