Analysis
-
max time kernel
44s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-03-2023 03:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip
Resource
macos-20220504-en
General
-
Target
https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15A4C431-C53D-11ED-9C96-EE84389A6D8F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e42ff24959d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000654b46b51e88a23160b53fd766b84ebddb9991502f8a2cf6d8862b15ec735eb8000000000e8000000002000020000000e4445b03e3d2bd36694b778f52098da7f5385e8421695d9b7731af9948f214bb20000000977c0c86e29ff5ad6e59c60973be8b490bb97edd55894c3d62b3cd0914d93f834000000037fb52e059a82030204a590524407e8a5b01df43315c7cd8b5209aa970c61e970e3652954903896e0a544838bec84948e808ed495e7f53347c521d7b616d3a49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006e8f12fa8cd8fd499ff2c01df6bc8a3c00000000020000000000106600000001000020000000392c3eec6eea02525bdae0e89cf915e50abcc5358bc4c14432bb49c6f3a751f3000000000e8000000002000020000000e8fe344c4529555c0ef59ecab7114213374bd77dd754d522d8892f8b8f0c3bbf900000009ae4a5f572324e463afd3ee18451cb4dd099dd178a0d267108c636956c9d297955dee359d6e177b3758a84d2e54fbe48d173653b50a643880d671015c0d57c65c0096468c6b87b3ec4b5d91cec621332c02c94e9c3c3924536d30e0cc28443cc1a4bce8c871fbe6967c4a846b13d90d0cb09abced9d3ccc42d02173c0150fa9e77eb9248cd5c239801ec02ac6bdde1c8400000004f8c25dddd4900cc23bf2b4a3b6ef49538bb90050b0e7244147444c5bc2a49789ffee19dd32d3344065c3f706c38bb34f0308f9fa53e0a916727a40d2fd52742 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1928 iexplore.exe 1928 iexplore.exe 848 IEXPLORE.EXE 848 IEXPLORE.EXE 848 IEXPLORE.EXE 848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1928 wrote to memory of 848 1928 iexplore.exe IEXPLORE.EXE PID 1928 wrote to memory of 848 1928 iexplore.exe IEXPLORE.EXE PID 1928 wrote to memory of 848 1928 iexplore.exe IEXPLORE.EXE PID 1928 wrote to memory of 848 1928 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://store2.gofile.io/download/96bc7856-5bef-437c-9a3d-9fb2b7ed3ea8/ImGL%20Image%20Logger.zip1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53211706ae507e7d70314713142263b4c
SHA17bb7a310f5d6fe51ffe3e61bc954a1d3756dcfc1
SHA256ecb91ca4bb251ab97021a0633629b47364ebacd562f76e66ff54a8a9e6bb2e56
SHA51268b0e9f2038913ed7662c06ef5c4beac203f5dcff8cd684d206a613e2dbbe7bc0db7582bcbe31b53984cb32c7c94fa0ef7c8074a2ce2d332b69c9f231de24119
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD51cb9be2a3ab244186938d245894677f7
SHA1951c1dbf682b8d27e515fea56adb973b8ce961be
SHA25661a5082c035dadbd3a5acb5d8aefe65082f33db5e5de8c3cfe086bdb6ab05d51
SHA51202c601f7ed7d1eaa5cac03dff7c026f4da2cfa05b0f6e4a77f8e87d92eda879d96f7779d98550e6ba673e0d569d1f88470bf5e4285d7cd4edf7b838cffdfab9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5655c9ba4cf44b447f6379948e5364fa9
SHA11b478ecd746132aa3a47c298039669e7b8149c88
SHA2569ed546d00c56480e8af017af524b1a4e35583c9ad9937e3e5095cc946198d8d9
SHA51231cda5e14b6efbaa3c70a113085f4a090b6220cbeb8898f70f5c409137bbff84c32906f39d0b3f3f8e122dca7a4e5668ecfd31e379369d06cd7b3912b72fafb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b9f090fffc804800d3be483776d43f25
SHA1a6a4e648a7528bdc9f621be0cf7ad4cbec8a028c
SHA2562b4f6286a561d6e7dd18f3c76eda208e7ffa04053b2c679549bcd088444ed621
SHA512f86663f080d5b7e556923dad49e84a116a4ef24b6e4dd67184c04a2252f6b4093df661641ff4804940b7d9c1b2ee31af137fd6a612f97c76221f7b7fa0436788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD599b3ec8998da88dc0331f2f8cbd2ecef
SHA1ed8e5f7b631db6dbc639065eecbc9539d9e6b238
SHA256a5d05702c9edf748d03571c4bccfa6cbdbe1032b1ab62bded08afec4d79faf73
SHA512c2763945c4a940029a72df95ee506f800ecc5aeef75eddef5708436bcea17f85c3895b2e08460418b7024a571634e5aad565b7b33014e572c087ecd6e1ff0add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD56b27649dbb757bae074487d065baaae4
SHA195c032127907adf650fb187e68c66c5dda2ed192
SHA256a6055f874514450c1e67620ea69db8e13052fd3133fccbac7a2ca6226f7d8a78
SHA51212e8d59f129551d8c06b30781af50ebcfa1d22eec3f158065f9fefed217d4535ec823e67ad0c61af0380a8b76ce0856f31e46bbd5081b21f015c613870bb44ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b90b1a164e867c80d1a1b5422e03cb63
SHA15987d16144ba0091a60481c9e8aa0de678bdce9c
SHA256209200e01ba95664eeee6a056fb8a7403296bd485e0960f81a125a4a0048026f
SHA5123b038d13e16aaf767a00d7f0cf00b0744142e7f02ab85612b665bc2e118bb71096fa9ac3d3638d21109d4d42c2060cc12b4d55b070ef5d8e9de7af8a2fbcc27d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD55b53c4695d68118a588a1054a50303f8
SHA18f322b4aa41034ef618bc30f6daa3ee1a4e601b2
SHA25636190650ebe65ba2f7913010e93fdaa86741639050f359c23ef3e4bab9330042
SHA512e12c128e7864b1c08bb61a77fbe573435ffc703a967af1790fd6be190f886c8505e5968c27cb5b9ed4e848da848dc5e746b98ec4b45531251442d5687bec104e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5e623c1a64b7b91338af4a743b3604e14
SHA156174726f78f6dc43294bb0b080d8b0356e36788
SHA256599f282a1092a76b02caa84da6c1246bd821c3cf0bde432d08f6c2c81c2b3e78
SHA512e0625e58a78ddb3a307e7ddfbcef799f5801d61811664deae48c451c85ffc64f4c9bf5d13e93c3e403d9a620794ac8f278574017ac5b1c914984559e5b8ff981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5c6bf35a86916ada48922311c3ffddaa6
SHA15a7beec599a4b2a03e07c6f2609e5c7c4af5c19b
SHA256a88c23642a19a2c00da90b8a60b99ed732924bba6e2d4d0ef30a1535ab3dc9f9
SHA51263dbad1eca8d2d818ce7abcee13a8967790e0ae066d56ef739cf5b443b82328b5d77b1da571ae504c3339913ba30e7841587f0908c373d7b35adf7ed34806455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5dd36a4bddff20169e3e12a4c3d5fda56
SHA164d00a85f354a507703ace757d2ea0b5b8b4764e
SHA256f2a6bc2bee497060f8791fc8cf06d07e800b7b1b64f8384d0f383e946a6078e8
SHA51299f95f8ed5739327f8d7a97cb9ee45367ffaf3c7f29903c71933a55b762231035cbde380f3bb4dc8cf1eee3a0babdf0b114bfc2b92e2ad9ea0d2540df4c88157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b62d6ceda2bcb8c558e08dc444ba911a
SHA116466e8ce0091dec33a0ab5461790104dec9c899
SHA256fcb7792fdb1cb5e119b53aac04e3072cee6c443ac1ca2ebfb5a9625cfcc18d26
SHA512aa95007f419ca32989fe432927ea9b60d23e1be6f70dc2f00c7a96c65010c261ecd9dd5ddff9a6ccfa1c8dda15838743c2a84b70b45fed0906d225b1028530b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5df58a89072c6337f431269241382059d
SHA19ed79bfa4fc9ac75477e143ed8d954991252e56a
SHA256c5946aa9097aaab27d406c4f5cf3a42f56c3216e62d40dd2843659bebcaebfd3
SHA51268f90bd7f4939acdb7eb54ee5b5f81eb8088b92b24a7a0d0dcf8ae8c039ebba01648e59be34162d5153cad733fdde6cb1a503e8a941fbae8906e01b82f38d71c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5a8e97cef3e44c6701086c7185bff7a76
SHA1836a4d1ca31f3cb10e9eff2de72a6724b1e7e629
SHA256aa34bd5bdc77b065e372439772462bb58707d31a98c19ce438adf1367b8a7611
SHA512357a7227f5c7c96423d60ab3056b31ac78fdc51b1584d16f22f74a6f6dad9ff7faae44223ac2f836609dc0fda042bce9d146cb9d8101c71d25441ab6629ef417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD53174203ddfe88d49629416a485ac2847
SHA190da2b6f0bc5abe051926fb8e42f21b408ae9a2a
SHA256bcafd0a7afaeead564ceb88424aa1ab395db6232d600575ebe7c28dea6f2f0bf
SHA512660412b30394f2d0044fea447cc5fbc54eac0d98b9e6be0b397d5c721bd6315e796d28049df0df5d36e8bdfbc4440babf362e8d31d720197f0e5cd7c1b058b7f
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\62yy7f8\imagestore.datFilesize
4KB
MD5de160ae765f4ee3e33774e309177c5df
SHA1716d9f432136ba736322008e75ca948e52b26f30
SHA256cc75f7da715738b238ce71c12e3bce2e7070bca588b3ad5f214ae2ca452ebc5c
SHA512f6170376db40a21a828a9d0efd1042f0fb2fca1ccf9173bc9e9a59da35b2c61f4117a06839bca21e8f5cd559718e75a95517427ddc22410ff187078f7b77391a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\favicon16[1].pngFilesize
503B
MD5ad98355e85075a8ebc15a01f875e1aab
SHA1de8398fdfeb3bbd48a58a8b12453e1fee61e5f2d
SHA2566a437098dcbb8a0354ae28a5f7825685f471c13cecb83186cc950844df7c76c4
SHA5121b5d5402256ec3ccc20f1b1b635a9ea16131c2aec49c94105c8b7d3e32c9bfd45e937bde8af35ced6b22f39526de2672ba145ec43f49aba4d7a66da79e13819a
-
C:\Users\Admin\AppData\Local\Temp\Cab4B17.tmpFilesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
C:\Users\Admin\AppData\Local\Temp\Tar4D6F.tmpFilesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff