hxxps://reviewdetailstax000[.]site/MyGov/index[.]html

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://reviewdetailstax000.site/MyGov/index.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417590305"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005622c1387fda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b2000000000200000000001066000000010000200000004c87b2f04ccdd1ea4110f9876e7842b098f44dde836e7ea03710f6d291052356000000000e8000000002000020000000b1d561217876be54ff0f979608dda66b8c471c1b860bfbb3b25f0af2ac87a7d920000000eb3ef4b9515eeaaa7b505e589b00f9196cca2c3101260a765faf22d91727319240000000fd122b10b336c6fea53256d03be1ec86ea0a87fe73bd38694a2766067c0f5768c2021531f6a87cdccdd64cfefa7d2e3d9f268c8f7aa5ccc3af21a2e84f4062dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EACC2301-EB2B-11EE-B55D-7659DA376B3D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a529a2e22ae42f4084bf8a2f7b0415b200000000020000000000106600000001000020000000a224633ab64bad826fbff0dc191a02ac0680c62723964538354d4ac590e2a345000000000e8000000002000020000000c4629d5522d161c6d719d3c7f32b0fbc38ebd36c36c3b1a0e36d2345b902cdbd90000000d8bbaad51546746464cbb1a806e493b4d359c951abd090c339063c9d545a9aea06c8becc1fe1e125c759c0e5c54baa031cf5bd9663fd0d79ab72b06b48f87bc42c0bff366111dfdec2eb2b7b77beb7b11fd12c996f59e0107c67ee8a976539f6d471a842c598c1becafb1d55c6872bca8344feb33120dd2ce887ea75e9416ccae3b04919a3d737477d71a391ba2074644000000057c33e7cf402281472c020a1b6850c0a2f0c22e93f292cf5ab1018e610a46ddc0abb6af2039cc10f0824eb47fe476c8dbc16db2876b0b2cceee4b28f3066aec1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2172	1932	iexplore.exe	28
PID 1932 wrote to memory of 2172	1932	iexplore.exe	28
PID 1932 wrote to memory of 2172	1932	iexplore.exe	28
PID 1932 wrote to memory of 2172	1932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://reviewdetailstax000.site/MyGov/index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac8b016b5a31ab51ac557eb166f715b9

SHA1
e90a2a453c7a08b5161259a9cb1de173b2ab82de

SHA256
2d240b4168a198849dadd4adec13843fcdabdede2d5499674e1748110131501b

SHA512
fd166e120cd08e85b71b99401f7f3792b1676aa949f87fe417940a605c4e90b2fbc4082675be021cd219970641c86921b637bdc0b7ac192aa854ef99c1b4e804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a012248974386e105a77c37e1a17a137

SHA1
9424d9c093e54664106aaea1b8f6ec753dbd6920

SHA256
2365c2ba4655e1778a6e0bf7167e16c3a382f1ab88eb04fe85b0bbf6177d24f2

SHA512
5e890c0a7c1caaa034313a5b0b58343e017fdf13c33fe270e4a085e32ed02fee55dc103354a689df0378c0c12f31b85a0c756228f532b33dc750161e8eef3822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d1dff5c93ba3a8de1bf3529636331fd

SHA1
ccab373e3e4ce2d96dd14b1a93d0702181eeed2b

SHA256
f4536ef9a05bd19a741de48a96a03c01e8a9fc9c96ce8952e78fbc529226c465

SHA512
19dd89eb1f6cb2e24b9c9cc76eb3e001b0d6a5b4c57e2d08fb7caa204385faad6f66b54bbc873f99d6e93ad3a1c921b174ad6f17f2f49c17c62b3c1294784cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
422654f339b2609f4e0b989849b687d9

SHA1
5bc59fc2ef6a56d2f31816c59332abbac9a08642

SHA256
49c212d4cf750dad0bd121f10f71ea82b0718138db2dc8880b0e140698bc4b6e

SHA512
37f77ac141f1d325b5b585e2de805b9b7aad9de712d817d558d1777272fc9286b37956ef21839fa1ae40ebebc1d10953ffd4830bcc98c7a883d20faca57bfc14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162536588f4c1f547a78963a621e1996

SHA1
158f5b32b81321a2e247f8f5c4cb5ddf3e96fe02

SHA256
c5b8e005589e84f76137cbdb46db29beede1212f8112da22bd1eb878fe89f297

SHA512
fa5a51ec8ed0d01c960d64f8cb06d19adfb695fad73046bfeb9168f24fe41d79152e562cbc1fe5d9c35b25ec4eceff7d5eff88fa6d07d501373f12fb12b3683a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a3330fea5c68ce219e46d78ab7521038

SHA1
ff1d6dc8f796ddae2781c30255e747b0a5c2986c

SHA256
52483adaed1c9b64717c0d297289705fe6948882846cbadae5583023d0968524

SHA512
67211c68f8abac18d38f3bc334eee7d24ff129dc79e4f00d5b8387baec1112ed65cbe8f6eb7fcc0bf3da7e71f4b5dc9a721ba6913b49288e1003c50d1b57a11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb593d9d141e9e7b44be741f0fb4ce7b

SHA1
4fac4bbcd02b256ca2560fad2d7f342031910378

SHA256
3ecb972a8ffdafc423e41b3754ca32685a99fecc70b2e87f5fd77d634cec4b90

SHA512
9605c86576c26698055b06628ee4a62d812a78798cebf863201d40b317f7b740c34876c9139df39a036999647a954e9f948908c278e4a09471dda0db4ef7b50d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61b1c09c55013c261d163e62ffb622f9

SHA1
7e093bf7a81adcd77cb3bfcac1e30ddade1e1ae1

SHA256
6bdb76db29c8a74a4a5418351c0041bd42371d0e65ece93bf6d6869d3547ba6b

SHA512
a9368ed561f5f01d8d7ae57419f8d26506ba59220788606478f8018ae06e5459fc1a07c673ee1ef03a2486f331fc72c0d76346d365a6a03f74f3a40c9e594da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37bf9a0d964cdc86b0c5d5e5037ed798

SHA1
33d4c10cb6237ec830d1c71e5c75439ff83a4734

SHA256
24b9584312e3d629ae10c5709f23d3e53ff8ce835914212b134e789c62251efb

SHA512
2ddee2e74425784e277db809b8fc62b197548de9de7f51c0f2bf48f85121fa936e170f8ef0817b4b96ea7b852634242ae2cc5e94959d03c4529107d27a564ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ef9e29a6b8630280aa2dd265b3f70b3

SHA1
dc199da5ca8b2c861176ae81c8090da1b6bafa52

SHA256
7f6bd7d83b3b602e4ae3566c977a55854fd59c999d6c0172be547662194bb4e1

SHA512
b9f7e18d4fa1d2ba9bcb824a4a79dd046be3b9344223084ca67044572b77bc4ae709f43948e3f7c75e748a4ac7367469b2e864b5b6d0d9f7dc35d791c788a0ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46c2fae353a63222e006bf473491f38

SHA1
4ec777a36d1cfb9da0cf00ea4a287dea4bc45a61

SHA256
34fcf6172956f69310c5ad14ecbf6fcdd4055c4abc5fb46453e5c66662d48152

SHA512
403240bef5724820e89fd25fd68891896ffbb254f8cc4cf5308c7dd4a21a049c615b07bae01e590799fa9869e675a17c39ddadd1fab176744f5cc880ca297383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0a566af2ef3392848f675f7f86d64d2

SHA1
1d68de6c8ab0ae5b025549c08cd8dacfdf949d1f

SHA256
eb620c411cdd4dc619cf1580477652e8ec1e302826f2710d53a8e4936d83c61a

SHA512
54fd8dd47e2982568b21feaaf86c57d85008757eb66c7043dbc83660528e0bdec23fa7156d41903878248df02a58034e3ae33915b55bd4917f9cdbe10a7717f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f24f166bfbdab05db64fbec22b5f94f3

SHA1
d7bbbcecfba3730015972a78b7e297128e062742

SHA256
5be4f66fa5c6d6247fa10b54627f392cf4b7938fbb6119271e20c0d0c64ab52a

SHA512
d65a252a130e1256792823255c26bd2c0220250dbc20815e84efbd3fbd3d98451b6a0521ad6461c696e6a9d3d0d6d2fe6e8d9c217b1b2a8a7cb7092eedac9390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
644f77f17bb9c1130873eb15cd23925e

SHA1
5f9192532eaefb29be9213ee34a24be30ba35e41

SHA256
cd317ce62787fd5c969152a423d7d123e8cf588c4d8c527bf47aa4393aababb7

SHA512
1c299d9cc3571746952c4aa62cabbce74900be87fcb9801888903540a4c2dec75750ff8b702ef95cd16c76a2b168d8c640891e6f0c77c1e9766f9ccc7c6fc273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be9c0eb05b1b1c7f4fdf9fa07c43dd4b

SHA1
ef94ed42dadfbbdd2287c843183012ce80bf7352

SHA256
af370b840290aa1b35b726805c0dee7ebb2f5db0ac1caa775cd9259b8dd00a4b

SHA512
7a2da8b8218dc815ac2773c12940013a901545659e5a1ed3ab1b2c90ff9b98b3223972fad5734a859d740bfb5ec1676cefaa643ffa7c5e038de01e3d74a1e1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76dd2d9d1202e084e69238dbb682d498

SHA1
4d84a81ba2fc1f6a6c13c8c59358c6963ad887f3

SHA256
f450a60f6ee530ccc7794f8028590fba7831844d9a5dfada68e589deb881d7d9

SHA512
1a50e3f157083058151f07ab02dd417997a5c365aab621b8f1a6d04d150c3262ee75f824cc8416df4af0af58388a832c1d53744eac68f7f9a02a1449827c8c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc3336954b8de25dc1756ecbf0b710f5

SHA1
b99bbeec259120ab0a520ad8cfb33b0424bed55f

SHA256
5fae5e17bf90986df64930c1d1c6768d81a3252952f383c709bf7f5dcbe7ef24

SHA512
0edec0a8bbfcf99431ee74d514f0fce6c8a813fcccc96b02ae78c609e2f828522e1ae858da7e3f2c126a7ea6cb7eb32c1d0aff2bcdcf4301121ffd399d8eff17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be2c00a79426071377d69b29007147e2

SHA1
06b4ab063587acd6a61c116c1e07cc0e89ef940a

SHA256
2c273da3995a0ab1e613f0d9d1701c9c230604981334dccbb7c43603a718e6e5

SHA512
e7c5a511d69cac601d24d5ec55baefc71dc0f55f6b1130e29c4f5ad7d3332847bd6e63299d7df8d449f0d5672fd1714448d1a65d1ad6421aecb05b3767f5923a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ce9cdd768ef575404ea276094515fb

SHA1
25d373186111230c7971db0dd374cfce78669afb

SHA256
f657a0209a1ad1f4ac706266d3dd8cc85c8680655a834b49e433f218717cee4f

SHA512
993b882cdec8f827e8a30e3b327bcfc1dd68ecf4e11190e67e09aba9349b4b4e5aec270be19fc3b0c4b699eb925b98f4651d939524b1819dac929533b4cd1689

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70EF.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar70F0.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit