hxxps://t[.]ly/Joo3

Analysis

max time kernel
25s
max time network
27s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2023 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/Joo3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CD927731-00BE-11EE-9EF6-62507EA95193} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4132	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4132	iexplore.exe
4132	iexplore.exe
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE
4572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4572	4132	iexplore.exe	84
PID 4132 wrote to memory of 4572	4132	iexplore.exe	84
PID 4132 wrote to memory of 4572	4132	iexplore.exe	84

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://t.ly/Joo3
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4132 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat

Filesize
1KB

MD5
e0d1b39b8fa38cdfe04357caa83f8af3

SHA1
f1606382aeec5197cf31281b43ccbe8cd7fabd35

SHA256
cdfe2795b5bbe1cbc1668818c5a62017bb2bf6f9c7fe8a7d729dc3d9f32467ef

SHA512
697cdc55b30c29e620d35c0a75dc246c371002dcf60787dc7ad1c5cc27015029ec89935c387ead9e78ee15b1c9ea3f3994f33d3846577697b5bbc207d113b943

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8OI4IV75\main.min[1].css

Filesize
129KB

MD5
2e98899d557f518fe691274ed7851b89

SHA1
999ed2d6a9c00161c415f43528865354bd3c08cd

SHA256
d35d5d0a8fe1ea7a74a5ee80177dd3f7dd2f3ca24aeb0c35d7c038874a41776d

SHA512
9cb6b6bea7dcf6263a3e39a74fe535d11194e5097a7f5cc312f6848f40089ddf52cbede3b1720c2c4274d231244ab527c48480b6e1c67d6e96354e3f6fa91460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\analytics[1].js

Filesize
50KB

MD5
4507839525a19180914799b08fb5fa5b

SHA1
738d7e47e47a102e67d09efa63408d21aaf02245

SHA256
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

SHA512
124bb24b26ede426ac7ef14db40ff894ddea6eb9c7a5bf408fd83b116bd55ec86b51b6839d5eec7ec0f481aab940795006005b4534dff6cc0f3a6560f7cf9bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WPCK8CWE\favicon[1].ico

Filesize
1KB

MD5
b4969a03721c2ebaadc1e542b3461b8f

SHA1
37ab2c35ea395cc8aefb4059021f31dcae10de4e

SHA256
cab6a0e77f4caebf5c69408dc4218f6c69d24eb65ca6c20ad8b798a68649bc20

SHA512
28d59e653ca668ff484a3022e4a4c0565240c7278fb21993fa08c76b42db49f8c5946d73735dfc441e5b2ed4c307b589b07a9a6775c4692cbdb54349d8d325cd

Download Submit