ae049268d4f174944bad46b4dc1a93fc3eebddd96deccfe9342ff55bfc5d8244

Resubmissions

20/12/2022, 17:16

221220-vtedkaad941

20/12/2022, 17:11

221220-vqg1aade6w1

Analysis

max time kernel
54s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/12/2022, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DTEC_1638071393978027465.xml
Size 11KB
Sample221220-vtedkaad94
SHA256 ae049268d4f174944bad46b4dc1a93fc3eebddd96deccfe9342ff55bfc5d8244
MD5 cc105e744b4bd0df957a5fbc0ccdfd04
SHA1 170b4073d101702d5fffd9ecb570b7656d2fac05
SHA512 ccb04de07e5a637d103c9e217a34f445fb7fcccdcc02b2eccefcabebcdf3fe613f071a6babee42a302cedc1ff81450e312e0f759b50ae76f4092e5934f20e1a1
SSDEEP 192:wrUoXhjoipmHTOwa4ifeFB96SvDJHwe/vrgrHTOwa4ifeFB96SvDJHwe/g:BoXh8/zOCife/96aDJQe/0rzOCife/94
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1398847339"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d000000000200000000001066000000010000200000004c4dbc9109769ad793e26a6071acb2722adc8c24288a27cd780963dc5dbce74e000000000e80000000020000200000003763ab3d64de28496c5482b610a41ade41258f5ff402c1c0d30148dd32e07b7720000000f23ab151d5db8da0d3c3ba0f2d28cc4e51723278a86c3c90e21d256cfdb8bec440000000e4dae1ee3ccc7d0a080ce74b483b9fbbfb6dfad5951f419c1dc012d5f6879830e5d29d3543cd2af73889b4059f7eeb897fd0991f8a6adc208bbcf2274ecef2d2	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003807"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a002df539f14d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7E3BD4F8-8092-11ED-B5DE-42DBF9D6FBAB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31003807"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e9ea539f14d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1391346760"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1391346760"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000162f29bf94a1888f85d48229e0946869112a47f636fb5e45b93e8b671eef37f8000000000e8000000002000020000000aedae4137a02788358e7a8a9cdcb2770f32459a20492b887e119d9105626706820000000bd3dc6b5bd0b2599ebd71ec1e6db27adaf988fe6af71d2c1ed9a7b895dcbd6dd40000000b6762dc365dc884ee93ba4510a8746f6b6e3df14b0008c12d6b53c3ab7dba319f92042d537cc79504db64fe9a79d48fde2db8db213f45749b8a00c2311080e1a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31003807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2436	2604	MSOXMLED.EXE	82
PID 2604 wrote to memory of 2436	2604	MSOXMLED.EXE	82
PID 2436 wrote to memory of 2008	2436	iexplore.exe	85
PID 2436 wrote to memory of 2008	2436	iexplore.exe	85
PID 2436 wrote to memory of 2008	2436	iexplore.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\DTEC_1638071393978027465.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\DTEC_1638071393978027465.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 db88db8fc754f8e979b7061497f98362bdf7c15984f402fe90586983f88b0b2e
MD5 4be9ab121a39e812723996e08985a451
SHA1 c86edb51927e78ad75ac6273e287a4187f54b8ee
SHA512 d8cd3a478546529741f1c8e7465014f3ce906994e94a5c8fd55167d6813c73841ece72c98d5212a23282633f841b9d13107954aae4a5256d66a9235c7caaf8b2
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 434B
SHA256 20a79104de9ae2a9dcffd33592506a11fbf913209b9591bc64b170a5dc901dcb
MD5 e64b56b2baf7d158677f10a320634f59
SHA1 92d47912ccaa132484b3293d379779cfc2463571
SHA512 7f099387b67582e50037f7deb54df9c158c14fc3317c50ebabd8ae6cdc856cbeb4d7c4715f0c939bb16a4dd4b6eaba664b5826ab431e8f8d8f0c19a68d401a20
MD5 SHA1 SHA512

Submit Download

memory/2604-132-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-133-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-134-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-135-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-136-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-137-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-138-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-139-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

memory/2604-140-0x00007FFF2D050000-0x00007FFF2D060000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads