hxxps://www[.]youtube[.]com/

Analysis

max time kernel
49s
max time network
37s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85AD3F71-D237-11EE-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ead6a7201245605673439059a88aac80fbf7523a33b53bd8afb9057335084795000000000e8000000002000020000000b3fd4704419ba777b4e9af1ba1cfcfe38d18e5a3a05c7bce2b021b03af2a58a02000000052c74643c119f7ccc24ed1dc7a1f222aeb2c6720359487e26e0e34de85e52a2a40000000363a77e5685a297b6159c492fbc8cbb2a73c1f85613d52310b761c91398eed29c2c919666e3669293a7c2c3b9275805fb6735027f483ff66290577c70b6fd31e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000efd97b78421ad398a6cf178424b41e075f6fe174c909f02daa461be03db2976f000000000e8000000002000020000000f43373f951a7fffd33f9453cbf6d3f9ed123277801e0b3c8f914075c1293dc24900000008ca24e924259e3ab2b28094826c7839e763f48d7a28d1b38b9dd37020264d34bc6ffee47c7c41f86ea1f3b48858d02a9dcd62995980f3235c6e543ef7c98b1412120608bff0f984f9cb8f95c00ebad22988762199acc871cd401ab6f28a802778b2b7343cdf2b48cf213390f680f4439780193a847bf41296f71bbf79da127f55fc018c63162c17eacee4d6d3653fa5a40000000f9f6f697e8d0f5b7e60ffe1e58edb5dde78d5d80d86126fd5977923b05430c9e53f18a201c5b7bf89a12efd37a963934b2c8327d2bbdd4ee9b9cb9fece7bd621	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8012e15a4466da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2744	iexplore.exe
2744	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2080	2744	iexplore.exe	28
PID 2744 wrote to memory of 2080	2744	iexplore.exe	28
PID 2744 wrote to memory of 2080	2744	iexplore.exe	28
PID 2744 wrote to memory of 2080	2744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488302ac2c3341d5581d6e37631d2b63

SHA1
454aaffd2f97297e2f93c223b7e50d8bdc25a520

SHA256
34156a148a3f62b2d38b6cbcb32794a45eddac5b4bbbc82afa2fdc71d343aeb3

SHA512
ed7a67e2d823b7d9611de03ff21965c7edfee8771200b49ae6c122625925d40d1376762abc98776575e9de58c0e965943bb89d332fca6cc5f0a6df76e6ce8163

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f8a881405a291b974878b37368174b5

SHA1
befa43bf18dc940abd2ab573d23ee78a3e6244e5

SHA256
0ff585e18a9a11e55f54805e5da646275848472371bd46fcb8378e87ae51382d

SHA512
9716428774aa98c59503ddbd37aa246a796eba6fda2e48663ea6842742ed60d5ef9d942c45cceb70bb0d11222aafce4c9536a79ac3b599d74aee6d2dea7fcffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdcb93a0989b0ce7b51f4ec186e87ad1

SHA1
66e73124a295d388b008d0b937c2b13a19937253

SHA256
d5301c59943df29077505f18f2802193a751f248c48d6fc42ff5a418db19a0ec

SHA512
bf7e9c750f06ccd8979ac0c5049ab6336943102b9724272481efed012d4600574cd77f1ba115ced66524715ee8d3ea0383801bdb89892713e96ee699de169bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
054948a9fb526a98b0fad57f75f5af4a

SHA1
385158774564b2300e9c42338a373e1efd12a07c

SHA256
93c04a7af28fbd4f2592186482a8f8aca3dd0b668a2ab685c2002b9caa423007

SHA512
057edd34b45f8920dae9b49b827f0117a64b9c289263138fca0291e8a63ce83526febdf65dae65a22e1740f9f58b51f9edbdf84af211c62cdfdf520065667856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
26302e0cf894a2b3a76941b8a679fbd6

SHA1
de06bd9252fe8a6904b50f314b2b068a412e1bca

SHA256
6bd6ec29c1c3273cbaf06b74e647f6e6a5e7517c3f03af65784e2a86224007e4

SHA512
29b455634c13f0a61648bb13e4c4f4a13c131c5d36bc01ef8dd67c66d9fe5084bbc881a47b7d7546535210eb21b1ee8141fcd218d8742eeb61ec759ba11dfd3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1d5bf71230702737774b45e0e56718

SHA1
91c0dc02842ea330253eb67029460f979b5a20bd

SHA256
1d673c5016ea7499cac3709d74c46810dc15c4796353845c5aa48227a384455a

SHA512
63f7bbe57f7a5136cf68702ca38602d0a6a604fe11316acb7b967cd34a1b177533f61d8c9a46f477080d24e0dfe55d4bf8b8d719a9b90a7a3fc6a52ac526bf35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40c8783687db41fcb5fb4a9bb1f27641

SHA1
05a65e720ddc4a5e5d7a5aac6bf915a66f160681

SHA256
9fe3a9ca1d358d2457ef1ac0cb5e2697e8ff99d04c91d2941f12a7fde85f44cf

SHA512
f971f2c330708310c19b31c8002e29c0b2f02b4ecd896d14e7172de6bd7193338027de38f5299c3171061cebf3ff6219418c3f8a6e434de8e33cb7b9c32f5899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4682cd4d3361e1e6ededad6ef9363470

SHA1
daa7efbc265d7928c55f95574735a5f0cd6ae599

SHA256
e8e384cb1e8d18b52c9093d0638a85b470c409ac0c8b347f9f094362ae669972

SHA512
340997a73af310be067dc0ce6a32eaec5558b5f0e8930451a3446d8a03b81ca4b5fbb42c3ddcf90aa5b3b7a940880dba8812a8ccd786823beb5c916806114ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd86d00aabdabae8332e8aa89bddee4

SHA1
05bd3d9861c090aae974d226a3963e9f110d90cf

SHA256
e6c178b19ed4ce9e029452681a4d98570605cc172bf72d778f5c7b09167c73d1

SHA512
37b0931759b3bd772c4d148c7c7b8ce586388eccdff213cd74299730bc6156a9771cccdd8da1899c4c4e66338e18e516bc92bb2d961b5f40da8c199acf440ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69e80daf08a5978323666e8afed1eb1e

SHA1
8e094763efa415ef353d067a035676eb1acd51a6

SHA256
af096a3cd641e4304792e56153ca220abfb819d58421e34d19789f5e4802c4ab

SHA512
ac076a2db489592f305e25e704380e2214996c2f47e28c41842adca8f044944e17a619824eca1f5399e5a2aca88fdf0799eb6e4e7e0842bef83927f308850577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\92bocja\imagestore.dat

Filesize
1KB

MD5
6d396e1b37fdcb1734be6486be1c457f

SHA1
f8f8fbb607176ef8c4b35763f806d6c228b5604e

SHA256
4ad4d1fc5aacdcdc90ba9e0eb5a5c65e281109cce4b566f3faec1a06d1ded6c6

SHA512
eea7fbeadc97d2873f51fb02669f190278a19d50c24d91d7fbeab08a3ec982cc22788232c4b5024124ad20e7cc008f2187f0e57e3fb0cb86d1c4d2a5945153f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\favicon[1].ico

Filesize
1KB

MD5
f2a495d85735b9a0ac65deb19c129985

SHA1
f2e22853e5da3e1017d5e1e319eeefe4f622e8c8

SHA256
8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d

SHA512
6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC04.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2502.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DFC192D40DA057528B.TMP

Filesize
16KB

MD5
899bbe6ce66cb5a755a5a71c24d15a0c

SHA1
0e9a4bba4cb865d71198bbff2e291b3177d42d5f

SHA256
a06e388f0482dd0e8605120f53fe165ccc4cb18d7febc56feebf4f46aba4debc

SHA512
b460e9dd749c5f786b7eb9e9d8d79a05da77f2d8c636d7c931cbdb31bf18a930bec0486395915bcfd3d185fe3e136918d45e1c1c00e558d30085259c6810cc33

Download Submit