3824c3a3b87b26557ccb65e595cf989944630e749fbbf5af5436a10c0d7fb457

Analysis

max time kernel
138s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 04:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0001-exploits/icq11.htm
Size

5KB
MD5

9998385f5f48e4537086965b5792b345
SHA1

dc7dea1a569119c34688bc717fb6e87508a7379c
SHA256

c56d1f4e56219b6d49de977af302c96651bb3965e3248d8a7976706cedb0949c
SHA512

50e4c2028e8ff5cd8fbe0287129f6877497eecd49a79bfd48b8d468800d92b90b46320e0d6ab41c13e0a91754323e217ab3d42427d81c23f8d53d4b012162356
SSDEEP

96:/0SaSZS6S7s7zlS/SQ5b6UKI9i8ZFlRGKhBs5zSP2/LAD5iRFzS4dLXU/G:sSaSM6SeaSC9KkFPGTzSILAD5czSYjUu

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 702a975d7335da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000041f6d9c267f5aba265dbc1270d3954d587327f1e823a0c13516473304030ec15000000000e8000000002000020000000214dd9c3e045abff971573cf92b09ea5ea6d8ed6ddc0fb6c28ca480ad3d070a790000000f958e37a7c01db6e3b0dc56203095784a8e1e03ead87219b8849350eb04bcbb46378c337fecc6b30bf63fa6ceb57a142b241d7635f2f75e70476749c7c1c61dd50150dcb0980e06662d90780712174336f93bafa96e35765551bfea8081bedcae7114021e594fa46fb0f2b3f06986d2e6e3c80c33f50a442c9e9807fc00c468fe405a2cfab166a9f02d81decdb32aa3340000000c839d122ea8f4a46a8bf394d3f34754af95a19eb99339a90ec106654db45755db07193f88fdff83018e9a8fe4b4445af71c5f74756bfdc7a8d34905ef6a2c09c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88A1B051-A166-11EE-8495-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000383d0583820374eb35b8dfe8abef1f0cb27272c54e930762605fb08a834816ac000000000e800000000200002000000098a49e6b52329395aaefe11f90882456ef4d93ff5771daa4392ca5a1e814420c200000008eb3cf08a8301061ed9d48f05640d2fd83f8b73ca890e7c1e0101d6fda9bbe7f400000000935b9d273ff97f7b5096dabc96d8b49d14fefe6e88e778c35bb0ab7c2398c679414d527b41aa441946df96f561b78fd70e9565d017499c52e67d16dacf0c1c1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409479096"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28
PID 2200 wrote to memory of 2364	2200	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0001-exploits\icq11.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2457b0e31e1557cf5e87e862d63fb213

SHA1
d3c6a4044d235c6269de6c868bc9e332ebf0fb22

SHA256
0a751bc66948a357d6b7a2542885ef0571faeb38a12d89ba17f231aa936379c7

SHA512
7263770ceb4922bbb5017147b5e6e5cf2ac264265d40656a4301e2df58b51d8c121cfa351fb1ac13c2f8310c246452e69fa4bccd746c2a8e3f0c87586404b2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88dd11f59699a21564c843509604f0eb

SHA1
1174b77ef9db06e8f4b1a182517cfccb16d2dce4

SHA256
1bd33e32e1de70985912a71def5a229b47743ba2db4b18b0a5c09612b48dabe0

SHA512
2a4aef3d0204224d5b73e8cd17c17f19be8fd60433abbd22c353af0e9e36af6458b7a6a62fd3b5a54b03fa105bacd262cd01c1707cd9efe4c757718c1fbae9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffc64fda6cdb1c8a66dbed249a093b83

SHA1
813d7a34f41a4adf93d3dd8d030230ea03a0549c

SHA256
4a86750fb8d833a06323a4ddf591668aa0a9934a07b1f4d44c60be0d025f6f54

SHA512
776c2d8337dd158b952009931f22b54bc658c0a67f8c74f9cb62b86a2adddb2cc035b367217ae30c8ad26998f67b19982e7dbf16ad8cb93a58cde28d6ff96285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5a500d6cce0f74f237697a61794b46

SHA1
7e15edf267062cd9b2f648b9dc92f2d543379807

SHA256
5ff3a6b711a57db1377bd9e9718f48af81819c147e7f33d559a86ccb71fcbdf6

SHA512
951861e889bd54a8970804359d38f24c7785831ac9230d24494070fef650be55e86f514bbd8931a42c33b1e204a19c2a550410818037a49940247beedfb1832c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9efe93e9056f628a1e7a228f2d83f9

SHA1
09ea655720f6d467676adb514d06cbe1c1ff42e0

SHA256
afa019926863302a9f1063e610fcc0daa04f622d80f3abce90e64bb7eac32216

SHA512
896cd9d3611056cf34d9706467687d15fc85df6cd219199e94c6d050bb7da13f29752e32d9d745b0365315be8d03193ff32d6e25aade3fea4c3523864a1aa90c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74dbde75c53d3d86d6cc10c46ce45f83

SHA1
b542c9fee55bd9b062535e51bf02be87b2bad377

SHA256
c554542ba73a0fe00cff62b446bb80706e75b91cbd1ac529d26d1b50c37f36ea

SHA512
58ba4013d716308426143c60d324eb906cff679db0476153f41336d4f4af268a6380bc17ac5234689a953cfa00f84d562ec3b9d14a63e4f4720d412c26f9824e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9640b31b89f5549ba1c18633c2e89603

SHA1
f4cacaea9d42b45f79d4d5455996e92d3bf7ef51

SHA256
03fce9db5f76d997ad110eff7694e32b65fcc2393173b32bb3970fb927d0ca79

SHA512
a7c17888ce138fc54781f6bc9827d2bff44728b3bd8d152a4229b05e9eb1df6f9922e1e7add2196ac2b8baea9520959498e830aa7950f183bbb39a9d6c8ec82b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b44b0f731a44c79cf899c40d0dd6968

SHA1
988d7ba9d0fd6da008cebc7b4ee245cfc7142de9

SHA256
83691bfad50831affb09e9c4910fcd966b32a724839969a0017bf8373a1af993

SHA512
b0a699147b9c13d81ded9e489c9a95ee7bc88c9291e8ea6c04297257ae49aa0e013115cd1f98797ecfbb501dd7ce76ad309adf95c6dac744515368fc97b17fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1891a63cfaf8089199bb7734e6931a4

SHA1
e997a1db42efeb0bbe71e828be0bdba8708c1e15

SHA256
a19d040f1ba07cb912d266e64fa35bb7fb9f95ba6d3eedc4edd5f5b59c5de63a

SHA512
b9ac4a173f867fb220915cc437947a30581197f8463d5fc1e88ab9ed92a91601f92831dd08c5ec3f409ec16e4e6d6474b52e1a6949789432cbd153b3695739e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0a79a5e9a8b834097990d703b1136e

SHA1
737ea2875121790db2d82a9cd62c73099b511077

SHA256
1d223c083724fe4f66ed09b2f9797999aa932e3695c593abbc8897218b0cdcab

SHA512
80ef21e2c8af72955cd69d0b603432ac89830e1c88d84068abc7ff7ce2491bd182cb07631d4d39b296a5bcceae342deef53ae7a4c49c296e13326667de42e423

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e65d00b1ebfe0dabc4055341aeb17eac

SHA1
a55c6ad05c834a00ede3ee635d8e78a199ea94cb

SHA256
bd15d7cbd056fa0a423136fc0b1249406219c52fe46de10713ca980fd91f1cb8

SHA512
4b0e4043c1b4a9729006570d8972ad4665233e6060b760c6b7c286f09a541d677adcb63dcbbd272322cd38970b749c339a6859250c566169f85cf2000b852bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33a6abf79fef69186ccf620d6be4159e

SHA1
096eeb4559e435f10186a0296c9ee956616dd528

SHA256
4e17362096e822053172bc488d5023c4e80d5ca2c9d6a1117e4115ccd1c035cd

SHA512
b5f31fd3362e06896c00fe4479ad89535e96b2ba99adc8232df8b5b15f34e27089ab83557b7dc7143de25dcf6ea218d60245ed2e253203124881904868ecbf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eee36071666438a51884cad02a5563ea

SHA1
ba1e872c6bf406bc0f9bf42e33d59d9babc1afcd

SHA256
a5d110374fad84985868f9e107b7afa29415ced5f376bcb2c35c6b76e96422be

SHA512
8d797a4f3ef98ccbf988c8b285e3f0e76a3a331c12f0a0d8af81263638381e191ed388e4d7bf979694cf85cda161c3489757496c3381aec373a2abbb2ae1c1bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3083e8523ff55587d231a2b22c7fd988

SHA1
b69def371ba88806c35c133080fd34fcd6c282ff

SHA256
ecb0ee1b205114d37982596d4283886ff8ccd38e0a1f1a3b540c8e378451903d

SHA512
09f82b0bb98faba79cd307f9827fad1ffd5dd0d88e19b52141a85ab662c2c463d4aebee00730566cb4d7eaf1461ca586cb8850439994ea9ebca1ede985141bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284b05a099800a86b936baf62a479b38

SHA1
88513ca29b51e243cf0c76c5b661a7ce193e6b0c

SHA256
a4487b631f83f7eb948dc15ddec8c2c227366dbf7d35d7f82d9f4361525de2aa

SHA512
e0c55fcf13b22ba867006452721211dfc3622c28b6d03b932cfa4c9c7205c4febdb072b7bc13d4bfd9ba56cd78e1544d77c0751f705c40287fc72a8b92430a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e7278d5dc0bf9e0274626512561384ce

SHA1
7cfc30a73c782f3fa0d31e02a26ae9fac28cf974

SHA256
a7360523ed64b8322cd6579ce73bb2e9f6ee5951d54ff8f5ac0f625029eda9fe

SHA512
9adf53c18c47e003e490af7f7c991d2f460c80baf16463455b807680380338f0dd9431be918659a2ebf64f176355f73f6fec93f101301ef594d183ef688a54c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8650.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8730.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit