3077d5358dfadec5956dd3db5a28c4e416332c5a4d44deb96b3fccc907f18452

Analysis

max time kernel
122s
max time network
154s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wifi_rc.html
Size

2KB
MD5

efbaf207ad3762724fd4ac6e58022e13
SHA1

4268759d592840b50c3fbbebee5a6758c42f01fa
SHA256

e134d5aa97d09bc401331f323e5b756c5571e902499d97de91316010ffefcd70
SHA512

f8015c27bd88680f3b7c466080dc7c5e5222411d80225c3433f86e76925fda4b781478bb5639c574072b6eb580bd111f08d03c67fb47cc182e1405faeff6f021

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9256A20-6ECA-11EE-87FC-5A71798CFAF9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ca0cced702da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403914723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000006e6044817ee3679e158b2800d27b2355447a95a81936a6d7ccc80acc37513810000000000e8000000002000020000000ffacc90fc35096b9536d94b3f3e6709ad5068c22081aa1d51565a0150cb1d1d390000000a26e98de6617e9af1a05cc6c314e122bc332e43e2fa379771f1192f1788875196a09a8926307f3f26d946a7068365fce87e2bc9c8b56da9eed7cc5badcd7e398ddf0f0fcacfa25741953deb231d7e31170ae0f83157228fb3eda5da9a058a4db06006e6f736308622f7185a07fb34da9878f9de10612c72bf88d82ecd7d274ef6842e6c596004a813bc7e8fe4bc21b58400000006271d8ead5debd85bf8c67dbff32cea2eaef5034140bc8932d09246c740768f45148bde818b2120fc6cfdce72abd08f64a313de12160eec70325fd547b549664	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000006ec3d02d092fa5b948e7d923e70148ffc8faea13032840f2350a9a98ba2e1e4e000000000e8000000002000020000000e68ecbb9dca8b060a184f0edb0755edfbda678ac1e536b25c37ee5a66efe6c3a20000000ea4d9163b728c11f62be370593200e2402146a20e70108f71e67835e1b12688e400000002b275bf13ecf92533602728f772900d8c9b2e3feeb5c9ed8e048a5027325647ad0b944cafbd3c701aeef7fca0b112796e65a6a20c43f45081444827052b26279	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2296	2232	iexplore.exe	28
PID 2232 wrote to memory of 2296	2232	iexplore.exe	28
PID 2232 wrote to memory of 2296	2232	iexplore.exe	28
PID 2232 wrote to memory of 2296	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wifi_rc.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54665f1e8e0ab9db1d2a5496a7888f32

SHA1
51bc29306171dcf3ad03ecee49a0d6cd2e176753

SHA256
2ee1d9a592c3eb30600562fb353324afbe3201dc3e0d305281f314fd0bd83cf0

SHA512
fb3fcae05f5634d17f56a155face07fbabddcee6c0672cc3543ec0af58b666c63980d46f2b172b0de2245de40e079d68a4b62d1b3e915e483659d90c23255e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d04f7dcb2b9ffb6f42b9c1b90d8356e4

SHA1
0edeaa1fade074c766d1d2e91d134eae392f5e46

SHA256
4f41f559a1dadc73f9e60329ee4c5c2a607b07642019c42ca16503fdd626597a

SHA512
c297ccdd0ddc069b581b25af4f907d3f28d32ba700f41029e5c5dd0e905b7d67e3bd93df4d74d810976c4ece3f0c994fa8f9945f28c57d23ee6d7cab07156e7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bf584c62a41e0a0428a859c4e027d28

SHA1
96705394c1c60355a13829983c77b16e4e72c20a

SHA256
f4fcd7389ff3dbe73519a2e85545d66a583391e5ba88efa6bccd2d9787513884

SHA512
6a8788c581627217f3ff169fc0d1b35a7289f24e8cf5ec42e367843025cf6da97821c81ec5e0641367cba81a73e3a6a94c5cd12b3d9a16a43e274bf7babc78d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83079039f79bd77806a4457bb777ea65

SHA1
fabb0f4bc7e6b15eabab41086acea60609013ef0

SHA256
77fae5c932329ab8816d55aad82cfe433c23dfdf26b14a7102d0e4547a3e5361

SHA512
ad51ae34505b1e11e0801579eba6bbca1410ad1561a78a4ac064a47c8679fa57d21e07704a02d9aa12aa1e3ec0ab1a4a07873e86bd9b223a87464788cd33744f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b58d0dac3248537db80baf9b1326051e

SHA1
6a1842ac0c7d84b9b4ef6c2bd8a177354df09375

SHA256
cf2de2558d93030f25c8c8022a0cc9f597055233ddb83d86c41feff0fd47f46d

SHA512
1c197274a2e98d3a854842a9b3bfb041ea2cca1e120315b078ce2e59d2769bd5670b456ccd928fdb8b51d55e8baf248e310845a7138298ebadaf95a92db4d766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55a365db228e057373d04cbed4794748

SHA1
260ccaff1c4230a2816ef7a012d517de69a71625

SHA256
647c27033bf6c299aa520f54f1b9d7173262c2f6998d89ed48d1d5e0156c2f5f

SHA512
98cf8236df214dcd2574d3331514cf156174ef1b5ee906f7a8c0fc54e2b3f6818521fb5e2505ef14b79f1ca00e7c122acd7f8e0d9aceff078b92b96f3386f59d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59206eaa0d8a4091c1bf08812ffb0fec

SHA1
d186e6bd40b15c828bcc43781bedf34dc8786795

SHA256
144a212eb4229374f01d8e2c0c7a37a8c41ba398db94c4d36da6bf17e1f0db13

SHA512
053b5f03da97d1b9a78ccaf252dd005099e88210eaa32786dab3230c538237b9692cbf0d975fbfaca428d14988c19ae7a4873ed100791535a41cbd854ad03230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54e4897c7ad81792a20ad90f28f4ab16

SHA1
4d85b2da4d8dda501ad78ec01eba3e476051c666

SHA256
0260e6b86751f66abac8c767d734e9d75745d28497294b25ab886d07a1bdca88

SHA512
f6c97bf9342256b85ed8bc0fb0a7f9993a26bdb32d09634d364565564ccbb896f245e5698685694c883eb884d0b6242087690e2fc782f00d07d8cf79b47ee9b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
749be3a834b779d6ce38cba3f87f32c8

SHA1
933ef9f63a8c0f6d17433a00f0d0659af040fd90

SHA256
0287db769c707cf3c3fd8bf0a919c22cb6eb6cc98a2c6807eac1cdef40cc06e6

SHA512
90f37e269bce1fa71dbe6e423b834488491e8bdc96d3a8777354ecc3372cbe4944043ee7823f62a533baf6d79050dcf20a1122c1ee4d85bd1a8c6ff07e8f660c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d368622430160d7f7268614756cd1185

SHA1
03da300f82b4e5cd53ca6f1413b4d23efdb08bf1

SHA256
15896e79e67e9f2cdf237683727a2693f6f0dbaa36f75d0b7a2ff449f8a4833d

SHA512
6d2e6b5dcc47f9ae797d820b15de0238a1cc0133bb0b9975219f29ba1e19aaf61e5fccc9a1e76a92c01ce957bcea11a02ff4e85189c163c52ea2be0a971b1341

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA815.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA940.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit