Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://youtube.com
Resource
win7-20231215-en
General
-
Target
http://youtube.com
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d404f1a34fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BA67671-BB97-11EE-9E34-CE9B5D0C5DE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000ff0825748bbbd1491fa9074048181e2f8caab4c65ac475dbf490b13497b1c357000000000e8000000002000020000000a04eecc97a06059ca3273fed17a64cb0ffe48e82f1bd363a38b6c893930ef8969000000015f4a42e6fc46d3fb72fb7a99694bd978466353d5543e14fe896f49b13245b00e08e8f6c2664641a417b908367de2f1d7ba2634b173c6873ea34523a3697713d2a5d03de75a8024af31cc9b542e227bdb6f36f0e71b53becb90a8fdf772ab43c2baf0137342850e2c510b50c6bbcfb3f93093ab4ce864a33676df9d520379f900866d24d8cbf2d2310b5cab81a11cc5c40000000e276e9ceda371858272469f7a9c81336cef79d8bf333a5264834c51aa27f682821c994011e2076cd3925d5674d19f3cf570e4e1b91f89873cb4058f5523d1e8e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008d44e2bbf114545bf6f986f2350ade2354d8ba20bc29ae33f5d4595870f6614e000000000e8000000002000020000000d7b0f946a44c3c13e985a0ac41be0040cdf9772ac4488ccbac83fc12f1912ec820000000bd267422e362aa5ad87bfbf053172f38e80da6d3394a6ab7fda0b9b3bc5977cc40000000515260e9775e344070741495e35e699c27aa3097216bbcc161fff7bd22e5a69697ebeb2b7dd2ba915733b400b89ea7b563a9fe42d4a712b9fda153143a4fb0fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2128 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2128 iexplore.exe 2128 iexplore.exe 2108 IEXPLORE.EXE 2108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2128 wrote to memory of 2108 2128 iexplore.exe IEXPLORE.EXE PID 2128 wrote to memory of 2108 2128 iexplore.exe IEXPLORE.EXE PID 2128 wrote to memory of 2108 2128 iexplore.exe IEXPLORE.EXE PID 2128 wrote to memory of 2108 2128 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://youtube.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c6c794c48273f93ea71118f0af9d5693
SHA1c0aa34f819e8a93b1e6b50d161e385295838ccf9
SHA2566e77f5c00501af308f8efc5897f45d06059e960453def24b16326db29f896718
SHA512a3f7cb3d372bdf2ee1bf23269a9862f21aa0393b902bd1822509226a78a69eda4b8e4d8a56441eb6a79cac9d71c8a3be8d6225853b32c8737d5a338efddce60c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a4eb3281531921976a063cbdbff4bc5e
SHA1e11c8af4224cc82a0bcdbdb8e98d8b08a0c88da1
SHA256f3d5786c59d39fc4aa0e1c0f22d186008a3a0dede1f17c0602506c2bd986b93a
SHA512acf45238d6d956b6245453abbca6edfdffb1009cc46fe74986b7c2604ea5490f6d35f15f9d4b9d6e6ce9f23ecd4b728a3f755c5fa95ec611f380ff3102634754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51cc2e574f656ebd8dbe5e10e29e9a611
SHA13e843fbcb1d923772d58b609f0bb2a821c5322bf
SHA256cf3632df72450b46724ea724a5a1fcd67352a872ad131a03eaaae8172a3622fb
SHA512eabac66ffc37cead1f63da2ec6a46d5831ec020b1cc9d739a52700ea8c12c557275568bbead77868afe67454326c71021a1799508c688470b6995ba51675c822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD526ff1c0eb8d4f74b1c7e07b3da4e975e
SHA1ee64739734de765acd2a34717b6476f356e2c6d2
SHA256f7ef1ce1660725001f1f549ea9630d3b758799b19ab4eeb81fe4b974df03c065
SHA512d6719a4c641a1a06b8c3b9a15d6c07b5f981e4b2744908e40c0e042ba6ed21dfd95a71f186ac27866f5cc16976a96608bc1af5ccaf406a5e91c42e7411479928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a5a003678de43c6de9ae1e76b8c2acd5
SHA1ec9d88791eb021befbb9e1f7bb6a835a5df83ebb
SHA25607beb4379be294e5a125c49310413e1a53a321849c5ea8db27829db335b34da5
SHA5125df11538d68ab4c4c55c35649c25b95004d07fd48daaebeda8b793d8627babc4dcb4efc73e1b1e528cb05aa975a49029a9a53286da5fa8ce9b3332080480289f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54139ce3b3ae863eb19ff7859b1a9b20d
SHA11bfbb0eced10a78ad3909eda927eeb69bc4cdece
SHA256605c69e214751b7a937495ee88bfa5cb1e44941094c20978a56afc28f67e6f19
SHA5120f4df61dcbac7480983a86859c33784776cbf5e7878eda9c5574416c1c784daa92c983f2627a5a72e7554ff7ce695ddf570a00fef4e0e0445a9a162ff0879eda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a76c0f82e9daeb55b351462915171b34
SHA11355e91731789d7304437d1376e3d9d0383f845f
SHA25612012c58526e965f293727256a5841cf7d1c65b3c5045f3aa577b1d425807af2
SHA51200f07d6894c84c50afd202e34d3124196435654df1b71f9f1cdbefb658a09f1256b2287b7d0dec5ea6b94a163039787c6c01858790e81915d014edbd7a852e52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e233eaa5b1357947c26de6b4a12aafbd
SHA1c0e5e7727447c294e9289bcadc3b0e38b825d2c6
SHA25663340aaeff53390f9972de6983a68516ddd94bbb2ad2ceb4bc74b70da56e6044
SHA512404892a67e47827fab6bd6c32aa2a03756f5010b2254e262aeeea8cf88e3d21623f18b39910956398c7de05c6345ddc18c5f05734c5e1730a59750abcaa1635a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD521f863cbec662bfb59973337ced6f9ac
SHA1a0624a6e547ea7c79d2ed49a0fbbb14f960a7c51
SHA256739d0c5d67a86162a0a3d01cb775599448e1eba50635330300620ad9876c6ba8
SHA512de6124fa3e7ab9eb987c64a3607d01d49bc02302aa27f66d007ab4a36a20f7327cfd35aa825ebee4ee1c67e2b4f6eb02956a1683ea9f1beb05cd87ba912062a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54c6eb67f4515d76a8c111cd4e6231728
SHA1d064d9c86e91126f2c3344691bcaec0d8969914f
SHA256289ff2e3966003afb78ccdd4bb6e2feaac2fb5fd5209ec8c27801453f62a9705
SHA51243d5ac6d63dcc2d287746106099f7d86b578efd03e433d9d57caff8274b2ef1291c687a21c188fcb969cbf9c19731fbf381251c9eb5f47971478ba2917e158b6
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.datFilesize
1KB
MD5f5c0d5787b9cd5f1c55713c54ad8661b
SHA113c26f587d29483ac2d47a310e0ebb3695bc6dbc
SHA256c4d1c4adc1061bd0f4e6496aabfa458884ec6fd77c32f39794836757081f5225
SHA5120a3f90e970a5b4810a5d310e239f797f6b8ef739a44bf736a5667583827b72ef655fe94baffc3d5cae4afb27650c4b08e7290cc22122c6c5d91aa1206f9f7749
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\05ZIV8W0\favicon[2].icoFilesize
1KB
MD5f2a495d85735b9a0ac65deb19c129985
SHA1f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
SHA2568bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
SHA5126ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b
-
C:\Users\Admin\AppData\Local\Temp\Cab345B.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar345D.tmpFilesize
103KB
MD5ff49e2eb065eadca69b00510ad17e707
SHA1d9746faca974c5a3fd121f25caf2f97181d8fb3d
SHA256a0e2f11722975fe55fb2981744d79f2b25588537b3df834b4ad7c965d9fdbf43
SHA512c183e7b346a30d54bbdd87dc2c476d9644b17c01d5c59a5e2ff6d39ce0c77ac155c96f1cba38a4e14df17da32e41430e9d66a24f5aeffd63430739fbda7c3220