hxxps://linkr[.]it/28pEDC?fxD=t2hGgbHoN7

Resubmissions

31/12/2023, 13:17

231231-qjjs3shebl 1

31/12/2023, 13:14

231231-qgvgssbch7 1

Analysis

max time kernel
23s
max time network
33s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://linkr.it/28pEDC?fxD=t2hGgbHoN7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "137"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "137"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "88"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "137"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "88"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "32"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "189"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3D8FAC1-A7DE-11EE-8452-CE9B5D0C5DE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\Total = "88"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\stockx.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1576	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1576	iexplore.exe
1576	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2684	1576	iexplore.exe	28
PID 1576 wrote to memory of 2684	1576	iexplore.exe	28
PID 1576 wrote to memory of 2684	1576	iexplore.exe	28
PID 1576 wrote to memory of 2684	1576	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://linkr.it/28pEDC?fxD=t2hGgbHoN7
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
754334197fa9d4e54ca91d2709eb5c8d

SHA1
fd60b9d1b8f58f6011078b9c92021b63129caf58

SHA256
4e05e9920930847235351f81c30ff6363f9e6ebcd92f9e65a53883f25c847ebc

SHA512
6267004fdcf6516e729c1a9764fe7ec6fb98ef3ff555f927a62b5e71ca756f7def5ce4b2bcc025b02d64d9476cec4a4802c7a693a3f3e511c8926011f14e3dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f85a9118218c5c0b44935b8ba68b9c1

SHA1
c9ca18922c75dbdf729d25c7bea857f94753b89b

SHA256
b192a626b78590443bdbf7cd870aa1bdbe1393adfec965e0e71584ea9deafdf5

SHA512
fad8afdc18b3276c705dd61d8510ed4128e670f2d1bc3091ab7ad68c91d384cbbd3f07e7ca99b1de1e99368be34f07eef6b9820fbd7d75a6aa1e634ce236bfab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
324b08e0a470abf805ab10f6e257bd61

SHA1
1e52d3d4d4a60680a0e99c205cf25c83632bf062

SHA256
7f9eff8c7182733ddc9e164fc28bef4038adca7b3d85a12250b686a4f02615fa

SHA512
b3934e71289487c015c9f13543445110398656f46148e32030454944f7e200fe6b42a7f7eb1fd0f7ea84fa324f38fa2292bd46cec052213aa634b2a452f9f4d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbcd3af02b378c5228ba38307cf10b4d

SHA1
768f8555525e8c9378f3f8aa4b4425889770e70f

SHA256
fcb22f5d8a478c9fb0a4b44329cc51e400feed91d7fa0ec557fccde2f4cfd312

SHA512
1a368ee36c57f26cf577d6d3c2a7cd35bc234a5cc76ab4bda75d90d8bc1dd97bca605d0b61ce915178afd521e3fcb6c2fa200b1a119f2f9ca5bbbbc50f544bdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7310e022eacc7e02195c96a306a3663

SHA1
ce16200d75056f54959daa3e7a721f357008abe2

SHA256
2d71bc9630f62c7f409051eb532058bafdee4472c9c5ba04ad55dfa28ae426a0

SHA512
2ce7555c290d5835abe210fbe32832bf012b47e9239b9153295991a641a0a55ea88296c0a13a707775fb4da2089d1ec65a3f5d157de961623bc9d2021f08cb64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
458db4cd3fe8ecdae699c147b5bc11de

SHA1
357d6713890b9d47710c7beb2bba75e7ba940537

SHA256
5d48199cadcdca7cf06e0a92bb23ffab826da17e984b92717cf8add4c0e27296

SHA512
956d1e121f682294509828152dd81f256bca7cd3b9e352ea54e30f9eafee475098052e56367d212368da876a2d284eadedafb3a028e98216fe5d73f36db07a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
713f8136487836995e8fad502a5b2930

SHA1
9e58db3d294d3c25b02a2260ffb4b393ced55412

SHA256
19d341fc3e44aec016ae5070c21bf3f377ec4bde4f854ef4b918a30cd31989b6

SHA512
b48bcebb5ef4c5c2b97c106c7d1e69fdc924e2443098909cb23b05f2da6fedffc6a5e11e960861d2adac8eb236b70a387af2e7519ee4077af66518f5fae55c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4f7c12d8d2c36fb91357523116a1724

SHA1
6a66aea3ee93992fa4ac94e219412828b02b4e2b

SHA256
f2dd591d2de6673ffe0eebd4da934c67e0e989da9e4aa0dc20791292b4d37d82

SHA512
0fe79b524d52d5386873a4a5aabfb98b7c1500cfe9c38ae1ee4f24e609a017af92fd8caf7afc24544e0f2db3bd930d68aecd2165d14a0a81e03c0aaa31560e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cf6662d42ca7013bd33fc6657237eb4

SHA1
628aebebd6e384ecb14e1a7c799c0bd26a749efb

SHA256
ed7727a1d63384a85ec8a3bf06298b94a39c5765af3f9447da85df8f0615c82d

SHA512
449ae52cd1b3b4cebcddaba0d5d3f0206e73cf0fad161bee8a33828469c79fd659a15d91e1ad42c82be3870df6131a155843e105fc87bb09ec0b5cec1e9a9a36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bd85fc184639f00ad2c6ccfd4195a39b

SHA1
0105c52f6484c9ed746e6420bf364df2683a1fb8

SHA256
62cdf4351187be73f4c08b043c0b44e07069a71d166b172b83d96b9d5a407f97

SHA512
3877cff1e44b62a247c87dfa0292b81c9b3ef28d0a75fc61bb263c7f8b0d446b99ded8d7356bbe96486edc0ee5d5de562ede7ebdd05abdc45bb863b756ebe5c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb38332401832d654c097d7b99bfe35

SHA1
e8aad8c65262a47fed7f8fb9647905d0b8f1a53f

SHA256
231fdabc60c53378088bf28959ca42384b6907e53d11bca8d3dbec7beb2d53ac

SHA512
ba680d2a1f309f808d8a4a8aa27718915608acb8307e31d80ef70b00e0b71a398b399501ef80f6c47cb6edae078a16dbe82ff54095e485e40d02235461598a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VDJA7CA2\stockx[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\VDJA7CA2\stockx[1].xml

Filesize
324B

MD5
7cabff400d480b6dfd975bed0c96a079

SHA1
04d401b55fcdf81807bb0b9189c7927fb521c3eb

SHA256
c7e56789b5e467ad32c7a08959582edf772d8e924e8a93599f37fec7d798fd90

SHA512
fc9e83cbfca1742dbd69eacd371a0f902ebcc43e3423579394e522eeaa7690a6a559b04cd5ada9e5f88dc379bf3ae148a70ee139eaf036c4d047548946ca5292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

Filesize
13KB

MD5
657631e5930ee889e413c10aed016cf7

SHA1
8889e632a11db44a44641c5ba6022c800da7bbc3

SHA256
fecf342b4d9a2cd5c81b435543b162a23dca4679d985413863788b0b69762a1a

SHA512
6bd20ca9fbe271561074f1c124647e674fada8f524e4bbb43fc66a9ac7fe6555ef57cc7eeed4df68f08e6fd834abc2559861abcdd4ff39363272427cb2e2361c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\android-chrome-192x192[1].png

Filesize
13KB

MD5
47b30f8576f57383930766a659345704

SHA1
4b751a7df7c5c6de334e0e23e3d4e3988183e6d7

SHA256
35ddfaef12082db8855de8efa676c164e7b84262800abb94ac2cff97f5c782ce

SHA512
36dc8cc9c7fe5d3215996803f6fd694477275ed9d3f9cad8deef223b20033e9b03ce1eac2b3f0de528dbff226a7fc0853bed7d95802c0a2e3ddf92cff0c5df15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69CD.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69EF.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit