cd36cd7219c2378b9ef7ef1f00bd51e3bf2abe827782703a4e2d5e7e8d396519

General

Target

Formulario de verificacion.htm
Size

94KB
MD5

a923b69173b92d5b5e5990b3f922de29
SHA1

cb5db10cd60a7a400c3b3c7c7e6dab04817c329f
SHA256

cd36cd7219c2378b9ef7ef1f00bd51e3bf2abe827782703a4e2d5e7e8d396519
SHA512

b1280c0c7a7be0bb162b2d64afde977e282ee0cf9cfafad671733f394348b38ca9280001d95230add6a7f37a57768dd3fbcd941edbac108a321d964873a9a399

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50168B21-1FAE-11EC-8A5E-D272623A5E27} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a600000000020000000000106600000001000020000000a3a1bb44ce1622b699c323cb70f3de9f669e48b64e39c0e02e8745efc4fd550f000000000e8000000002000020000000cc218acdd4c8d7ba5516684c6b0017eb8e84f74394aa6dbcd4f2556e57a34fe620000000aabbfe1b2b1bb1ac7e3d5bd3d4f6b23679eb9e9594c57c9eccb6a513f638b02f40000000554249773d5f36dd9b6a84f7e36d03ebd1a581f451025974d9dc45e3b7180871284214950cdea45781e8ab90792fb00fe416704a796f87261c22030bda969024	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c040c226bbb3d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a6000000000200000000001066000000010000200000003e1563af37a65b9593d3f2f040146306748b70a8bdbc45b82e5608194e7bb859000000000e8000000002000020000000077c68f7ca727d11e12150f7aac6252cbb611ce83fa068f033765eaf8ee5540090000000e3f35a07b034d17cef503b9507dc525ba070589bc50ab07866ce549469b3f86bdbcf71b32c60846dc7b7d0fd960e2342856cebaf6f35e5b8fb1a195821e9a9c0a7e62b55812a5b554758c9d9430aeff22efe5ad17d3d6e9ac22b1ac55b0cadce0421c4cea8a14f4554827cabc9cc77e1055dc57db31ae8383f578038aa1ea2972118ed730693455c9f4a2fbec13830384000000024044cb8067f56a5bd6df2d62ce2dd8913f37dbce246f86e6b8a7ae7052aed53bb170ba7bc8938fb5fad46335b66160762cd49eb171740e7efec1ad531f3073c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339524382"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a6000000000200000000001066000000010000200000005c135a02711ba34718f8806975cd5c1b8a7303e2779752905e687693f9580fc6000000000e800000000200002000000095b4770a1d422a8b34980e98df3b2310158a1ca2912ad836b785d83b8ae49e2710010000c7bc3f0a11088a396480ecce1f51209e73dd0cb566bcf63ddc638c1d6ac55d58a65253728da0af94c77a7309d5369a337aa2b54d191dd77f4f387b4b8a2f6c4b31287c2510af5e7254d82b504625775b2afe1ff660fe465712224ce7dbe4e5da848ed2162929ec27936cb4b13106eaa1ca288ff84397c572e49ed1e36084274b253a88567a08451810496336f0d499a9a89ae25790078f0ceda6c6fbbfaaca220211c3dd8deb2e76ba5e3b255e87cf19f0ae580835ea5e063f6e32f2d1797636c7bbf6a47db1f168b37f2b62fad61e45d0d5052f3276fcdf525e96652b949d3197cffb1db0b8165e6b7f2a27d512ef5374f63f2f84bfa731854f985bd4a69835aeee51fd45b7e0c236c832afb6d06f594000000098ce0b47b9d87ebd488191adfa342231e7742b0ee6b07e80e87ec66e07e79632a96367da968e91ad97ee6b26696a5c7378c99e00eb612291402dd6125c5d7eef	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2024 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2024 iexplore.exe
2024 iexplore.exe
1460 IEXPLORE.EXE
1460 IEXPLORE.EXE
1460 IEXPLORE.EXE
1460 IEXPLORE.EXE

pid	process
2024	iexplore.exe

pid	process
2024	iexplore.exe
2024	iexplore.exe
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2024 wrote to memory of 1460	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1460	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1460	2024	iexplore.exe	IEXPLORE.EXE
PID 2024 wrote to memory of 1460	2024	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Formulario de verificacion.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\61WHJFQ0.txt

MD5
dd55de2c02b24092c54286ffe02053a3

SHA1
bf9f4ce5dfb88200b54ee2cc40a36f13a0ffa27c

SHA256
e39c9c42feefb7e032daf9110e30804f5a8895584b1493f893d080431e83aaef

SHA512
bbafa5a24b5bebcbb6d6b83ea058299e2d71f90b35f0e7e87b065d3a80ff58879311cd3443beeb74ce3d501449cae49d49e003b438df3a6bc444ab1f48ba0bba

Download Submit
memory/1460-53-0x0000000000000000-mapping.dmp

Download
memory/1460-54-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/1460-55-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing