hxxps://www[.]hybrid-analysis[.]com/feed?json

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.hybrid-analysis.com/feed?json

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 10719459f951da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412615303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E28D01-BDEC-11EE-9201-42DF7B237CB2} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2024	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2024	iexplore.exe
2024	iexplore.exe
2268	IEXPLORE.EXE
2268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2268	2024	iexplore.exe	28
PID 2024 wrote to memory of 2268	2024	iexplore.exe	28
PID 2024 wrote to memory of 2268	2024	iexplore.exe	28
PID 2024 wrote to memory of 2268	2024	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.hybrid-analysis.com/feed?json
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
1fb8d86643d7f7cb8f1ffa94c719b8a8

SHA1
c7f827c460108f9c14307d52b2f2abe70b6009d9

SHA256
2d9f0f5907c545ad9381ac533bb280fde00e70badc5c07f88d2f086931f4658e

SHA512
0405faca6c0ba86a3b83bc2a0e85c2e3830fb2a6535d2fa4d7af0e065ce8a612998b9b04bc5764af7eeb472007e30df87ee9b1c478ed30445f164b938d82873d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cccf07c0f83d932f39485f8f5ec053e

SHA1
a8bdb717c9a9eb274c57f2beecd3044f17a75578

SHA256
357ea3bb4c23dede9de8419ef6500fbbceb578eab29c03d678be79c15e43f2b3

SHA512
7455f144e5d3075502d53d7a501da1cc7e5a43fa35178280f16770d1a95ba5f23a523ef4d5d552bf7164c42d5cc9882718029f8333aadd5378d1e973b180f5fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4dd1f944ed6f2bacf74d6ac83aeff34

SHA1
ce0329ba271dfc970a94c93c8c0b2c1117921f4b

SHA256
7e07a77e0e825b8843ce49c54f3c93f2d35f0b64dc8fc67c20c1104fc033590f

SHA512
75518d05f992b973643d25d83f10f76213eb54721f86ec2a16807dd0eda777601f3a5b6b96639cf997eb85d257c01609b60ef71269b802b552ecd64db3e3fc47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f50e60add7f88cad60812484032bce1

SHA1
5f57d5c7296db9bca64a1a08c513692e245984dd

SHA256
1ad3e66c4e9276997de086fabea65d7755ca06f91862e3a30e5ece7fde17c5e4

SHA512
770bf50a3f2f3a95e6f24e62b6070f3700c51c4bda7df100eff81cea4e9ff435246b83316e0b220a7aae0731e817fed9be97fd4d74e33f2c903f325caf5c5728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47c9efc921488a947593d85a6c18b005

SHA1
02a20f05e3b07fee7f1c9343984a55905bc01684

SHA256
6ecf51fe1b370fa8c94e769cdd9dfe540867f04fb66079ca9b1da3fae2876f54

SHA512
07fcff5a9f536320a927c446b149c5d5297569f9e7af70897b645f5add76664844c9bd8f2fdcdfc1f219c66faba7f91f0d3248d9dbcb887151840aa31e38930c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5300d95a352c16deae9dc66f8bbc15ba

SHA1
4e7fd4e29f064ffbf829949e7755dc5acceac7a0

SHA256
9ceb202804e0a277a722f054b1fbd574c2984d52af075cea0a8da7174d4da29d

SHA512
2e90e05fe01f3219f33d9e0f129dd8d085c19f606dac2b9eaabe596c08140b19c5e5320b69e604386665dcac200ed12ec45dbc250d46bf495fafb2ebaa400959

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc28a55c032aa3f3f198bad795dc9aa9

SHA1
e5eb19ef32d3f274d5f61f85d9b9f2a748a66c0b

SHA256
fb341baf65b08392c71fa353d5c3bd2b20179db9a5de90786a2be8f15d958c68

SHA512
8cc8094116df95f94397d7bf04b8e4b3d9a5f3a525b66d9dc13334baf2a4322d3a90144b55618a9009ff20d1ee073d3dfc928681717c91b99ed43980ae926623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f849d04dfb9edc9575f07362e336ec11

SHA1
4549c434e7256953c0f181e1a76965c6e64b7fbe

SHA256
938455682884e4e2c47c63244a0dc93fcfc8338fd0b93fe2a4e32444a8ac4de5

SHA512
ad800364829cea75bafd7c0a894f0d9a4db2b683d3f50d471eb983034ae16fb4068ddf7f99f6c440497b36a62dc03d731927e8ca3d2bbbeb9bfd771774f5e3ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8bc4ee6b8dc745c5769dfd0b28b79dc

SHA1
e6b58b4922daeba66f8ecee559ef4a89984e7b02

SHA256
2a2659986216eb98afe2332322c16eef55755139666220dc290dc6f8b46f9060

SHA512
2a9ec629018e6eb9d921e1fb26421f62131de72cb309a8c36dcce4030be7a6ff127b85e1b4fa7bba9c2893c1be1e5a7350d156513dd89e3077255398b5833067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
adf5af0a12695d754b1d856ee00f89e8

SHA1
e1bfefbfdc49fab55b32afbebfd4b5f93a2b24eb

SHA256
b7facf1dec9e93351068922dc000c1dc34ffe6bdc021cfe3ae33461921ceeb17

SHA512
847c6cd59cc7c12754bf0b603508fd6fcc779f3d83ea06653b5c593037a3ad2b9c3019e73e75c76776517a6582eb9574be1438eba5f63b189cf4c2a8762c8ef5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a4d1a9689791e80d38d3b4f4b50497b

SHA1
16d2d78e3477df58c63568129c1b65d2aabe7a3d

SHA256
d936d6581f5c2a01b2d6071a3df1f9cd96ed14b6c103be74b3d4cbcc9e96b805

SHA512
2ee4cda98d0862fc187ddc3cde76e372a123e0ef5923fe50496fdea2404acfe2e1c7fad39cb2aeab6696be91bc86f1ca458b19dd12751afdceabc4b09efafc64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52f439e56df1a187721bbbff35e6e86c

SHA1
26ad0acbe02b5995daebe379b3fac2fb5a0f1444

SHA256
b3efc36ec2d9f95553b0b500ec874be829d7e288a3359abd380a951686a5c10a

SHA512
245c353010a4a1eacbbd0c86653a1a15cebc35526f2236ed5a8c7b47689d30c00a0294cbc38028d4d37662afef9f872d8d1121baed191199cc88974539595331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a610d2301df41674058bb6918e049165

SHA1
c027d5c24c5b730e422a49d10f5dc96e39e8fa04

SHA256
3a5eeedc3500caae9e1b29efacd7e55a90a1ac5449eea62a3444822eb63f4ec5

SHA512
9edf4c78fb89048c8e85b241a524db4f6c4f5556fc6f26a0327869b4bda24f55c3b09eace756f4377710a8bf3aeadf735bbabff6478300e3ffba0f9331ba6399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0b05ad63cd1f2918ed81df8b1234fde

SHA1
defa4d0dd880ddb96e9d9682a2b6da03a0f9dbbd

SHA256
548b71f4d0479e20abd5764b3ee9fb37ef014519c2a41655c3da1254d62fc06f

SHA512
c44d0b30ea894ae70f89c8f1f5f21aaca7b48bc474d4bb3a72943a4b3de6e97b9010d3b72d92aea50a1d515dcafdbe907c5067b3cba4d414d80fc0710dd50dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bc8bd108dbe20520f1110000a63485e5

SHA1
be95cc14d516fc2d8b3b989542293e527fd4dd6b

SHA256
94b0c3a643eb0d454aca6d6ccf38ca9d717a779e860f884ad99482f8e4dcf50e

SHA512
b802eb695bf41d23dcabb06c249b4e69ccf3db933487eada745c20f1ff0a9df2bebccbe641d3e2e0e6df08c49914c317fabd2af64c07ab2a048e2e9fae58743d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5245.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5315.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads