hxxps://shorturl[.]at/ikQRZ

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shorturl.at/ikQRZ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411106870"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{769FACE1-B034-11EE-A371-5E688C03EF37} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ba3b44f37835ebaf898f7c9c72cd0db966099d6bf8640bdd651d39c988280b28000000000e80000000020000200000007e07173254186ff7c30d05741da21808ac693935d84ba1ea2b83db20589cef539000000013e1c6d7fe78dfff30a1529b4e98377dda50bba8ce4268cb248983670e1f1654420f640058810d99d9dfcedd2a21c44ceb8a0396da5c5fa466586e580c4b87def941e69b2a3d02f88b4a5d1371dfb1ff2ba2166b37350055eb771bd9eb8864a01c31bf17d2b1ff0489d9312e2087f6973ab1888a4dc3b3a652ddc3511d44f7fa212f1394806c88efa2092d0b7f001b1f40000000e2d64607bc42a846c1fed4ab6fe7b5f159380495114d5c14897507b187112df7193c68f9fb2b85b8506c508998ea57e1bd1d8641c4598d1c36a1521eaee0a20f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002d84acb87d52e31df4b7385a9732446ed9a6b8aa97045065155d324886581810000000000e80000000020000200000001b46c3a79c96fb7b90c2ca5f71aab153137fa4bc56adf6711ae85fa6ed20e887200000009c67173f79b9767cabd607ec27453c133da6b17d181b2ec47a464b963b51c81540000000ca1c3fcebc40aa7bd1a95a0749d2ea1346d4eb999f96662f652c5e83b6cdc96d0aadf37c10de05ac7a6855a18b613d80a4bebffd0bf2da14a99eca40b3e703e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c3e7504144da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2912	iexplore.exe
2912	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28
PID 2912 wrote to memory of 2748	2912	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://shorturl.at/ikQRZ
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38072e4187b4f3f5392c5febae834f8e

SHA1
8119c6ad1db4e658ba6f581be6fc97cfb8cac5bb

SHA256
fa6a1f1af744e6e4435ed56bb0325a48c9105b2444f8e8adf4ffb40239a8c28a

SHA512
5315db945eac1643c45e98cf746939dd964fc6a33e655e6abb4e6d218b6a5877e07f54638da0f3ff83b8a029694ba2d7ceba7452291b1564bbb1be8cd50dc32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
858bc8f9f996e373bd47d77185d5f14c

SHA1
64338eff5245722b523f7f384f1225fce6440372

SHA256
aa6f40a9669f43c74edb87314b1324099766ebb154c742eb635cacdafd5ba6b9

SHA512
a5d0636a07341851483c113cd0921ce480fd650dac6b6fd2a5d4ad06ee2291d22a3170e230a48170513a5579f0b029b5c3e7dfcba5e392c8199bd92f31f05832

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95c45cc0f95d2599f25f137c1cf342c8

SHA1
1506a5194585fe4da0064c18c612e5828be04eb5

SHA256
8f81e6ee06851f6ecc90ec57c1de4998526b5e53e38b9c353476418c07d1fb84

SHA512
f20442593f6208295349b30250e5b51e1e2f62fc10c157d6e1c76ec15c28db3280c7dcac94094d628fd3c9c18d3a22f19d672c715792a16e9cf0370fa52177d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cffd6e9c95e7a244da05e54340d0e6a8

SHA1
dd9512fdac4b24d4fbf9721b233491ff3c4d157b

SHA256
32f52974dd83d22f9bdb5231ed232d97eda6ff0c145905c861ee16a29428f3e1

SHA512
f253cfe479a960890b9a91d2c8a7f686c48e5b3ba7759361d1b0168a5aa784c24530a2f6aac18c11950152a1e1138bb4f121d705a7c5bdff07bc0efdc5df078a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5bd1b28e40537dbb9d4fcf8f66155bcb

SHA1
1368bb98441b4b1f25081473cb3e83d9bc3ba86e

SHA256
c6ab012dfa3f60e18f682dbe8ab18d6c17c8f2027e67120587d563687309171f

SHA512
63b0e93701c85bf5215205c79ea6ebcfb3d1fd1ed4115db156b749d43bab75d205be16cc1ab33b72ac75667284acbcad9a9b7c9852768a17abbea9e68166ce77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1adc0133db64b96dce95f309f2d2b070

SHA1
b9a296490046e8677ae277170dcf73cccc4d1e21

SHA256
5cd7ed664e17a1d09ec487222937f4e2fde8816a0173fabf2acfb74a265da5a9

SHA512
bd58dc0d8ec4e129472151c415737e7b8ffb398b5ccbe85552d94a06c635ae5f9cdf27a58e059550bc96e4103d5818e406fe6535381a89acbc0a143e1de49ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c161a40f2e59370d379573fbce84860

SHA1
a83c13007e8f7a144fac4fd1d0dc3f4d29748da1

SHA256
a9a1bb7655eb98775eb13117ab64a1ad6760a04d42d1b6660aa8060884d6510f

SHA512
a8b8b2c2a289eac8767acf4ba9d5bfb8d3a08e5fa1a4673e16fec4d6f43565d4d585686edbb6182d48f659e13a7bea237db5cd30238577cdb1dd950b7f912bb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b0f73b8457eee595c25e3049dded5ef

SHA1
fcb26ceacef677cde9ba5e708c7f2658cd5ba36b

SHA256
91a6b80bf7a52e602426027650330d6a26e72b7334a9358b68a66a47d1499e6d

SHA512
9c4ff8501f5f0a75a1e9cf96d262998015568ba9ca381c8184838abc46a1b64d01e5c63e895a3f77170ac5a1cd8b46ad69c49644516924f60c990a45d2727cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

Filesize
1KB

MD5
a83d55fdde1e3f87e092290812a37657

SHA1
d51a8a74580e42ebf8b9685dfe9a84873c09a65b

SHA256
8ac86831597e76ace7b68cdb84b045dd38c767984e446bd173388a739d018430

SHA512
7aa057c34cc0571aa7d079342f77a3c7769a71414732ebc3e14cc94c0e4bd247cff497eba1e7206c4816bf9848cf381163ef090348e02afbd391cde9c9a62130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\favicon[1].ico

Filesize
1KB

MD5
c651d44f122dd752ab399838fd0b5a06

SHA1
81585767215c1caf3ea92713a871651486532fe6

SHA256
70214f63b7587f091a5177934a7de1be42ef361d20cbbc12c29aa8a3a847076b

SHA512
79c93e7d14d5e4c389db649e0107b0c88de3802b49ddf5968cf09607a5dcc7495f1e6d2499b054ab9b3399743a1a4a06d6997ea2afd28d52db433017e4417593

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEB5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBE2.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit