hxxp://app[.]documentoffice[.]club

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://app.documentoffice.club

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c6ed8b7852da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E605EB1-BE6B-11EE-A80E-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000004235adef89e826ef2b4c65994c5a3c1e7ff4c114d1a5f59fd6cb3bf8bdc3b68000000000e8000000002000020000000426912f46c7fb678ed6c03748a414dc6006912d8ec36a62a6e4b94c54650e5992000000077448ca2cecca911f4736ba72048ad05f303c97dc0b189c3b5547c13aaae58ce400000003bb496b4dbd7d2dc2d379f215ceb11f12cba1fb7ab05a830067013281a0324369408b8e8303988c5a7e34e6b5bb5169b08c22e471559a36153de5049ec463dd3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412669859"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006ed1de32aab8eaaf80c631dbcbaca271bef78b245ff46686286b329ab6aae5b0000000000e80000000020000200000002bedc81935ea766225163ca033ee9642edd7a7c0430062ded3f66e3c7a2bf0d890000000f0673390f80ff3f52eb86da71314859da36ed681464f5b64fba98a0b169489d6061a01311a2c2946fb716905902cef58866287a200e9572945eed0b4201d44a19775c154442bc217913685e16d6ac32687060458e9c199ea491a2f864d4d74ccf324b9ebdbf866bcb3a537e898f452de0c7855f1b19631086bea142a76e28a4d360e7d196264d5ac049f03975cfd4d74400000002ff0e0bc644be9c109bd5b11edb17a5df8139abd9d8479484ef7eb9df5cc57a3d0c24112ea8a94ff1e6104eefb6ca80131ffb67a512753945cf0e4670068be8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2672	2148	iexplore.exe	15
PID 2148 wrote to memory of 2672	2148	iexplore.exe	15
PID 2148 wrote to memory of 2672	2148	iexplore.exe	15
PID 2148 wrote to memory of 2672	2148	iexplore.exe	15

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://app.documentoffice.club
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb3309fce954cf1d03317003562f1a4f

SHA1
60b9a8aa7348bb337dcd73dee8ed8b30e884ee5d

SHA256
0329705c32821031af71c6eb49da90a06a01894b7ff9ded0abfeceaa2e6995b4

SHA512
bad09d8422b856e28e7ec2e2d3180a259eacb7941fce30b5f7f4ec98779343c110879d653a1a3d070d565a0174f90dcc80b81c8efd526fa52d588c4f33650dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb152409955fa3c2c1f73e82994287df

SHA1
10c339ebccc1cf830061bf5010cb84fa2480e30c

SHA256
15253a85e2f95add4298ebe70fdfb2f801ddf0cb3a2abb572fbf10a8aca6630d

SHA512
47586e7c8d3d2c4a0fecc793561d7763dd6e45243d0dfeee2fe111a60dd037d75fb2e037c3b20d51250aa430d925aa7419ccaf7d6dbf843b0026498ac5b330f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6168d7c7a0b73f9ce59b34d47cfee79

SHA1
96a53cef9f3f8eef99026ed1fc30440943e1e07b

SHA256
72648f24c2393f95fc87d615031fc4874ddeccea42580a144183a258baa19dbc

SHA512
6f60ae57049d9c5d6580a68a0a12d36cc5ff338c52791474e6b0fd8b2ef53b22ecaaae9364225a022a99372be9f3af4d9af37910ee51a405c1dc595f1019cc91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a92392c52a56b893ea99b8f0e0a854b2

SHA1
eb6b729e541ae297df7046a961299eb527440bb8

SHA256
ff9c61a5c406c4e1659346f4784dd837ddf4062556b4dcd8a457c33bf131a2f1

SHA512
48bd62e11b06aae8d5b78ff838564f89ebc1d238051e750d3c7289f50ae184d2c5587851ec8082c203cae5682d9726c611f1560919f93fa657acdddf39f4f0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ea2ef354541972fee4124e68d6559c3

SHA1
8c1b87a1d6085ae5f046237d13f1f29bf9928cb7

SHA256
b16bf5af70533066c31c0af0880a094468d952398319b20f6a646a99502ac934

SHA512
c12efdad4bc7a247850295d6d4aa3b71b858133892207a7d112d1b7e7a95753e957433ddc4f63be3d97a663df31ff7962b3a54e70adef7841bc6937b32fbaa70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75aa59b80be6b0c828ac064fe19c1c69

SHA1
af670f3af2400ca9afd10fa48011c3bda0fa275c

SHA256
71939a57d4958930bdf3302081632b8dadc4bb5d344e654ce32591bad14e770e

SHA512
227b4aa3da2d7993d49cb9dec1008f4b5bdbe6e5cfd174195bda6790f7dba65160da32106e63bff81808fca9af63bc20d7d49e2dd1ac6f08e1953b6dbcdfa345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c76b5881b4748d23011ea3f112932133

SHA1
a10d4f211a371b61885566fd503744338645d42f

SHA256
597badba4d47e36800ae859e5769e90e04eadf71d766d51c2a1bda0a1ac4700b

SHA512
6cffd519de74cabf02a9db3b7a2942ae715688df7f5fdbab3154d4467a5fdef1592629216667384ba199f82bffc3a7fda3dfca48458c4dc63154c0dc7825b273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e3f06a5d79c36896844c0bca7b34323d

SHA1
834219ddff10e6595eeb898df10e2ac80a2cb2d2

SHA256
bff1f883eb6766b24f476ba29cd1bc6a3c0e23fbe80321c20a15379c331b9849

SHA512
f7ff1cac2e96c54aa096a362457f6c31f6b63edfc0d71493101a50b1e490c0dc93a038d29419192e71293c058be3e8893c0b0d1c50c6d2955ea2beeb0437fd4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a041be5191b4fdca807c06ef1597b844

SHA1
7726b12b12e52bcf0e18f552e86bab536cde7e71

SHA256
b95bc0d18d33044b1cc0318c0b7d89d5d08eaf30b8a21bc1f2f428111ee51908

SHA512
c9a10ca4a5fe14064cd172e8b8568da48a7379f215e6c0d00a4b1ddbe9ae232fb5c858f4f138ff4e7102be59e2a8008528baadd4f9f0b4708d20158ece5ad96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
018f1ada42f69dfcb4b1aa9be9c381a0

SHA1
c44f3c7001acd14541a11a738b807582111fcd60

SHA256
3ceaaf564117aafad86680550713dfd402d99a014bcce8191007379debc50e66

SHA512
a848d936d03b7ca324ee6749ded13b246b8f45fea57456f417335ebf68a54b3ef16858eee24b14816aff98829d3d6c1a4806873f9a0b38fbc76f89f776e08d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c94c28e38aee71d628fc428f91b3321

SHA1
eb23dbc85525a333b6d60203baaacaf678af3446

SHA256
0e6b68307c192907f4ee3b7a61249bdac9c74cef718824fda814e78aa84dc196

SHA512
41ab08727963ed8474ad7eac90dcaee1e1e31eec8826fef00d09e0a054342a5db5fad2e72c222fea38d2f845e6494cc7bceb18f17c4da60fa15320b3c8b1a7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64d268c5b603f557ad39c68899d9bb53

SHA1
3373ce01edd4009126f8df88f237ca77041de860

SHA256
55c296711ebc422aae51df06f231860dd3b47fede10fe5fabc20b482463565e4

SHA512
ce90c134361984316f4a0098f08fe620b5425b7942f15c70280394d242a8dc0512f2ca467483cb9863361aa2b567f9a84dedaad74a673ec4c01f20612ad53b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
347cd52ca00632639c1cbfcfb079d4e5

SHA1
42012647a704f068960a250466b32b9b054f42f3

SHA256
009cf47b8e2d57e4300106f099abf393e1572e6c2a95c231291025156bf50b3a

SHA512
518a513012abfa63eb292ebd8cbb0f209c871b092416f09a54bd21294805b7a5760529b512bc87501255d5a46417aa9b5b090fb06d7943c69df9d8e89c4f9e7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4126a6329cbfccba68459e05e3edb8d1

SHA1
b0e58f5e589fffd548ce81056f98b28a6834bfef

SHA256
1caf5d695d82a6ac9ecb0048587cec54fa91caec75e69c0c057894e52e69001d

SHA512
bcb5bc5a63097c5a0b53d69ca6fcffc6970e7dbe3f1b3c2394c46ef4427306b409b1bb892d0e6f6f352c4653e5ae47d70f3e562814648122d0a99a5cf37db81c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b872686c98c54fc51e53335d99d93b69

SHA1
eed384f635decff75be444828bd6c5ee65f809dd

SHA256
b95a96a59832c5eb466ae766e164a9a7bb3d7099a6f90ab86a95965a2274b3ab

SHA512
fea6f9f35c602097e33738c53067125ddefa196768eebc14643071de691d9b6f767f97ada0d25769c70786d212758668cce7ad77dc67f7e3d0325b17d8db6bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb025890d10e845b49112c474b749311

SHA1
420da6e2fffe403f36cb14cd2e3aa7d9c02b8cc1

SHA256
4411f1f3ecc76d10763ca9e93c2c9992c099f6ed9ab5151d90a958a3842845f6

SHA512
12e79695bc9c99f8472895b569b8fff2d3cb2454ea323522935ec5d3baf719eb4a46a4cdf110ba33c4d88f9a321e6918af335aadd1348dcfd22c8a168e098897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccde3b7e384b337002a2b88ae147b6a5

SHA1
53f512fa3bf792026cc6084966e531b61d89d7c0

SHA256
3d699372a55ee752328ee2fed55d234b51283782ae04ee4479b42559d65648a1

SHA512
9131db29d0596b79629ded26734bf65cf0538356fddc4bd8a98ea51d7c30ea5e0b63676f61de869f528f9f517abde7494d2f277b9710d20d80fdf47da464fbb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcf451d3c687f1e586bbcc518ce8c33d

SHA1
99df3d33edba9de93f21a6b96744890735dde423

SHA256
7127fa9fe7eaf98b74124f1ea3677cd74f005d95177b0a2a722dcd21b9b1db53

SHA512
fd3729ad7990e12aa94c1b3f12891bff638cc2648a625f005ec81dadd11e284e87ab94cd756fcfac1743830731c109be987d8d451ffc681b4bf42bddd0f00523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd1c94f966d0cbe5f7fc03befdca3ed0

SHA1
61648c441794ef8f9879253f1bdd25a87b0505a7

SHA256
0a6e5252559b39a0b88d130d85541dbed36f2f789b978577052136ecb539a72b

SHA512
878808fbc4056539fd67ac1f840b42e608673a9cccf24870c3373f7274f406a5a08908acefab447e939521466c8873c768dd537b6f575c69fb5bb643ba343021

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD5F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCDEF.tmp

Filesize
146KB

MD5
14b3065bb3cdf235c5fb3c0e0b221706

SHA1
fd5ab5a448b7fb7695328d13b879d1d800871634

SHA256
894b75deacc5b7b9fdc128ccef41612bd941f2a914e03b4928ac9037f381485f

SHA512
31642022a04a8dd01d42d9aab4c8c09438bd103ba7a85620d8a9a032342e364fff57f56047472dcdda5fc80521ac3ff4c0b6275a6fc91875e2c40c9041716186

Download Submit