38658ac74d5516bb56c20c604b95306dab9fc707c5662501225a8a6c18e3d7b8

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

consentform.html
Size

27KB
MD5

7a2ed1a6df8839dd8936a86d9edccabe
SHA1

7bc1af528444afca678905059cb1ba9fade65352
SHA256

d02fbd55c1b5da3fa1f77c52f5633421395a3bf228457521512b37cdacd65f9c
SHA512

ea0c3e512b37e340f4c0a49196344f1dd5aef38c469ba124605518e913be601a5b6a92a50f00e962bc90041bb80e51480254c7902032d894b7d24be5aec47097
SSDEEP

768:wEh4FOT6bJdK0D7fkvaqF1b6cY4c5rC28c54NTc5Jt:th44GbJdKoncY4c5Wc5wc57

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b022a2eb6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{162F52A1-3561-11EE-B0E5-CA145D9C6258} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000004a24bf4f6eae1fbb730d5d4394f2c8bd214c73c0bce9821bafd684064ba62bcc000000000e800000000200002000000064a9490f73d87028317f7c01864c70af8ef40d138faae80d04829280276f996f20000000423f4aa46e97b5dc685d1c64501fe27462645490d9b0848d8d22dd77016769644000000060d39d874c26a219ede976edc91307c4589e27fdd1dd0aecfc0b3e06bb1fff4466fc0efe2a4bff04c83bd216540bf6b3024fbbd1d564025106a2a4e7a62b88df	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a6162b448fa391f18b3289dcbaf71e95c0b927c77dbad232205d768d61590da5000000000e800000000200002000000036206997f5fe4d24845c23beaeb502f737c111ef178f7fad9061b0a069591dab9000000030130fbca06c586b21179391b4e268a50d581825a680f0d71e7cba48cc8ad02d26a6d3bb2ea5313955a55fe72c20a5d3005a878a47609ab7d09b2045fb14bf8121956aa1c61d82ea65fb66d5903339082e995319d2ae5d9e513c39ad83f7e1904c45bb36d7f4714bab32f75492e3121ced93dee9415276803cebda6aa6757226f83e164cc7ff2d36ae247aa50a1f74774000000091a589810a660f544f7f7b630cbd5185ade01d3f34f89281d798b604a7b8243d34106587a26845a41673077f81ad35cd8a0818aab934fec9969f40eb7d2a2aa6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397602031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2052 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2052 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2052 iexplore.exe
2052 iexplore.exe
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE

pid	process
2052	iexplore.exe

pid	process
2052	iexplore.exe

pid	process
2052	iexplore.exe
2052	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2052 wrote to memory of 1784	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 1784	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 1784	2052	iexplore.exe	IEXPLORE.EXE
PID 2052 wrote to memory of 1784	2052	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\consentform.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8646145c4f015c34dacefb4f3fb0736e

SHA1
34546978ba693c191a6e78e71b62bbe0b51a3a78

SHA256
c452122c7ab65e8ffbec96b638a861eee1ff5f956c39455d078b4c44dd46207c

SHA512
cf1ee34e4a600cd469ca84d0a851facdbd8af178ef3ce7e5f27af3b7ba4782c3243564a8d11852163915bc4fd53c3741162e336b5e59d4c41e6da9409267d61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83b655c4a071206c7ffb2aebfccc2a8a

SHA1
183cf3af3b9aa1d97191e3b7c3c503f58d09ce4b

SHA256
7c1c5a5e32a30e92a5990470b0c3ec35a6d4897047da553a4ebba06a9c4c25d5

SHA512
bf114be5d0bca3bffb84dbd71c457b7c32b3f1886bbe4d27be3ec0926daf8fa456bdb9832b8564a6f1672a960af2c6d3e3f6bd49b9698eee3295d3375a35b0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d8318d1049af3f7ce33ad0664fab810

SHA1
3ebab28cd2f1b6231ccf0089160a70465c0584c4

SHA256
c64c8df8948d17e4f15e6d28a4f860d38d993a91f97cc06aab9eede3b4b2e3af

SHA512
2a48241c261d2dbcaa663436269e4f6cb7c5b52bc7366876e4facc614970f4c519b1cf14a16fb9cdf81de5039f49230e55df324b652816e559e59e239ffe56a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61fafe5652016ce3cf14e3200a4ad6f6

SHA1
a13aa1e56111b120576bf7db238955bec39e7f29

SHA256
dbbff816de95e30a501480fef7a633a2f4f9a73ca40bcf3f65ea36ee95ab97ef

SHA512
18f872c7a63c4835d782fbd0f47e7c7af4bf12061cf3e551006fedb6fa57211e1b897de8412dad0cf27df9c7bf8f2b4be51d3e9a48b03d64f58fddb51e5501cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8458bc9cdd264b63acf7fd3390919a11

SHA1
a8c6b2449c924f1a44d4e089f0e148251a43e2bc

SHA256
cfc4b5cd74a4d682d06dead6229e412c8267021ce8137f8e240381d3ad7c1cb9

SHA512
2692e7c56e26fa4f9f56254d6c6a64c722d2f4e88d17de5bc6a5b922c2f4cac6eed7dfa0db3dc150473a0ae5b06faa52ec5bd1baff8f59fc6496e684f0a390c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c1b5ca089d308fe8405e700351f71a5

SHA1
2c5e4e618a4c99f8a7be92ea92365a6ff11d78b0

SHA256
236cbcaa6c523b21a6f17717c5a8fa6643b0db11b50174b878252e9c17d55d09

SHA512
14ce62ed6b1c8469b5998e9d8d7dab6af68846b739b6e6fb23813a82d5f43ff79d6785fc62d026cdfdedb7335add7120d0145c2d82219e3833bf245225361c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48e13d89d26e1f318613a3857bd4ac64

SHA1
39772d6ddc4ff9d215d5f98b6a36bf64272dc5b7

SHA256
45275d6dcbcc5b3b04e0ae8a6e7d8118e6ff34064c79e1f9b248fc39459373a7

SHA512
99fbdcadd706224ed0a970fe80860529dddaa285b7b2f866415b754e82f6db01954cf690ba0c5b70b03e72c122fff608de46c62635b8b22ddf52735f6efe96a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be9abdbf51bcf1fe5693eb9de4c7e292

SHA1
e760916a437d700432ef9c7c49c2036afb40d51b

SHA256
060d38b14989eaa46dc34ee5dd09bb7fd25c892bd4572acd15cdd5b55fbad495

SHA512
ef4aa0906ad5ee0b0251f3270bac8929f4f72d2532bf0eb443660f826af4973c8780b85a0828c2553e12bfeb2505f06e5889025a163336f2670ea3cb237e4af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1BE.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1BF.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit