ace157b7c751c5f02a94f29d26435a82744e1aa2207dfc031997daef1f020bad

Analysis

max time kernel
100s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14/04/2023, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

molotov-tv-en-direct-et-en-replay-4-15-13-release.html
Size

532B
MD5

31503c72e58834a9a55ad07e06a345e6
SHA1

5af7703fe33d091df467ccb0f7f372144b53de2e
SHA256

ace157b7c751c5f02a94f29d26435a82744e1aa2207dfc031997daef1f020bad
SHA512

8325a1f1bb2e66ba176359cc8e5ed0fbbeb1820c313f5f3799a5f6844f145f29fbe470f09247a194691bc4fc643813d61378df66dc885215a6f75158eeff8a61

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09A25F01-DB0C-11ED-AEB8-C22C4A0458E6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2050f8e3186fd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc45899000000000200000000001066000000010000200000002daf16d6cc09c814f2bc3d2ec30e034ee32d7c5022c421071de58a229d9f56f7000000000e80000000020000200000001e07a7aa52e2733955ab553307c78c3976c92708a8beafb6e3c3effdfdd1dff190000000a4aa57c834b6d6fcd40dc553268c1a240b4d2c2f4dfcf5bb7378ad04f572a5810085960dd0ebdb979d8877c3b42e187989b3ef515d42bad1e9454effde9b4ee2e9371d1e81d581981dbe4f02de1cbfa6467113138b8e9f5a0f3c9d0c41bf192944f5ebaf0ebc2dc38ccef8e5579413f5ede59e3305f541390d9537b0de0c33bbfe0eeacb55d1f0f7d4713e4ccd4351ba40000000fcf7d3a7625624ee1762ee0bbe963c08539079f978e5054505745dad836cea645c6016dbdc3951cbfa8fa190c761f5119cb669f8e1df44c4d1cb5b5f261ac286	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388273002"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8a3886e844ee04ca528537b5bc4589900000000020000000000106600000001000020000000ad01eaf4fd2e02a90c41e46c315231c6fb623dbb3ff60c341b9b55ff34a9a3d0000000000e800000000200002000000098643ad6983a47259daaef890a1cab0238246fa95b1a725ed4d2409569be701e200000002c14e6fb17273c8eeb38dd289e8cd5cbb4d5eb2fc49ba3091fc9a4e159e5c32940000000187cdaca4ae65e3bb27bd12bd2279295123fff5a6c1cc6dc98ea8d39f1727e264269711584a67f9a0b72197dc4e699a5bb2222a8cc091ffc793caa246d3ce238	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
664	IEXPLORE.EXE
664	IEXPLORE.EXE
664	IEXPLORE.EXE
664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 664	1700	iexplore.exe	29
PID 1700 wrote to memory of 664	1700	iexplore.exe	29
PID 1700 wrote to memory of 664	1700	iexplore.exe	29
PID 1700 wrote to memory of 664	1700	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\molotov-tv-en-direct-et-en-replay-4-15-13-release.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04128050008ae0348e838864ec583d80

SHA1
6935e9bc94fcd8a1802dac3d0790623ec6054211

SHA256
0e7ebe1f59056cf9a071d9d89a9bf97331be4bdd859265acdad4be12da1a7185

SHA512
a0a56c12e37b9c8723cb91a4446f326433bc18fa0100e4804280819aa09909e11e64c4e678ee318670b79d4a7972cc45291fa11de9c96a8f58bcc89e6d440dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d05314792110198751b966a5667ca24

SHA1
bfa2f5a35402a7417f68fff3d985c2e989f73048

SHA256
82adf5ce83478049ff7f127ee91422de5d2421cf67276df586d05738191b80b7

SHA512
ea0f27a1c7e7349557459378fe534ad4e843c11dcb53e40fcac8fa89b7e523843d3a5181d628a6aba6adad7e7bcecb79e202572b713eb504dbaa084cbcde722b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1cf0dc9cd8f9c7e755d85817bfc4722

SHA1
f39f3ce2906a6b980250ad06a8385b37be2555f2

SHA256
1a98f00cf4307bc163355cd7ca925c745128798398f5739cb902899e0efb9b67

SHA512
cdb01b3dfb415845ee10bea471a39d860b01d3edab6e404e23dc05a7d9f1b2efa7e51eba5cbe3cf561a88757c12f31c8a70c18340876dad4c3f33ad559c13c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eda9617bf14f3147624d7e030c44fc1

SHA1
d59fcc4e3b8edd577f941d5ee3b2d90acae20556

SHA256
4c349df38b74d24ab6d497ca511b8d5027d472a0c86ecc2c2214ad5d2af1cfd3

SHA512
4a870b04ff9fe66ab6aa0201ef4e9cf9b195ceeaea4097f150b959a34d5fc1e30add6ecaa618d528626e61a8afcc48ed23bcb48082bc5c8b66307371fe7aca25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9cbf8f08937b8d1aa331c057b401e5

SHA1
2c787cf7685df5811ad21e047879e5d6a9f79273

SHA256
13559142560ffbb4f594d9c687c497fb74df546ae29939662ad927b007a64876

SHA512
44d472f35315fc88c31a8d236e8a3dab4bfad653b280d38005341c78fac84b470ef448086a3a6833dd82dd4b3ae6e8cb3f260a1100945184983538aa609a614e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
011aaaf00891278e9287f1f113dc06f3

SHA1
acc4b732a43f8312c9e7fb9e61a834079920c1fa

SHA256
3e71ad7f4af27d94b1d803ea7c1136ffaec391b9d07fce4c56968a57c3156812

SHA512
4f47e03f0a7e06c8a5877b7e3d133da812fd2d692950b48d0657865bc035d779a8ae082c37c084853532cf1e30c46ebcbb26872682720deec4d59033ec61bd70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e212d16d05629cb033413580736106ec

SHA1
2532a03368608b91c9f3e6c4715ef89421747e5f

SHA256
f24c43b1b7e00a1f952142fea2af9f36963fdc99f4cda69db616d56659e42ef3

SHA512
e141214da848d6aa41ded4c5065772553ec4a5f42e5d93b8d0d7d8c93aa3149def926b28b63ffc5a11d2140db8e49b1e21be598bf6418af749b0eec273f38a4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ebc1f41a8329956ef830c6e2daf7645

SHA1
a63cda2a981d9d172f4dc2406fb22e735987105b

SHA256
2487b8145f51a5ded5327c3b0f60c45ae1bb6f6eab46410096188acb50dba181

SHA512
13b2a34d1146bcbbbd3389b74ac6cb514ac29d2c6fecff1de148d46a6108d6f90312c1b66dee3240fce8ef59045c296f4ee9caedbb3970761ab6f3f9184041fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d97206ea7df092bed61a32f1f0062a0

SHA1
a54145edffbfee9883c534770c0fa272547b718c

SHA256
d24813cd0d657f55a1eb7ea365e9c15ab27b80cb414b64df8540b1dec6e0227e

SHA512
eee8d7aa68764a817949fa502d06e6171b16315bffcd3603312cf01a94b3ab997f4381e27adbfb7dbe22d940eaa6e2c51df29f1a6c0392cd7579412526515cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYXN1WWD\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45C9.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45CB.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4823.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SF1AODLS.txt

Filesize
608B

MD5
77077e66873c030eed4528cac97572f3

SHA1
70926dc1a32b98658bc21da00ec4721fdd862275

SHA256
9fdc8e4447a8f43bfec43dc650bcc33c1d0a791646ff614e6b8263b18f73a87d

SHA512
d1e17144dd2a80b48d2f756885f8a39c5b4499e8ec9999de78ef5bec8de2e4e85dbf0d3b13b9278f80f616d54c94f9b1f033a3beea7ce630b6f0ab724e16115d

Download Submit