Analysis
- max time kernel
7s - max time network
12s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
08/06/2024, 15:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Youtube.com
Resource
win7-20240508-en
windows7-x64
4 signatures
30 seconds
General
- Target http://Youtube.com
- Sample240608-sle9sacg5x
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F316B01-25A9-11EF-8C89-6200E4292AD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1844 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1844 iexplore.exe 1844 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2696 1844 iexplore.exe 28 PID 1844 wrote to memory of 2696 1844 iexplore.exe 28 PID 1844 wrote to memory of 2696 1844 iexplore.exe 28 PID 1844 wrote to memory of 2696 1844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://Youtube.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 20546278768b7d9cd5de531b8633b3d2757b5160a42752b8daacbe3ff4474524
- MD5 75c97ecdbc9bbf5768b121ba114ec5d7
- SHA1 355cc710f0e6d5f767a674d27ef20a8d314ad32b
- SHA512 7d8e5975947e490215f1930160204509109c5838f641f623d3cfdf173073ee31fdc1d8817d74b7957685dc5ded0e5ff09cd7b5884cce0c33f85398976cd0739f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 baf9ffcdbd25985fd0250a6c393930ee5a4c45a5089a869ba7af3a2dc3c3998d
- MD5 1b230562aed393f56d08649a5ab6e747
- SHA1 e4f41bb9b3fd7049e84e5015e7f0145e03b23180
- SHA512 8e5ec1e0227d6d329517dda6b42882c37bab97d0edbd0cd4c0008edd7e8ed2ee513fe888d68ee51fc8d59a2e2fb02363e14fb05a73812dd0f9c87862fe96954e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 8544a8ef328a39e2795e94d06282336aa477687d44014b9a4e0125fb15339d4e
- MD5 e93a09098f8a0276a04d620b8171755b
- SHA1 5dfba2fc7ecd13dd9a28c30e3b13a28cf78916b3
- SHA512 95a5766f88913d16fe62dbaf15a8d4c893668b472a14a04fdd92bf6fb03b74f3f964d4a11dd034298aab28bd9ee525d7e6804e462d5a61b583f2d2f3b87afeef
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 220d80083a81c4c210a8cb494e4c2d5a6ed4e1d9a04c93b8c2e8d3542632048a
- MD5 e2102f1a182c69cfcab420f5d50281a8
- SHA1 051972dbcd729ed652418544ba2efc91b09b9622
- SHA512 a6b5ec24aeb65d19bc4242e38fb8f239569c0bbfedb7eedf1707009ac443c21a235d1f83cba2ebfc1fb82b7e49711eecfbb0e6fd39f5755ec22eb4bd395b6c46
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 282dd06c3da6a9ef2ecf900f28f0a556552588cebce638a42a75f44b485c9ed6
- MD5 ee363a70f0d60b82af94fae1b830c767
- SHA1 f4555c2424e0269a8f44569d08cf0b2f0adf928c
- SHA512 785935b0dcf6bde25f2658d194a2ad74fb9875d2a20402072b383e00a9ca7c083a484bcf65c21147f432bc5359c88d34616339b414c7025861dde7c4e5190745
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 d5156c699545f366d2f743bb6b8347c64defacacb49a701ce06c38cff3eedc00
- MD5 1bb275ee4cf55f0da02cccc40ad6e83a
- SHA1 acde9baf9e82e2310a177561f8d7a730fa13d068
- SHA512 b8bdb8c585af84c42cbbaf011a5bb5af9705167c72b797fb6a27b24b57bc080966b0700cdc2967c250c602aa03369e7d1cfdd312ebe184e56df4173655af9c0a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 317177c8d22417795b3379843b414968b9bbfbf58770c151823048852e4e6b8e
- MD5 f1437cd9e93bb1c7578c4d5d0702757a
- SHA1 92f62f860a900e3ffe527a9f24716fa5186cbd94
- SHA512 de2a318c2e88310c390e11c6fc2b61942a9c10671c34c90909ee70418d2519b9e72d922a51eb7a51da66d8354aa9596adb0bfd5bb14e5b9fd833e7d93462f141
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 342B
- SHA256 135b761666383abff9d8d61e509260be84989b30452e56503bb0d075dab92580
- MD5 614f8d4f59ca9cc3c9fff14eb30ead4d
- SHA1 7527485923c086e93521f7e31c66b610abcf405d
- SHA512 4ba7586806f046742ea66da07b3d561fa582715b4a9999329bed42edbf18094f9e84f5d3007b541666c9c76ef7081eaba5429def5b57c5c7cb9100eeaeded35d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c01c28db5f1abae1e056fe50da1a9165fbd67f73d258357641595eabfc38cf58
- MD5 263a90d3dbee15a1f31f7094443a61c1
- SHA1 6f2d18e9c0f16792dba3f42b0387a4df4e20bec6
- SHA512 e8c11470c5ce844a99119c39e7b3b01ec93689fe8b4ccc6ddba0e8eb70574825b0d5255bd16f9689365e76407e7c310f4090987b587b1a0fdcfc5573a4a37101
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q7my5tn\imagestore.dat
- Size 1KB
- SHA256 8b03baafc570ad15362ce322f1032ed55d6ffa592af7a2ede7d529d1b6cd3f6e
- MD5 4b43b3572d36dcad23d655f320022e5b
- SHA1 fbeb5117bdeeed6fb4041f6d34feb737a3d69988
- SHA512 69e6e348f0f369158d705f4acaebee48cf5836fae7063dc17f929de9a097785c4e7f4549a67c9d598bf9369805dec9ca8a7aaf47788484277335d0e9007913bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\favicon[1].ico
- Size 1KB
- SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
- MD5 f2a495d85735b9a0ac65deb19c129985
- SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
- SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab4000.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab409E.tmp
- Size 70KB
- SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
- MD5 49aebf8cbd62d92ac215b2923fb1b9f5
- SHA1 1723be06719828dda65ad804298d0431f6aff976
- SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
- SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar4010.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar40C2.tmp
- Size 181KB
- SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
- MD5 4ea6026cf93ec6338144661bf1202cd1
- SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
- SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
- SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
- MD5 SHA1 SHA512 SSDEEP