hxxps://google[.]com

Analysis

max time kernel
118s
max time network
157s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000f0344af41606baba1f792df68001fffb7ec733d7e549a454a4736200fa68ed39000000000e8000000002000020000000a5f60231ed6314626f9805c027fc5354c92586537f1af6808b3233e1b4df00f720000000352a89e272d0a8d79c29d82afe89fa4e8ffb5ba101fdd2fff18754c5890735c640000000d60ea8b7d1ae546d1ce21fa3640ca2ecde90124cca1977f2a588c3dc0be4a33400e400bdc43270d65974bb3dc92e0e53fd6f1dc4092309cccb00a44c778b2132	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50aac3dfb165da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000e10b2e54ca45b179d0f1b3ff7879e3f49b3eaef64988f7c92945473e79df3602000000000e8000000002000020000000780bb4498f43c6266c3f08c5c03e857a61fd72830fb6318c36146fa7f8fcec1f90000000f1d4ec8878a7df7af156eaece010acd7f884ac2da895491d71fda594bde6df162c7859ec8f88d6226dc5a06cc9f439d29942323796d6d0f2f63ff2983170e91ad478a4af0662647e8bc9de09f5ef662b259fcd8fe0e5fda34b1141da9ffb94bbbf85adc0f4c202b97292c2f9b57f7655004712b65b841f5083a4099bd8a087dda7293677ef9fac2fd379d25019c977f140000000027478c732dd26989ef4e8dc3d2f2e26c6d63abbff16475bc3ccf107c5b41e333ce4e7511a162560d9db2e638f77c3621385f356b9cc421842a47a3d39b6baa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0936F631-D1A5-11EE-ADFB-52C7B7C5B073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "25"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "25"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2888	IEXPLORE.EXE
2888	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2888	2852	iexplore.exe	28
PID 2852 wrote to memory of 2888	2852	iexplore.exe	28
PID 2852 wrote to memory of 2888	2852	iexplore.exe	28
PID 2852 wrote to memory of 2888	2852	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://google.com
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd5c982c4419600358dd65e89d406fa8

SHA1
af3ee461efb9146cd8b38a8300dfd93b41bb7e77

SHA256
1ef00a087e50cb0c34dfff9b8f57799aec28ed7d2fb75e62340d67a9bf9e09b1

SHA512
695109722fdbdc35bf1345e79f843ed08d55172f58558ee13f119cd068e00f40a04afc69284cb159c2e73e544eafccade33c5db0cd0e3c021eed22caca2378c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1974dfdbddeb7d83382ae08170aa5e50

SHA1
0175d52c3b0fbe85085533199832175d1664638a

SHA256
e01dd90193fc78c2b050a9830ceda471ada69b1b2ca06d11b6b7eba7f032001a

SHA512
33c85012c432555b7eefb81d339ca7d28655a1b3f5de489b52b69a32d8845003b3c79d35ffd4fe1055963e7c45d0ef92e5a28fd1cd138009ed4f9e17c86aaebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25db1abde76fa96da9da25664da4f940

SHA1
c6e631e571ddbd38096bf28e6019b05c4e6f8984

SHA256
5adf89e97981bfc874e19b78239040b9a4447984d3b2a583596ab5ab5af91df4

SHA512
5ada017455737dcc9c5316d8f77653e4faed26effc89fd0d70d61142bb9620d7c69f1ebb88f40b6bb2e53150ba27e941fcca3e0e9fc83f658e0816212f157585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b20f47eb1a4db1f7f7fbb11337b9d34

SHA1
54fe3758c45092f1f27c45e7a9585ecf53412e42

SHA256
afb080124897b0e18a860a0c482eb1d9f3f591e3932358c2aefd7ab2a00cc4ec

SHA512
3f7ac48b8e93e2de13bd6b6f3239d46e0d8543d1bc922e90d49f2cb1312abd0fda6e818ffee42edfa631e771e573e463915ea245c59e26ce5cc0fa252a9491ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3cd24a39a11eef668da17ebe31ef3cf

SHA1
d5f572c1ce7605ca91977399b5278f3b9a97897d

SHA256
05eba3aebb4efbc499b0c5990c1eafc4918f2b29f0575119d17835f5edfd0dc5

SHA512
6aff40912d1e222f48b47ade029101966061adb65ed85229fdef65ba05aa054f9c6e6f36a595edcc9928ccb4999d70a2a6aaa3c29f0c78c83d7f8e2248255b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60e4b2786ff12fae4a10c0ecbe16b461

SHA1
02bbc4c7cfa4d9e1296c2b8d352e1d190748a58c

SHA256
6d1ca99a195fff05201fe492860c9460a5f17126c4de537b77513721bd98c47e

SHA512
ce0386f9598a170b2ef8df7cb4d2d618a7661fbc52cb4d80776530cdd58d889825129bd4f061807a489426fa9c7182b804c2d809055e4e370231e6d8f5d4ca55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13b55234291a7abd8e90c4a4229f76a0

SHA1
7bd5d16ea8ab165045493b6ca982f06e0594ed89

SHA256
903364f08b9457993bc7fd9f3feaea7614124db912adbe5e9d7ca584b1349099

SHA512
d662e2008ecb47a97fe7f59b78016fb79ecfed8d8f12bac4cabb50f72f78181fc9cbf3e89ea01ed9d9d0a7965c2493b9e97689f587fa4adbf722957027ef8ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dcc047c4a6071086af3e6077d8086607

SHA1
1ce8e808142d7f6fccae56e3aa6afb844642de4a

SHA256
a6d3d16fe7f9314d1064f59cd3db26ae95c5fed494e178db94a11d71fe2edde1

SHA512
f5624c0f61ad1693f40fcbfc9b708a515f9645fd0b3adb29851c4b68a7ca671f71736a1264604fe1a980457487866111cf1b1a046a5de4f90ff133d032a9271e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c19199a06efeb14ec92dd54293bd25fc

SHA1
a8a5d39b7d8cb36c5a0b367738c30db798acaf8c

SHA256
ca9f2e027fc334cc19b882b42b95d69c9099f136b12f6a1707772edd7c63a1af

SHA512
f8aa33c0276a62097a371d46bf6e7325f90203643d31529935d1ef659c8532985d9daf261211b8ac9d6f5874f17949809a75577d4ed05f291385632ea53698ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4452fe5ecb5f5a8a8f9feef43bbdfcd

SHA1
a7eb8e5caf011e20c7f14baa24c92574cef3b8a9

SHA256
de564527cca9738bc27120d2d91bb40adc5507befdf24d846b7d3c4235e18a39

SHA512
8997977da83a84901a5570c7a098795650f068bfb6f6cdbf09245052f64937b17f46da62af87af36beb869572cfa2609ac9db75891e02cdda838928fb6c62127

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c4e3b06b5349e3f99983654ac47e9a5

SHA1
fa31fc5b0473e9aba72e51a17da29be2c59c6ae7

SHA256
8b0e02b63ed2a90c3c80017c79ceedf9209705375ed25e589299ae9739611419

SHA512
888e28b12824f0cf3ff9b545788ce6fda0aab1f381364d435a76ec9827f63df9f81b72bb1042e2a50d1d2aa9835eb3caf6677b3e0ca55f2e84683477554ef569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1b06e59bfc52edaaee1812a301f819d

SHA1
b1e4ce5ef23d5f0b5f82d4fa682d7256f9ce987b

SHA256
8ebb7c4594556453d2f9f5bd64b27e504e32010712bab770a0db0d46114bcc04

SHA512
702a0db5fb83705aee8616f4a587e665425955ddea16f72f478284f7ddcc2e8bd90a26b213c5a6034f01539d1af36d3ee1ab819e77228ce87f911184b769be01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\WUHLO9XQ\www.google[1].xml

Filesize
99B

MD5
15e7b0c33b07c4d4525c2bfaa783458a

SHA1
0db1b81d9c3c2934570ea64874f754fb131c92ee

SHA256
23a1404f4ec4d36037d40eaecf1bf877c223236e8762afa5a676ba90018c6445

SHA512
8b3f491c21875d86974be0d75631da0c374984389ac7e6068681714a6ffdd042c90d6a16abd4b129b1a4fb9dd7faa019ae124540bfe463057daa489cb33ad4e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\l63kubb\imagestore.dat

Filesize
5KB

MD5
0c509f7eb193b199117e0d72f351bca4

SHA1
c3d023bcd242ffb6a2c3c3534063d714dbd03398

SHA256
1034576ecb64d4643cddeb81750c2e6b1815f9661f39bfa486b2660aeb9a66ec

SHA512
9decf4a7aac8054ac026bd90178d3ef7f0431910ffcadb4fcd905619c0a0db04c0a0c331184a5401f1e3266d53c7528447161312dbaa0a2df2858b579a8cdc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K224YIDM\recaptcha__en[1].js

Filesize
491KB

MD5
3e528c5bd4e8985f914f84bc5f86df5f

SHA1
34104ea645a6789dd9cb58c264e20ed6855ea1de

SHA256
e51e616d124133b0fb24968469097a4d311b972f78455143d940703ea0639ba6

SHA512
c59a1d40f649446f33ff0ff3fa9a8e997d3cff10f968d35226ba08bb91c9013ae937460cf2dab0888848abe1b693d4377fbd6904e3e03360b15035a8c3e9bc97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LF4IFORF\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D1D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D3F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit