hxxps://github[.]com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot[.]sh

Resubmissions

11/01/2023, 15:26

230111-st6fyahc2v 1

11/01/2023, 15:20

11/01/2023, 15:14

11/01/2023, 15:12

11/01/2023, 15:03

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 908ae892d725d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5C8A401-91CA-11ED-A964-EAF6071D98F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380218510"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094aa01a532d33d4b99df8e26a1fa9d2100000000020000000000106600000001000020000000542d50b9c125869b65b695cbcfcd43ca3573b9b4a11bd1e037b3f3830be7cdb2000000000e80000000020000200000003d69561e01451608f933b9bc735d236a40df33ae216aea0aa09356ad34d8096590000000c170ee34bbe8c79cfe11fb99de1037349fe88971851d036b0d67666a3f1ba8c4bcee6a812e6a779c664c8fb3d1ce5a899555d281bb6cfeacc7a645d3c42e6b6e589453af86d61cee161490734366c1d28d2d54dcd4a9f1850e1ee70b7f8fb8d9272f4e048aeb6b85ed2a544079238a50f55c83b2e94fcc64f1964370b1277d424ad9dde8fa30a9baa47ce2fd7e22cf9f400000000d1cce226ce35ad001d7d3587ba43ffa968dc7734fe8b67ee02d6993f19cd3b92b1f813f17cac0a85de515376efccff3fa98bf8c590fa1b1dae800f2a19a768e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000094aa01a532d33d4b99df8e26a1fa9d2100000000020000000000106600000001000020000000ea75ff08e298f6e8fe2c81be70bbf4b8933d062c36daaade5c86ed6cf7d58cef000000000e800000000200002000000009b45dd72f524e5586ce48ab5865c7760fb83d881e0821f8dd056e3c82be10dd200000002b2ed5c61ede305276873d1d6a73ca852fe0c6894ccaab52406fc0120f359e2740000000782fdf2f00447e0e765a88055efd0a98b0bac2d0cb3389b663c280a24f385a34f63e41de9d5e67eda6333df7f1750cf422bc035e155e15edc62febd334af4585	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
288	iexplore.exe
288	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1664	288	iexplore.exe	27
PID 288 wrote to memory of 1664	288	iexplore.exe	27
PID 288 wrote to memory of 1664	288	iexplore.exe	27
PID 288 wrote to memory of 1664	288	iexplore.exe	27

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
07635cd5697a1676af8a345e0ebc69d0

SHA1
6fda20e364fa28f51428a776ace806bbf0ea3f4a

SHA256
645afa63fbd93a967aeb4e1f196d2dbbc8b9de2e90c0a208cc81f8ec178e0982

SHA512
77470637ade1d1e706eaa5857494dd4dc516534444d323d54a91509df2efdad2964712efc9bd482daf2db88df6e804b2e62dcc8461e08e7491086bc36583b4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat

Filesize
5KB

MD5
77e3fc9c6eb0f91cd721cc5d3dfdd2c0

SHA1
91625507bcce6d0e605936455d3a95a18deebe32

SHA256
7e3353eac445a111d252d7686c043fe54cd10e3afdcb49469d20cb1efc124589

SHA512
4c06dad3a15b0d49c1e99b05d011be7ee6511633546f312350d5caac7b71e63757fe06cde2792d479b4f46c608a354f8436a44c22009ebd9b0a0ea3959ea38db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KIV9VAXJ.txt

Filesize
606B

MD5
8aceb5e94137d6fd135e9260c288b7b0

SHA1
d5f1834ada7f0327690f0f7ab851a4136159bb1a

SHA256
896f1df82f5aaa4433b466836129d4c7122ff9b1def53c2225ac3221047509bb

SHA512
b708ba5a79ca5067225d8fbb18d1247c63cf06b06ff4c2adabae4911f08b5e3792fa7c2b7f3b1d8439c6591e24df4d1b72cf543f3e75abc6bd5a777baa4c160b

Download Submit