hxxp://23[.]36[.]137[.]193[:]443

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://23.36.137.193:443

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6638C331-C1ED-11EE-A552-CEEF1DCBEAFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000009df956852d58aa53645ab747878152d3eae6b7c22d00fa6815fc40e832233459000000000e80000000020000200000003bdc0bed5478578e4c34fbefcde282e43f970b84172ca997416b459b697d521620000000e9f7401c25cadd4fb7dd0e516e045620d38055b5c9ceea5919d54bc0a843abfa400000009f2f83fa30fd6dae62c81068e7da52d2f827b253c546aec977578ab869a60f611c2171963bddb6be73621026cee412003bc7cae40c25bd2a8edf2bb9202267fd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b9b95a70db3ed122c3504ddb59c8000bccbcdb9945c216029edd654a26774d6e000000000e800000000200002000000082f6a136ecae8223f8b54a44b65ea6e9fdd33dfddfc030fb393037bd25a69ed3900000002270be0bfda793b10d084918ccbc3bae177373311b2aa912b3080d3f93f8a5531a398dba96cbe4b3dfb946fb3531b82a6e2b7612bda68f621102026befe959d9f97085a353e8b584194453911713d14f88eb06b626cc2781d00143526ad213bedc982c8490e62ab2146c8eebbdc091ff18a5a23aa7fc5babf972fc40d04ee894e32fa9adf45ed75935d8df72ac535a14400000000873408587ff03e9dfcbb8593093832b862389a77d8c5b0381256a5fd39854442cd52cf2cff7dff9304c38f1219a71c1f05385e356503c706dc91489052ca5e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02bcc31fa55da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413055455"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28
PID 2000 wrote to memory of 1744	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://23.36.137.193:443
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73061869bdc9d92956994303913f2ad1

SHA1
ffcf10b717517d19411d582e98c140746f5865bd

SHA256
d3e56cbd3968efdbededab66d04213a30d4c7953bbdc59c1a9e996a8a2d4dfca

SHA512
ee8040177b287327f54697f9a949e752b522981669a9d5bf4c022791f5127bf92d35efa9b5d2a0d567d5f250cef28b829e68ea312ee682f3cd846190811e30d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8d77d6b139fe0cdeb8a3a8fe20ae5543

SHA1
d565f4bbdd4396dc59500358fbdf22f6f3aa0160

SHA256
1f5d9450c38b6c60fe0ba873ed667c1dc560d5ebb3a08270726b9017a66c37e4

SHA512
d693a241bfff708d58ba247ab8506ea69dd4aa245b38256d38d20aadc9e197d4b37583bf14614bbe61e113180468c62d62d21d4b20d33065f82c7a8b9ae1d42e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
518b2009987648dd9f6f7c4243d2ca7d

SHA1
8efe4cfecc92a6e5c4ad2169276f590e8ca9fc80

SHA256
51c26c5936266ed3c36ef5f048f057d96295b06bb0c47ae9919e666ab1588a0f

SHA512
354fd688081cf23f4d81e8d78b133ff872e7913d3d11c26687f0218038ca915a355470d1326065e15a49df9e335825d560a0d8f280bd4faeceab787ab79e7330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1369256a1e2f5da5ad49f2fc57f888e9

SHA1
b7e0a9b98df3c308cfffe6d0172d910df6cc8dce

SHA256
422385d5559e3bf94c5941bf1c84d6f07cf82dbc9f662de30d1deb18ef31380b

SHA512
ee163fada845b99b138f98a74080ad9c41a279bed4b9586764020951ba4c20241542eb728d66daeadf2e25fa21ade9457918ea3342e9beb5622b9609a2a13377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f8efc4ccaba63f2c1b180f60a3f2ab1

SHA1
75409fab8e35d9d524077bc0a645d73eeeff280a

SHA256
ac786593770afffded1631d155e63d99b65320216038879bc0eeb9d43f45ee55

SHA512
9eb2fb405c8eab6c78a4f5a2c3ae6fb9565c26892cb9eeddd178645239be9a9950185439afcb4a26237c98eb6063950621b8db17d26022550852490e6bc3141d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d83c6d4c6e3898a999ecade555db787c

SHA1
5ef4c403c782649a068ecf55a1361ad5b5966080

SHA256
8330014ea7d25b1e8506d460f04ffc85af226f6591bad3b30fb698991a3c2204

SHA512
ff37729942db8301e0c663f300734e5d00212aa7db5c5defc16f2c4a2ea2409bcb9c9e0b208a79c31c5067ff46cba8fa8dc276cf4738dfccaff248efcc8d3581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5b0e146f9f1b55601aa4c57a88244390

SHA1
1eaf5516fb27df533b7a1bb3b5e4dfd79c862875

SHA256
b8889697eb4a54406923c69cb0cb097aa7b81d03f2ffcb11ab1aa70e2b6ef756

SHA512
14fa46263b605df3dfa2649d376bd10977984b47a8558f4b2f18e629472de2903e925ef67f6db53f068ddd6435833ace44a4471b23e7b273b02ad7a84e519712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
544df207dac1219f6a30c890b428cec6

SHA1
466ecba483bf9852b639421a124f06c4c1c07477

SHA256
11661f42ba5d0cb194913a85d6db191e9b3f2ef87a23769908a8176788b02ced

SHA512
fc4ec2817ee1f4c560be923096eb13c646df17fc3ac983743de7bf2f158e04735f0a6872c9c4be0bbfa0871aa3999e33d1f8b6d122970f0b984662d3b11f5296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2c3ef28a565866a0f3c5a6adabc0ae7

SHA1
39a9bd89d56eb35564d919d1f532be787ed434ea

SHA256
80f93408529efc59bdba4b00f9df4003b8369a0364372e581c8067f45b20b8cb

SHA512
8fce32cf2ec65d605eb95eb55a6a4c84594e03b3bbdf8857e23e74adc9c69162c438daf330a06be1976e8b2e83f13a839a880ad8a45254c6302d2093aad76831

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5959e45289b4aaa843fc31bb746a968f

SHA1
c5f44a037f83bb13986ed7c1f8b66fcd5905c451

SHA256
e5b0b4dd875d988fd3be2399a6f62cedc1e80d940a59649ea3d1fdef17c3d295

SHA512
3017c59fc75ac3ab6671fe5c2bc6b1fccad5dd594260676a371ea861881e61692e14017ba62ac291315afcb3f2cf7380b6b8dcdae3cfcf1f5e4bd05a308fce15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
257a3656c8e2b686a002f0198cc667b7

SHA1
a4f5101602c82e63bfb146ec696e77da9905f26e

SHA256
322860bce4187731c61c3164579d49e29c49a65fce4dce013095a3a234c6c22d

SHA512
835f891dc288e5cb3525aae62723a35c942f5153f89c439728271c7d48cda6aa713728fae67579f5acbef2b52a19ea3757b16359989326de73d42d3d3af06e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a107af0a25e8fec95e44009f52c337cd

SHA1
5fa5c06a8984e33859ae78c9ff73a8cb58db2492

SHA256
001c19d770586e1f62efab54ca91df1cb5ce796014090e2b54b14e1e30b86d05

SHA512
7026edf1693fb26642451b9c02ca097f9bea272c9e4d0168802b6c290325f1ef911a78c4dbb8a2103a55771c98393df743551f7d2d49b78244d2d4166d846654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c6063963f431df54a1967a43ecb9386

SHA1
16f40b60f71b388f575b1c1ac4ba8b6c977f6f1d

SHA256
67e11e6b28605581c69b39ddd73c2fd1829fcb03999a650592043436908d462c

SHA512
614515f2890b1712744bd82be5f9d1a566638f63ef18ea0c566ead35443d8727382e708097df43499005eadadb1f55903d5d1478aec01d1d3b78cf899eb25480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11872ef22e1857a4d86929177ff89927

SHA1
4f7137966d94dc7831e0e13f7a5998e68b0a7a0d

SHA256
f8d456c41a1b3aa79fde54783f646e3089d65e8c7451b9b1f15fef4058daeee4

SHA512
dc65a85586440c3562e8e722e90a185d56b202b1cdbd9d36e29e707356bf41180ae6abfcb5ea3ac32e2ec4b73b5f86bb755ad64ca966f07f029d7be2f8c0a836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc2eb031fdd63b816b6722d4840e4e17

SHA1
985c87a2baf2637d495860f15a8e3b232df17138

SHA256
3db0fd919ebd1a34909c2c31b09001c3bd6f4b0aa2935b50b307f3244fb0c427

SHA512
f9c1d8bf6e6ad8f050e72c6c72a31783c727b43799c6821196f6ea31448a7ac5740f94c00399b6d4e07ab3aa33324867d3a338e7073d1a4c2e8df258ca2b8001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeeccd83374216e2c7819172ca364964

SHA1
89cf4a04ae669e658575b9c5393a25c600e65c1e

SHA256
e9f281b3483de9f54e5405f9091e819bf3875a8a60428c2a1e191aa11f0871b1

SHA512
880bef720efef808713257f938a853700afb8de2deee487277ab895aedeb3e3c836688a6eee3e25f78e47814d59e7bf3321b21c9c45d32f970469c28d93bd795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b11f57eb37f9483e37ef42c04234ae50

SHA1
aac58fa25a008d312388fb9600d96730394650d5

SHA256
327c1773283f23eddac0dfd4b6a9a475cc64e9c25dd1df2053c3526ac4d1cd0b

SHA512
dcebed4148cf908de98644a9c06a7693805d037b6ee5ecf2aa1f84fe1e878970cf4e9219376e7889b374633ea73212c8c63e200e11d932348f68fc072680250c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
673f94b86afac83af5e4a4db8325dae6

SHA1
1dce2c0c24d7ad43959081c71673ca511a49b3cd

SHA256
60658e4be86ececac1ec34b405ebed02dc9782432f8fe2a6e1292bf3b6453fc7

SHA512
58875ceb9675b3caed0e9466643b638a29c9343c2b198cf067054114b6268969c779e0bc80b4dc1531d29114d811c40e091983b223b69d9991d0f46e81fcc72a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b6ec2263768cc625b3ce591458c9d19

SHA1
afc8cf6bd234018723663b692d624f6ee4be0069

SHA256
82c9aabe5034c8bfbc4d12493e38846c45ee566561dfae61e5ccb6aac02bf6b5

SHA512
47f4e184cf0a3742095f83149c62f6b2c578f338e5909699c85900608f63a449d63b05dca15b33833d96d1fc013529a63f309cf087e9329c2ff73c4f1d0c1cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60C9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6148.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit