1ebdbd1ae10055d0dc0d56944788df673b866d6fdcf9d9b071b9a5d8798d6dda

Analysis

max time kernel
134s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-09-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tcaptcha_webview.html
Size

2KB
MD5

91da5d9997c1e6e88bb16013fd2972a4
SHA1

5678df78fe5f83ce2a0012246aa1bf9f625c5851
SHA256

15faa9670379fd4c06bff363d2eec13db8ec0c61a0d7e5b59cf6db7b84eda125
SHA512

f79bb52639cd1f6d889623c8204d9fb3b0d9669a966f48971911b39fe3a1bc95ba8285d24fec9a5e15f4e560471eadbc3eb431403f659e7fcba2f663a0e32cf1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef00000000020000000000106600000001000020000000e7d40e3bbbbaf7ca5d98fa2c9dd48cfaf2ba851707b43166ae74b34477610a87000000000e8000000002000020000000c43c117f24ea9845422b3de20b07fa58fd80f1a200d4614a1946783052fd8aa4200000006f1817a09f70800a2cc5072d39c0d34c64dc73786028d02b8cac9c7d2fc4137b4000000060c97567c1f2c8dff735abadb50b8c55b103cb91568ee6a8efb92df5da269bb175c952fa57b853369d7ce36b23f3b6359cfcd53ab1751bf84e44e425478938aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DOMStorage\gtimg.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DOMStorage\gtimg.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ad612020e8d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000918258b1c6eaef44bc85c7515db804ef000000000200000000001066000000010000200000004babb687a009f15fd736f1f2ce7e4b4992d35955cde26d2646bd379934cc64b0000000000e80000000020000200000000be0fb855e245bfa2262504e39884b820a1b4d35c2c1e1b8cd35b1264c1fbedb900000001057e23d745767735b9e302d8b057ceb5dca7a6cf84bf0d33c2edfd11114f61b32be14f0fbfc816b6962d7dff75718fdd5ab3c1f5c8273ba685cbdeb4ce46be8e5c9473467862c5f5dea09ae80fd79460e9be9afded1dc7f804c8db8efd4b6e04be9f50c3b0b376198df24fa85196273cf36eb5a990ab5c0c8a3b633fa0dfe90173cd573da9046f63b7710146cb3757c400000003c14406117298c2eb3a1d6cc85dc60730569709719646fbd467a41e79afbda597dd163ab2af4c3a7a5748672a3e0d141dde7b77097a161a15f23a1e30b4dce6c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400977100"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49B27CD1-5413-11EE-AF5C-C6D3BD361474} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1644	iexplore.exe
1644	iexplore.exe
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE
1176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1176	1644	iexplore.exe	28
PID 1644 wrote to memory of 1176	1644	iexplore.exe	28
PID 1644 wrote to memory of 1176	1644	iexplore.exe	28
PID 1644 wrote to memory of 1176	1644	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tcaptcha_webview.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1644 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa10b90efeb43f0e9ee74c2f3d158a54

SHA1
983f00cd37f429cdaf1cd92efca7d11569cd7990

SHA256
39c6f07fb65f07bd1586ecb4b85a0fa6dc78f191b3a7081d6e6716e96ec3def4

SHA512
fb2dd875da9862861439dd705739adbaad669f76da0726c8f424e3f7f24d1791eff5e00899485197bdb7d155f75e3792d1c2d53383e1694ce3553f83bbbc3431

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090123a43ce7ac5cd2451368c4f082ff

SHA1
bb271f0faf2d4a54a04a963a6462f3d80ebeec50

SHA256
e9fc4f30e9dbfc297bfa2f81892340df085d8bc5c4a023e120d922ab62e2f625

SHA512
a4cac8b683d9cd038c6441b3b43c13167f93da20cc043557fb14bbcfbde9d35ef029f7399b0eb710c3a5c8ef9f12eaa7abff64bb68422e74bca480e0bbb27779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
279b468da0dcb6f4205dd81d0dbe036d

SHA1
ad50b54fe70aa6a63e713b24498395cf49ffddce

SHA256
1c40ab050f78e34f6ef7c088dcb43a2892b5cd7463f1b1b7e8a2fae31d3a8508

SHA512
44730ee208b37b255bbba30923c65562650946feb994412191db0e06cc7c81221e74f1e414728f3c453b68ec1f5843158c754a4503881dc3e1bca2f3a81111af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69293e12ff31148913101e48ffae3d1e

SHA1
712b8c3f9c670f0a66326a1c7996cfb831f510ea

SHA256
d2d1908dea2db80d859c41e8427e66beb974bd35b37c0b559a24687cbcc3f03a

SHA512
742af1e1ee61d0cc639294281732505189722af04014fd218ece9afacc2a3c867fc8b312cca61a1b857c5d7a0ed988d7d74604a8ec0ec2d48c74c95d2b759d71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4411992010075be0bfbd964629e86bdd

SHA1
c0d296a0c234bdf43e2a3077ee60b52b449fa508

SHA256
5edce37d4c5617f7a01a32e317e625687edc16939afbfeb4274d34607ce0a62b

SHA512
8085bd3c2fe7dc478d8fb16a19ebea7379548f77e1c36942ecfa121762dcfd085fd3c2ce032b766695b5e112d11b70318a47d6bdef16d0799a2e069ac8d153ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f6aa6767149fc3c217e3af69419c014

SHA1
db59eccd2b1838d41fbbe69adb9cb8b0c3f25414

SHA256
45b25641fccf98701290beff3f192b18c4a27d9586b290a8139081180ef7bca7

SHA512
119ec53e9fc4c7c6fbfdc7b46b80327ddaeaa1b1394cb68d8165e86287d9ca652b4da131fd480e3f39892a81ca0f3b2b23467dd937c64430172d3848d72f969b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3413fe3a774060f8c8527ba400bdfaee

SHA1
25991626ef953e3e80f8badcc0843af86b6a303f

SHA256
fc1ac74e67d7968f35488b8fc1652467a7ba14ff0ee478e723c8d42dcdb8400c

SHA512
e033ab5b25576873a2f6a64878921eaecd495dd7f2baf696887ece66fea0920825e2fa88a73d3661b0347b05488adc12d498c146a1bbd7da16149b84130035ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86ae7fb92f6003bcadc10c97aeefd8a9

SHA1
f80d220ff6aa18c5abe4ff5c297765f19e5d2342

SHA256
a13a8533e1d56bbbf0702251a44aaa7fa4011f931b378b6138dc45253ab67dc3

SHA512
5116d4def06805f9ec6f9eccc26729a6528697aa20d977f614cc996b27b7232e3998e2d59c6e3c0d79f975a78504df181fa43805632de7d6dcfea8caf6958d46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
419ab8175f0ef6675b31b0f1b25459a2

SHA1
6910b012ca522b2458a16e9439157d91e6bf0126

SHA256
3733f22f679508d8cd71108224930d351d6e7ed7d54c7c4986233faa6068803d

SHA512
3a55746c32ffe6abca31f9f5e9adb53068b059dfabc0219e2cc0a5dcc5d47b40c486cd1286be04e4148f5821c85d69f107ce9cfe24a0a72e13317bf7b70afbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d17a201ed77752b942c41c760cc90bf1

SHA1
436718f14363c173c8a159ba6130c582f42df400

SHA256
33d6fbc0e32da347e9ac91c284ddb462a430128acb4618de365d7ef370c1e9a0

SHA512
6ab7d7edb69c909dda651a895b937c1d0245e66d640bb5b771b19eeb8090507035a361576d84f2dc508bdad012d41ff1788d37af71fd11d4264f874e83728fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
419d5e8a4c25e3867db95969a227060b

SHA1
136f39e364429c9e9ae06f9e2f6d548f1dc49f5d

SHA256
e0b50112b7981d0025b9d271378db9494f5a1d6d5700c3755746524f5b507796

SHA512
2da2ec032deff007a3943f85256a9d5ded2d02e87987843c0f89e4f1418371f949bac50f3b01555550b43dc6add27db1b7d76933981df7559d610adef8fe875c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6693.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6694.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit