Analysis

  • max time kernel
    135s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2023 04:44

General

  • Target

    tcaptcha_webview.html

  • Size

    2KB

  • MD5

    91da5d9997c1e6e88bb16013fd2972a4

  • SHA1

    5678df78fe5f83ce2a0012246aa1bf9f625c5851

  • SHA256

    15faa9670379fd4c06bff363d2eec13db8ec0c61a0d7e5b59cf6db7b84eda125

  • SHA512

    f79bb52639cd1f6d889623c8204d9fb3b0d9669a966f48971911b39fe3a1bc95ba8285d24fec9a5e15f4e560471eadbc3eb431403f659e7fcba2f663a0e32cf1

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tcaptcha_webview.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    c687a98946f23b78d21875ee9e2aaf74

    SHA1

    65a990a97d5c8b4f028dbaad4ec6cbbce931cfab

    SHA256

    b9c18485a02ec2f05fbde853fa55a9ba9f478b4e6635a1ec0de4c3449661dff9

    SHA512

    b456be49d085359fca7489ad1adce0f8484dee9b0d61eadebee85b149617dbd021c4639a8920a918323f9da60ecca7a6fb7ffe8ad76ae13748599345bf50ba07

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    00bf32acf605f8646e9a77f8caf8fde2

    SHA1

    20eb9b7176b9d70a669f9ceb1b069e5f736f554f

    SHA256

    c5d75c8544debd3b0d99cece68a08110d3064d0a3e694b2dafc4b304b1bd750c

    SHA512

    23eaea4ccf9ca76e1f24c2c063ef97ad868c31441b357bdeef4d9c39c20191d44dffcaf16bfddbd74c408ec3b7d2ddde571672fcfe6588e4db5fb91c98eb1bfd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    60ca30742fb48c7bfe7be58845bc9a44

    SHA1

    888d9d12158d82fb21448065deb29e5985b9fae8

    SHA256

    d30f48da489a08a5ad5fcf4b8025c0e7715060e75c35cdcb227b94df519aca26

    SHA512

    743ee9b5ea000b194261e89d33ae7abe6033d9680927108f36bf8cb85ffa68154b1bcbbb9c633bed3e4fa08d2e093dbcd08f7068e1dcaafd3ae04ffdbcc24f92

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    ed7db1e3211f3d72247a6fd49f753910

    SHA1

    10e8f9c6f15debf5cacc5a0959f32fc7b3f7102a

    SHA256

    90c94e7e52e54cc364328e197c1c401f50e04b573a5dd3148c057e47d1a440ca

    SHA512

    d58c2b2c3212966cf5e603cb339b5128d018ff45639d54d06b5b046b8140d45aa4d68224f0e39952abfbf2c1271ebf6f159554e0ea9fe9b924a7e13bce7a1cd3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    ed7db1e3211f3d72247a6fd49f753910

    SHA1

    10e8f9c6f15debf5cacc5a0959f32fc7b3f7102a

    SHA256

    90c94e7e52e54cc364328e197c1c401f50e04b573a5dd3148c057e47d1a440ca

    SHA512

    d58c2b2c3212966cf5e603cb339b5128d018ff45639d54d06b5b046b8140d45aa4d68224f0e39952abfbf2c1271ebf6f159554e0ea9fe9b924a7e13bce7a1cd3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9edba0c766e86affb31ec6969757be03

    SHA1

    276804279e9a9f56ecc4f31243e7008251de2623

    SHA256

    aec5bc25859c9754f06ce2bb13774fc134296fed5e6ee13cea9f17086fe08f55

    SHA512

    3dbbf682100e0c9dd415b1d3e911944e8ebaad3d9bd261ade936a644bff63d1197656d899fa7eb280fd7fa7fb477ca04579e6ef9239b20f0090c742282ab2b65

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a2543e9304960e26da870b4f6da774a8

    SHA1

    a2027d9100dff86c16a7d7ce460f58b926eae782

    SHA256

    bed36d2331a8f481d0232c2701dd27decb250f7bb911c6763ee07ef6e301022b

    SHA512

    75c16ade7cf5667dcd792ab8d67fd154309a155075fb9019cb9774befeaa1e37d2a6577528a080b09b7886dcd468e4c211d8c5ad91079612d0b6d3d1be8ceef2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5f7bb0c66e989b379f83f3120e62cca5

    SHA1

    58d51bdcb86305c65db78a7a5671265c66f94ee0

    SHA256

    ce4bd08bd9e324e3ce9ba8f9b1e9b7064746af9569d2d1dc21d937f3ef695fa6

    SHA512

    d4643bd9d4919b9e72e5671d36e3006fc7051bc6bcae62f1f69da5fafe671c02d8976531e057cf60a994cdb66c3985cc20a2480913775948d0374f3d463201e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b0c4f6093c864ad44aba1a5fde629450

    SHA1

    4087676d03aeb89d02a65d12ea040e12f06d5d38

    SHA256

    09f2927ab356472809eab018cda3ef470e304a46112803845bcb08bdca956233

    SHA512

    39742150ab09b74929ae5e7ec29c3146c02585c664c2aedbf0588541c5833e71bac030a37d223dd87356396762cd2f4a55b3602b2312b9f79cf998e640858b98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    59795aed48c4598bd500fa19068f0622

    SHA1

    b3511c2f600a7b3a8e9d28495555c0a1a114ed4c

    SHA256

    80ae98e32b91f7a751974eaa2a2fb28ca1bda22e23cb3cc37f1d2ec2fe234ca9

    SHA512

    b9194aec01bfda64511331f0b278b0ee584e9e33ec9d0d6c753a5ede7caa0809b504e6e223e0a3d05de784bad1aa32b8dce0f52d8159ce461eafb4b9f107a3e6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    2b66ae93580ed2b4f40f13620ca843b6

    SHA1

    08309ebe7647293486bcb4c134400effd01675df

    SHA256

    75000c719cf917f9956837ac96d9c1f06d95c2bcac7caf04e624b244ef6f13d4

    SHA512

    9366bf8a3359b5b590cd460e2dc3e2ceffb74e625da768a8d7bee4254aabb1e4c255d57aeeb2b84d71610154a20761d7e63b74c48aa88da2b2b863b4122d2043

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    3c41346d9d06993cd28e358eb1e3949a

    SHA1

    3e99502353ece77b53decaaf1780014e08e05d74

    SHA256

    fdada72d7966e875052f0ce2e193fc8af311bc9bc24dd688da0179201c005b67

    SHA512

    90d3d5e168d9b7d3945bee6b3230bd281756e4d8d867a609adc7ccb57c1b6a9bbee10ca3505c95e1b7d37acdab5191d8007ac7cf8f382a79c7a73bd4b47e22bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    bf89774fc49967e7c0550d8cdbb7bc4a

    SHA1

    e9e72435eb3a5551726ff1b9add50a5352fbc530

    SHA256

    d4ce62038ac5c9956e9c9d9a11ee2ac8a50521cafdac0889c79a5c02be8eb487

    SHA512

    c6f1f398d4b81b523c0aa5c09fd1681fe751b6c44bf7a8a5b0eba4296a5a7d93e10efabbc69ab2d5ade3c9ced7dcc65f1efb5c594c25147e4f0bb68237cf5e26

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    92a8a78f062efbde312259d2cb19b477

    SHA1

    d467fc1e66131e4fb68a1b061c8b8eb553be2836

    SHA256

    8fc89686de8bcd31a5935b0974adb347609f84f0cb198f2bd4dc279da7e4ad44

    SHA512

    ec33ec77cfabbce7071ba57277fa8c373d8db0ea06cd8ea7093800225fec0134dd4e624c28d753c6deeb1c396cfee04bb793658c39795b6b864b74a57933ac9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b4dc0ea1233e60aeddf5ab7e779f1757

    SHA1

    f83c161c0ff48c5239caf160132e7f9fafcd3a18

    SHA256

    a77e1fff2c97306cbc869fbd9c0e1f79af7dc455b7f4e2214341710b71bd8fc1

    SHA512

    39e62ccd886b50341d3a86b1f1e08dadf61814769cb1989709c400267f91846ab09c041c4d632f253251f9a12e9df1e6f8fbd6572544aa6ba46c1ba049022249

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    bd3e66596532740808bb08f1b7763aa7

    SHA1

    8e9df5e215548d533969574c982a1e77653b6339

    SHA256

    015bccd677ae1738c200b44530a9b75f4d7c2d0096af256b6d9e59b322044fb3

    SHA512

    3b498ad60a27584b53bd3dba3317c427fb2b78c06d476af752b0c2ece84817543c3207917897ac36642c87e8b9e097710dc3c7a85cd666715cffb1f8d97c49cc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9ae35a8e8f1d0209b2be8afdf920fdf2

    SHA1

    6436a73be61c9c402a75c718b9d5c19fcca78691

    SHA256

    5ec69dab2e6196668839790c02b55a396799316d0ec776854b6b3bdb37572e88

    SHA512

    d9699e5a2e71baf07323ea9a82bc9c63a59da841931ecf1a212da5004de922c5d4d0534b2624dc1df3f463fca9c7a5fdb0fdff259835fe1ec37c51380159b33c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9ae35a8e8f1d0209b2be8afdf920fdf2

    SHA1

    6436a73be61c9c402a75c718b9d5c19fcca78691

    SHA256

    5ec69dab2e6196668839790c02b55a396799316d0ec776854b6b3bdb37572e88

    SHA512

    d9699e5a2e71baf07323ea9a82bc9c63a59da841931ecf1a212da5004de922c5d4d0534b2624dc1df3f463fca9c7a5fdb0fdff259835fe1ec37c51380159b33c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    af63bf8f797417352206d166cc7fa10e

    SHA1

    360f74dd429d8a3d83220c4c771ee0a563d54d17

    SHA256

    99145a79167ac291614647295b564490fcfb860df7f57301af9b1c2717e3341e

    SHA512

    b514bea24e650181548e10363f0d4053cb0a0cf65acb5f5ef5e094b2c7a61ad7d277643fcd9c5ed9e80d0e4071bcc5c9f3254279c92b300c3773f831c5a88352

  • C:\Users\Admin\AppData\Local\Temp\Cab933D.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar933E.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf