hxxps://myaccount[.]google[.]com/u/0/youtubeoptions

Analysis

max time kernel
133s
max time network
140s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myaccount.google.com/u/0/youtubeoptions

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003beaa6d5c316ef3d49ba5c0723a8c7c7e1be128e4fabcdb54bc83c227522ac43000000000e8000000002000020000000e4c8213419df5bcb564621315295ac5f481137f1cff0a299d5799e1a0355f89e20000000d98f850d03b9c00d55b5734204ab4bec3952c20d5e1714d6658e7d6c025d70de400000009c3d39ca2e3e3b5ab49a4d01133a382c703dc38f56dd2c96a1038e7970c301e05ceb6a2dece8eda400392a0a318ac238f726db1d5999ca709aa5704b381a07de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000006b3c482cd74beb1f166b97bbd349bc4a2cadd0e52d418982f69bd9c0bf564811000000000e80000000020000200000006e77380f5a031d733a7ba617693cfa0ba28a23a068fd784a8fd8d74a116ace2090000000e561ac0993ab00b15c6e0d611e03a0c3f88861fb1a73cc8e3d6fbd44f0ef718ba318625fdd6ce54036c6d46cd2395d6ef4d1afff7713cde13959f954e3e1b91b09e51e449d49d24e2efe3351ed319b05e3a7b4187d6d60aadfe21eea822734f03993eaee63c472571e755bea6d9efefa756f4b72d5ca70480a8af98befc1e565d7393c29ebec8257b1782f5703ebd8bf40000000b7407dea4663c08d5eeabfe088be7101bf0d86ef57718ea21bef95b979865a80887590858b909cc05fd8c116cf79738ce87cb80205cb7c3ab64778ec4c62b1b7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422035075"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4534701-1398-11EF-BBEC-C662D38FA52F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c36c89a5a7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2460	iexplore.exe
2460	iexplore.exe
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE
1296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1296	2460	iexplore.exe	28
PID 2460 wrote to memory of 1296	2460	iexplore.exe	28
PID 2460 wrote to memory of 1296	2460	iexplore.exe	28
PID 2460 wrote to memory of 1296	2460	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://myaccount.google.com/u/0/youtubeoptions
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f820ee4fc951ca0d6e4b336c7412758

SHA1
4cc4f34cc645c078272b6ac28ca80644e6ebbb20

SHA256
60e868d334f021b728efccde1865664c26ddcc73eaed5dcbe255a408d60dd207

SHA512
5ac1416fd20ae89fc6ce91a3a6e047185c5897aee2874ec09356cecbe58e8b5b8edc7d3c08bcf88c73063b0c44ade64adbc6362dc3b1b9e685b8c321f25123cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
19667ed3b10448325601fc89d169fd64

SHA1
d79cae0c1c3a309d1e8270c373913243dde01730

SHA256
bac0b19fdd20040e68e3c3637d74162b591859b993c5cfa24501fdac42545e99

SHA512
22f4118e4c89061d783eaf1429250fe808ab5cdfd35fa0feb7a5717ad3742e5c88b919f0c7b5a324e36998b8d80d8f8a030853cca7a844d6ab956f317428cde5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1285e8b626fe1e2d2b10798d0204a739

SHA1
5f573d0a251598452340a3014fc8dad5bf5c3dc8

SHA256
c4f81d988fed5625ffb2a873185f801206a5aceaa9b7ed372362ba5d040a9668

SHA512
c9233b59e21bc256d19f1eef0c10804f6a25b421ea6d85b6ba54bf9378d3f7b2b2d045f2579093190f0bcb5c1a470cd22ca55493b9ab0ca24b0cfbe92a3c4c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b08c42be0a3fcbcf0009874e2c20d094

SHA1
1b58dd4f0a54093be3a6b44f5cdb110e42cebebf

SHA256
a987ed57523b003741c8e574a1d9245e92de359025bdf2ddaa28c255956b1693

SHA512
e31d3f115d8540d629c068660bc5683d566fe4b2b0037d47faf0cd03688a420cdac7c1d9d195e9642be76409b62258974b304e784bf4bc4e88f9b961566297c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d7a058fe489cec847c9fbd64dca7899a

SHA1
a0e5300efb1f57e5d6a7f382869f4dd47e73a0dd

SHA256
0f25cd16adc0525d4162700c7237d68ffa228f402f885220df990446366842c8

SHA512
4e0dbcdcd0d1206c85a294ac2b3a2b3975a3b4ba402d1f1cf5eb5cde3d9988e3a7f9664674e6a835d0787d0ce9ec8d5d5702a0c921af5275ff8c2fea97b48488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3548a445a608634b7c8bae6686ec8a38

SHA1
45a6148a01252c72f4a6dd64093f4743f05c9d01

SHA256
0d830c98f6f846bec2fb3579367d0b445fee54f19afc05be84abad7971ca0d1c

SHA512
ee3dc62c13621732ba9bc875a53a5ec2ae19cde10ff451c37814f4b0957efc435cacde73ca081a27fedcb35d2015eea805f1f58c0e7f2915d4b2ce8c59f0909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f485ea7c9f9f2467f02174eb40fcf4a5

SHA1
77d57b5ca84dee78626a640442ab61783837f0f1

SHA256
25f6b61e5bdda04626e0f80fb08e7cccf76bd8313f94c566c358722763ac5cda

SHA512
fda589ec8c4685eac02b8241a3cf503476bb260d4579b640109f2201ee795d066280c4becfa2f36dba70f9766ae0c8df1a3485cbbc863f17c470121519f70590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edb7ac7a1b1dd6ccc5dce4046311fbb8

SHA1
22abf9a156b71b99d324ccaa028c4e107f9ce599

SHA256
b4f6798cca4f0f03a2dd9e5d68e9328fb532f754676051b8b341f33e3e65b864

SHA512
f5e1fb9e15061eac26088ba9de51aff3ca5894f86d192555ade216490956b3a33946ecf3e970ed8d6e8df0d255e02b737b51da55ab2cb04a9cb546c4f696e883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddf71e65789da107bdb3b1faba2a7baf

SHA1
000cf4a95ac8193178ce99bce6ac66bd7c7333ec

SHA256
e77e2a8593594e45617daa21533219c03b5ce3a48b26b00437c097cacb568a71

SHA512
de7daf4f4143310844bc0b165b0b8a4a64ed6d3d76a6de3e124c1c6760da7c9bf5d8e848d33f8b85a297022a3e8ce504a5e20d707692cc456a384a58498a686f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d12d4a51d61813c7b6c586a5d50c74fe

SHA1
9f79c07b0ce8c58e0903412d4990d245507bff51

SHA256
c2dd62048aa5c8e87449325a1f3c37b8e3f3522a1478e6e007eee6353a8e1d4e

SHA512
566bf05861b2ebc91fc8a42997dc75605da74d6b06b3e6c2828bc84a779fea5699a7c3561fc6f624dc3e36fc86f14d9c5a01900909ca3d73a68c1087cd62deb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4da763fc0ef7cd72a04c99f084b5d6e6

SHA1
dd760368c0411cf887ac372f287b9b909528b8db

SHA256
d76e885da61cd1ef4dcf81abc17bf24381ec5e4c16c7cb0230e0191a272ce2d6

SHA512
1023c14b726ee22bea1d44d8a136e4f81f51bfe2c2b3b8424231429f6bfd92873dc3591a5dec61cd483695284e11c4092949b0e9d28494b565b57531462846f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92495a51247c3d924c7fb9e16d56bf50

SHA1
91212a8f79557bbfa354639a84bc1ae511967d33

SHA256
68548eb74c3b93e9d2c935b972ba7a1dab8351c1bc20120367870a8031492a4c

SHA512
ad84d09c54206ed80146741373e768250d11949d2b1b807f5fb970521d7d917487cea0b2fcc43c9af308053ecf56862ec4f654759ae104b90a0e12d5c837e7da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c99a0e0acac1af3be5a3e7bcd9d075c9

SHA1
b07968e8159bbbaaad4bc0cb7fe0fb92adabfaa4

SHA256
48e24550a7c8d7829e4b84e4633052ca4994abfc90eaf3b5f1bc11b101e7c6b2

SHA512
8f740b46bdc979e9322c710e1a4b5cf6e9d917d31fffdde2e29e9f89c8b853264e0719165e14e206c5b978c821c89e26f79ed586da1956ef968b8bbeb55131ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e989b50318c1778682611d0feb210c4c

SHA1
4d4fefe27a9faf0dfae2ef9f45c85368c7df3a88

SHA256
0e04fa40b4c8005fe352792d9cda4e1d988831a1f618042b896a43255a307eed

SHA512
de488726e665eb5836a480016824fa3826faee472a561f1ac42912ebd58e0821cf87e1573f19de63a2f7f6e1fc02c2fae66da343b439d37ff046977a01612647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wi962z5\imagestore.dat

Filesize
5KB

MD5
a4adc580b12303edc51bdff7ae232fa2

SHA1
abbabe33e245fd7322cde6bdcf6d87415325b557

SHA256
56ca820bde1916b35566a552e2534d758b92d4ad19b8043c37eda3056a644fee

SHA512
bad723a4e739b3bd78d05bd7b009e3f706f52d260c477440e1cacd33d251be5979ee6eef82d534459a65050859b5cdd1fcee84e204dabb54979c47e2d4355b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3303.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3316.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit