hxxps://dzbush944b[.]storage[.]googleapis[.]com/dzbush944b-u#un/66751_md/9/77260/575/11956/2117328

Analysis

max time kernel
0s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dzbush944b.storage.googleapis.com/dzbush944b-u#un/66751_md/9/77260/575/11956/2117328

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE054511-AF08-11EE-9FFF-CEEF1DCBEAFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1812	2928	iexplore.exe	15
PID 2928 wrote to memory of 1812	2928	iexplore.exe	15
PID 2928 wrote to memory of 1812	2928	iexplore.exe	15
PID 2928 wrote to memory of 1812	2928	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dzbush944b.storage.googleapis.com/dzbush944b-u#un/66751_md/9/77260/575/11956/2117328
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dc1ff08307da1bc665f2d2efd00d5fc

SHA1
f3c24ad6b9ca9eeab7f91dfbc2a4ea03c046e16e

SHA256
9b633f76840f50a7d26104386d1852112d74cea163b01b21b3562d299cc6ff29

SHA512
9ba775519b30857fb957796b1343ec041008f5da3f556409f936a3817dcc14a62cecdfc1a01b378e8e2054fb257ff77aebf579d17f80486500989a7f75403c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b16bdafd94771b6715eb4b044762e525

SHA1
4d4d26a86079c55ddde232d68b8e64dde8fc2b80

SHA256
6317a1791108f3a61eeaf2f5e9625b4e30a212ffafd62c83e2e6a8aad3a544c1

SHA512
6efb683b64b3872e460f6c15ca123d4ef56871112556ccc41574b561a614ac27bf441673244415f18a274228bab267d0873cac1dbea696ffdb86ef48e581318c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
10402d58ab5b62e58da571c2aa21f975

SHA1
715cf2a0a81ebe5c993eb1a8dfe9b364941ffcdf

SHA256
6cc8d2b9858a21f01337d6ff867811612a9f91992b947595bada1496d77a01cc

SHA512
292e19ed564111ee44411bb1ce0cabd728cbd21674e306bac91807e299c81b9ba463134cfbc71098e3cba6702cb2ce15ac7e32a1daa2db0fabada0703153f925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29e3f2cd214cf604062769ee64df24b

SHA1
7b9eeb21af6ef3fbd5becb6b6f2584f2bb8b149b

SHA256
4cef3662934c2ccf8fd5c4d7019de2f90034591e65f0e9df37776b5307e3ff16

SHA512
62abc090a5dec9ab62a270c1778e7a3ac1254dfe7b74424ea1f6eebccf1ace3d8b10314a4eb36c61bad7d0c10bd82949660acdb20c4416ef817b3b95eae7eeec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c27aeed9e4ed419e62d30e4c47cdbe8b

SHA1
072835e99a5946ee166ef7310db7c00614a93276

SHA256
f21571d8cd907333b8bfcd65fc46b5399b5eefa757a962f5b5f02126e5a1691f

SHA512
b7fc7d02f943c97f37a7680c849f4550bf45a380ea6fd54e33c854b16d786f03d25a6f9bede203d4d57950f50d1aa3ae88275b5a2cd642bf1d66c8a5d8a5b27c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
63b636835c55af885d40245927b54b8e

SHA1
9c9f6ec6d8ab808381723e348292b4c3e25f6679

SHA256
0bd265dcf127d1004d7f37965f2bdf4676953e22322f9234ad2afaf26ce97960

SHA512
a92117000bc66b7df6e0088945726cc390bc84215fb1fc7f71a99f367482afd9c711bd37f7cfad5e8e1c25725a03cf497a4d45b2776907c0ac2f71e762cc792b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aadb526b1128378a5df5dd759e385b5

SHA1
69db52817a27ec6e3dd5928c816f07e3139caeaa

SHA256
2675f656b3e6976e3e732bce2ce47702a6aee5fbaaf333c09cf7222b1ecf4509

SHA512
588c08c0edfd7111f50c4f255d0f3e41d990f9c90d67763b7f321ae377699bc5062d700228bfa35c49043a257448a3bfe66809e8094d00b85af986ad77dd4944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d644a1832e42f9b8b29b4c9ad30824c0

SHA1
a6e669c6ad2a89c83d8bea357f358c3286155fa6

SHA256
73e88802d037e2dc376ac0a86b1409536968eb16b37b4ecf4f3888bfda242020

SHA512
6772c34867e1b9b9b344e006e6688ef9a6a9a290bda762b983ac1e758d419e40e4ed592b5158a916cf38c4e7f5b3ce01087218a2e5cef477aea7fa24c66a53d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7c562629afc18965f3233ab46f54c539

SHA1
d34ea7db38dd260d9a7b1f0cbabeeae90103a1e0

SHA256
7cb57986ff91b9074b436e87b4e22a8645f9bee431951d28f1bea62859f34dac

SHA512
11d1ffb2e4ed1568d43f03d0f5b35b593147a0345bae40493b54b750574410ac7ac8cfa75dc0a5ad774ec6d997ec2bfa98d0da558af1fb047b4b81e39b1461ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d790f5c0013ecc3e2c25d0b1dc108f46

SHA1
ef958024436c73fcd2640d7304aaee4287df37be

SHA256
3d24ba733c307f1952b13d429bca8c5fe94acf941161025b7a3755f3c2716221

SHA512
280b0febca06eced0e7ae85259690bffdef6bee3b47efa7fe626acfa4e6be9ee81a0a6d205f1b19470766ca679354fe85bedd402a92240a46eb69a2c0c898c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D78.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D8B.tmp

Filesize
165KB

MD5
5046599ef721c2337e7d368f5ecb6a95

SHA1
e2d872863549d3927c0b52bc87160c5312197825

SHA256
272f03b261bd58ee90a34f94dfeedd5e7d760938a0cf44d458ece8f2251a4483

SHA512
13feb9e2ba906e8737e23c57517894169961e242c9378575279cb888555fb64797fd7ebe7a58f8b4b89918158ef5a08bce4c9d2b2e920fe655bf5f28aac67712

Download Submit