Analysis
-
max time kernel
120s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
09-08-2022 16:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://delbarriovalpo.cl/welcome
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
http://delbarriovalpo.cl/welcome
Resource
win10v2004-20220721-en
General
-
Target
http://delbarriovalpo.cl/welcome
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba5427000000000200000000001066000000010000200000005bd86c283009cd4d32e1d87aef197257a487bdc82c0dd0cff0f66e9dc66ffe82000000000e80000000020000200000000e4be331666943986eef1e4be9e573d0e1e19f156d54d6c1fb8306f108d82dd320000000153b7a144555e957fc6529511a0faa1940d536825ce713d89ec6d8608e8f5b90400000006248f3a392461b80ca8ca87ba5551c5c222367ecb00a23af34a6363b75af8808e010157a7f50ad49ff0849a14ce22c5e00bcfec1dd1c6b907b65bc1a7f3b864d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f080f0c51aacd801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E94EA401-180D-11ED-9E58-CA554DF106CD} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366833331" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007647cecb75a30445a6fd9fb68eba542700000000020000000000106600000001000020000000b2fc0a4d7ed5ab1d293419ea02d8cbce01909feda20e181741e77a72bf288fdc000000000e800000000200002000000045270281dc3432f32665ed285894a0eb720b13a83082cb55263816be845656c790000000eb809734b039b99035c81cfd55c5142245850df9a31922d109cd7e4b6207f4f52166713146cf6c6b760a57d8f3fd779911b4f53b0c0032deaeec5ecd03095e468fc7c65df293afddf0c73b67ca82c5dbbb4a5a3f83d449cf9bc332bbd4be0c81d996786f1878e95e2e65ad88c0b4710b5ca32cacf021955696a25cbf5f1e825b76f21c1008431d0355d289a41f99d53e40000000b1feadd97f7f8af403416ca7f8bfe68a262cd0f32450dedc361d84455b827624d6274756badd8af8d0cd412cb1a4df6c1fe81754c06f772118facf1feee30c5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1136 iexplore.exe 1136 iexplore.exe 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE 1596 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1136 wrote to memory of 1596 1136 iexplore.exe IEXPLORE.EXE PID 1136 wrote to memory of 1596 1136 iexplore.exe IEXPLORE.EXE PID 1136 wrote to memory of 1596 1136 iexplore.exe IEXPLORE.EXE PID 1136 wrote to memory of 1596 1136 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://delbarriovalpo.cl/welcome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5e01b6c3a2ff6684841002c85485df701
SHA1e737993a93193881d817dc0af76409ccef33e653
SHA25647944abd2e9d91e000eec9fe32eb9705aea1fe28b3bb79af885c88d1717955a2
SHA512eb35c97795b58cd26dabcc877b670d023f8d0f68f03b5e77ee76fb36e446fe10d7e6bc74b3784c7ffd6033da9b2b7ad204f42aa68efec1c92a3a5a6e52fd9780
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\3uhj3kn\imagestore.datFilesize
8KB
MD535f6640c682e187582bc3fcbacdef17c
SHA10e3b459a57ce10c59a14d5c012373bc1c3bd03b2
SHA256bc7350fa05b58f276964fae55ed9e589481e2a4983d469392ce9bae747687889
SHA512ce21877c629a9a5b1e0d229d91b5bd563bfb74bdd97a4315b65954d9818d690e4e9e45e0b67ad32392033fa72d6a316a25594460af7c4ffaff1984e819e6c5d3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PNS34R35.txtFilesize
605B
MD5d1574603da042d415f1cc8e3cf3c2db6
SHA1cd0dedfa5ca5606763d1306925e0c7129c756c0e
SHA25682e41f486d5f7f25e89265defc9c4b5e75ab9238472dba2f785b22486ec62111
SHA51239cd1b952139ee1741d456d74fa39f8bab75abb1a8e3ed278252193e4e79ad91701876c9f75deccd6960730beb10f00226cd9d679edab426201d29d8ff0242cb