cd36cd7219c2378b9ef7ef1f00bd51e3bf2abe827782703a4e2d5e7e8d396519

General

Target

Formulario de verificacion.htm
Size

94KB
MD5

a923b69173b92d5b5e5990b3f922de29
SHA1

cb5db10cd60a7a400c3b3c7c7e6dab04817c329f
SHA256

cd36cd7219c2378b9ef7ef1f00bd51e3bf2abe827782703a4e2d5e7e8d396519
SHA512

b1280c0c7a7be0bb162b2d64afde977e282ee0cf9cfafad671733f394348b38ca9280001d95230add6a7f37a57768dd3fbcd941edbac108a321d964873a9a399

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Modifies Internet Explorer settings 1 TTPs 51 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913483"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e90cf0cbb3d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c530f0cbb3d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c94cfdcbb3d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339531585"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339548179"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913483"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3935043877"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b070531ee809046b39bbe3ab7d8735200000000020000000000106600000001000020000000dffde5d6d44ab4e5ed0873f9922d8716a5c11181501d91cb1c079c6fc30a48fb000000000e800000000200002000000097c4126ebcf25849aa7968ef10328d4ca6d8d6ed514bdf9cce69b8f414ccfe19200000009709570e09ae9fb372fdf8b590f0d60cb1d8e03945a8324f18f48b99a64de31a40000000447158a9883d914069b82012373fe7e667d6279adcb34ffcbde430ae0ff2d46265ecc24cbaeef02249aeae43dde8c99932f97fc54df1ed238d5b98de7f02a1ab	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3900354794"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13A28E34-1FBF-11EC-B2DB-FE8EF4155406} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30913483"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3900354794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b070531ee809046b39bbe3ab7d8735200000000020000000000106600000001000020000000f0a08745e0ae43cbf11b84c9b97404e3b8c254f204211fe5adcb9f7999fc5294000000000e8000000002000020000000d487ab80ed16fc59a68e262a59def69c62c7713514e5cfeecf17809118658398200000000fb804ea8c77746f2bc7c39b2e78f5ad81a38dda6806f9cad1ea1da6b1fd4a5d40000000cf5033b79f5ed7451f58cb5ba902d43e31227d0febf82c6c3dcc80e97ae24d62a33eb59538adfe776312db2a1e1655af5553f1a8c06e522ce1b5840b2ae44d99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001b070531ee809046b39bbe3ab7d8735200000000020000000000106600000001000020000000ba15566beef0080cab8fa8a2e9631808ab67c7c17bc882773953fc4b11d0487c000000000e8000000002000020000000e7010d9de9a191ca5a274fdd1b952983936a459eb823c0683d98d9bba9038e45200000003b1bddadac231cf46926aba18811a45f96263221b3d8216690b7f0cdb479d7b14000000070c1a3acad06267683fcee16d53a5b7581aeb82d63bfa854c520a284a77e31d71cda7d57431239a97a299fc86e6cf60ca93e346633121cde218f281d80707163	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339580170"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1400 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1400 iexplore.exe
1400 iexplore.exe
1644 IEXPLORE.EXE
1644 IEXPLORE.EXE
1644 IEXPLORE.EXE
1644 IEXPLORE.EXE
1644 IEXPLORE.EXE
1644 IEXPLORE.EXE

pid	process
1400	iexplore.exe

pid	process
1400	iexplore.exe
1400	iexplore.exe
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1400 wrote to memory of 1644	1400	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1644	1400	iexplore.exe	IEXPLORE.EXE
PID 1400 wrote to memory of 1644	1400	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Formulario de verificacion.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
2460f6c235d72dcc7e3dd55587b03ed7

SHA1
618a0b487253927a1f7a940f4ffe8c5fd8577d3e

SHA256
3ed0eebda555915876e538f5c649a6c0471fff0c3550485d61e0b4536e6a676b

SHA512
675d438d3cbec374914af4a4bf2c9d1f6730897451f325427928a666c2f43978e898374a15d88736b730d199db91c3b204b005b21ac90177d135b4b8fc02c45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
647b8d7bc982449272d66d17e09f119f

SHA1
fcee7e5a6ae28bbee3a7fe3ea22144b0c08f929e

SHA256
678a5f60df00580647a5434128825237050133fe3243aee397d68f4610e1b050

SHA512
21636b5a029afb2134b029db32f84a5ef0f143fbae4f377949a79cb0f453ac50dde473d1aab977d02724d7547b59d767ee03cf6f4de59deff0e81d3da90d5153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
cacdf2ef938ccec493c75c906fe416dd

SHA1
361be7aed571b0ef1e18d2670d3f3408e030e1af

SHA256
34463ac0fcd071073e137789e369c600ad19e11d92c1acb7dad7421f23f95deb

SHA512
f61eb07a083a2dd1a56aa406c2d0994b960067996e78de17cb045a7cc821674030c8183efe5e29b5b805acb60be2ed9d17355cec9ea6abeeda3a01b7ce2d47ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
f738499cfb8d875179ffcb48e69b562a

SHA1
abe0526079c5babc84f853398bf6baa6b63e942d

SHA256
cee6c2c6b569fe28799cf5c68f2519dd1f950bdcfbd787f614c204a6acf5dde6

SHA512
876c208018ce44b2b3a4759ce9f3c93bb02c417312305ff09fbc2a6f1acfc2a5a6ded166bae065a0b288f97a8a4ea31ebc9b80116aa8d1227ee4c33e3b2a17bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\I6NTTZYZ.cookie

MD5
31d1bc7673f8a44f9f69cf62fe566c5f

SHA1
d338fc3aebc53095ac71330a488333c4777687df

SHA256
dda3f22dcdd4b77f0df5979672a4377422f3a246fdb2f8f7ee44c7834661d840

SHA512
eed4d2fd60888379e28bdccd90fd5f27ffdc01e85a5d60d9f733934520dfcaee431ec232eb2edef45c9b7be3ed8ed1f23fd2ea05c1dbd2be008af6a82b8bbc04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JZO1FV6X.cookie

MD5
65ba10531463081a5c3c9955793baa0f

SHA1
3506ec659e31f70cf174a91f6cd2ecad65bdc2b4

SHA256
bf1b56bde2723dd7abeb1065181256a34abddbb350b4d552d8e6ac014d9982dd

SHA512
2a8975d6af498cd3169fb950487e9d3b2a1de0e34956df6c5a801dfeda7c5563e420732bb849560bf85bdb06f0438457a6f89e23e4b8377c2f0d8a718a77be62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YSFWHGEZ.cookie

MD5
dd3e6665e743bcd06d391821893239aa

SHA1
5f279625e1dd60bbabe97863dac5a95de716a4ac

SHA256
1e35f50f51b8710db40429a1cf65685bf231b4cb2e6cd3de5be8f5fbfbe62f9e

SHA512
5e8e19ce47460a9afe61febb4dbb0dbad9f1fa62b5fa9a572a6dec71f48cbd11530d0478987ab0d11ae9bdade5c2d746963cb58ee875ae202cf37ab2291ef711

Download Submit
memory/1400-114-0x00007FF8B9AC0000-0x00007FF8B9B2B000-memory.dmp

Filesize
428KB

Download
memory/1644-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing