1b72da2cc6dfbd3360322fb265ea69b0716b679a13ef3d769b35a5dff628835d

Analysis

max time kernel
124s
max time network
159s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
09/11/2023, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

consentform.html
Size

27KB
MD5

7a2ed1a6df8839dd8936a86d9edccabe
SHA1

7bc1af528444afca678905059cb1ba9fade65352
SHA256

d02fbd55c1b5da3fa1f77c52f5633421395a3bf228457521512b37cdacd65f9c
SHA512

ea0c3e512b37e340f4c0a49196344f1dd5aef38c469ba124605518e913be601a5b6a92a50f00e962bc90041bb80e51480254c7902032d894b7d24be5aec47097
SSDEEP

768:wEh4FOT6bJdK0D7fkvaqF1b6cY4c5rC28c54NTc5Jt:th44GbJdKoncY4c5Wc5wc57

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "405729752"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e71718400000000020000000000106600000001000020000000b8904774b801c8db49e5db1a4e07e8f85306ad8d59f8770939be601222b1a34a000000000e800000000200002000000092be8333303090fb6d55d8d4cadb8240eae67c6d35927635d97022cbc818bfe290000000ea8caa34390c8f80a8e4c2bf90e4c15190cd19e09e1642faaa50e1c3a54514b982a55fbf5e2ac03783fc1f647de835dad0db01c90763e1ffe59d0a4423d990f03bb86f8c45071368c5f2c5730dfbfa823fe13c222e816a7e01c5e171d355a8b68b6c901a238ec19973127153806470dd921112f13cad8f7483402e74a16feb17abd48cc19c40244999e1912831662b9540000000aaefd7294b7f72c74e6716df707e251fe88c4cd5d7efdc9d1e3876967ef91d12bc4f536d5dbc412eef1d7a4289a89f482729dcd5efa4b89717137f774c2cabbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e46fb45913da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE0EDC71-7F4C-11EE-AEB6-5E10D214D0C9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e1e81ecbc95de49994f369c3e717184000000000200000000001066000000010000200000005a7689d172d4a8eb61092bc50ed10248ef129730c00d404b3d2ba9a23c77ceae000000000e8000000002000020000000a58c5f9b199a16c0270917754c05a4af08ddf3706d76d114405b1d8c251a5865200000004105bea9a814d058482a3b224e6a839b40b8c9594f8559d60e408d23fcf18c6d4000000044dc7914a38c3aed8ccab10e8d70ba4883b49f589f5d9996161a7114f7875a91e2708d990630691b01691cd8cfd66864c6529f07a3e2f4e4aa74a30eac95cba4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2000	iexplore.exe
2000	iexplore.exe
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE
1236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1236	2000	iexplore.exe	28
PID 2000 wrote to memory of 1236	2000	iexplore.exe	28
PID 2000 wrote to memory of 1236	2000	iexplore.exe	28
PID 2000 wrote to memory of 1236	2000	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\consentform.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0baa57a2a9b3ddcc5fc51976b7a00217

SHA1
c2f8623c8ca6049326284ca063f62d4e140c9ac0

SHA256
48124b403d9fd4f2df11f48c0f56bb4859eecfae5cf91a46e4f7ac7a86a20239

SHA512
d5f3ad8adb61364b6b45994d8deb91e512bbad867ab5f8db12b1f1889c12c40f7a715dbad81174e298b7e49a033d51e9d6a280a55cff77cef0be06a871e1977b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627d1803e2330f4327b657c821b40d05

SHA1
b96abb066abc9b91863aab5241ba197004b49823

SHA256
5960de8ccd02b17d6b5a02706c4ad370bff3ac4f17aef98672ff28485d7be7d1

SHA512
ef9f4fd0cba36c489d8e41dc4a002bdb7ea3d2c6ab59a147cb7aeae463a0eb65d2036d1e580c339efb084b3325224e682aa6b3c2c97f4d8a87af9edc82bda83f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f7b0e30ef4a85817a38999bf72fe3af

SHA1
786710dc0ffc5a4b0a6de19f37349587da6c3d22

SHA256
8b1bd51962fb0d08c16098045bf30a542879c32d60dd45d9c4c103e80fc2208c

SHA512
9d0d642f1cd8633af00d8775f85352af04bf29ca1276d06d8cb81ae46976327fc2458d7bb3450208550c016978fdf6bbf90417240b449cc4a3e5f38950609355

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c442f14e1e3ed955ce49d5ef6f8af3e0

SHA1
35a68625c8d50720948b251e9051301da98e2df3

SHA256
379e58fce42ff0e90007c219e488d66caad61c0a37de81e858274f36776b142c

SHA512
03d4745778751596f09395648ff014e4062c727c64fd712b73c9567034481892945e3d81a2aa580f4363fa58ca2363b72e5cc28bd2dfe08decaf9c9a9deb7e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0376ca7f8c63636f28f2414830fda99a

SHA1
e287d43b35c74bee570db6be0c2e742ea0a7e226

SHA256
2708e19997f69a7d2c8e4e118f27bd204a659d99ead456ecc07d32c8610081fd

SHA512
653e79735b0da67641923ba8e76cfd92e6869e9a24dd12ed6fd58441d1399f18a4b5bc9c7972706690ac3ee89c0d925e53048341bbe5bdb10d97e0f0c1571ac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3d2c33fde02c467e2e5e035bf1d201b

SHA1
88b156d9ea3db463ff13cf3b5c2d2069181615ab

SHA256
b7f9822cf5db3b77fcd4a8f8f2a28cb4b2146a1b4f8469db238183cf9562ce0a

SHA512
3d68c208409f6f3d52733b56ec60c2490278cb77b156c9a590c01998fbd0d655d1f3ef28a742dc42b9fd91a388dcf59c0aa0baba7e8f66db9514108d193ac2f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6bd6590f6351d451749b123f51dc8a3c

SHA1
40649373d96a065a5692f7d617195d704bc8ba85

SHA256
923a60cc0a3f3acd8a95bb2194f05024362c3c9e61228611c5bb6825ce21a45b

SHA512
cea7a54f4a00a408d3cfefb078007fb5b0a509ee776b86535d3ab04f1fe73bf0916dcdf6be92d0e7a772c1ec5c326f855159a905417d65fbd47bfbe747892e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c070ebda90f5aab1ca2916dcd3791f64

SHA1
afdf284f692f2fcf5b75ca35ce4e091c50d2f446

SHA256
a6bcfd25b127be49bb080b7f2e292b5f2bcfac28eae8b56ed1837f300523ddb8

SHA512
5717ba1aafd72dbc83bcc6a3fa6600a6b989fe93ee6c5176676b1761635891269448b5301e8b697bba122825a1a9a259651515235f6cce6b585f22af3ae1672b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
771d6f8a86751a45b4e8958121682288

SHA1
7f0f4d525466b9cadd436cb8e8083e440982485a

SHA256
f842ce1d6c2d7e9ecfdaf452b9ddcc2a470258e62e865ff0edf7fd26fe04d089

SHA512
574448f5bec999387c62cf9e8497ccc05762afe8634d0c2cdcf3e3208929f01d9bb43b3edc6893d45ab8feef5244caa32be34c850cd8258bb52a116a8eaca4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a802ac1caf6fa9f780e6cdcd6af6d4f

SHA1
7bc3e34348e0494fbad08c529f35ba0285b1a38d

SHA256
438dc98938ce049ca5ffa69d8ee2500b7e1a7edb48b60cde2e7d1c3589dd83b1

SHA512
dbd5786d8fc80c5b37418a01cd0db3843e6825ee364a821826e7948b7c257e57d98793090a0c0c093330b49e7e6dcdd8260daf9ae74b0d7b640e6dc5bfa747b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE85D.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE8EC.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit