hxxps://www[.]ganaderiapuertaparra[.]com/

Analysis

max time kernel
78s
max time network
139s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.ganaderiapuertaparra.com/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f873239536d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c49be8815c13034198d414fceb114beb00000000020000000000106600000001000020000000d462edf7b24643e7f8acf0cd537eddc6f640018555c6e1df26813093bcccd241000000000e8000000002000020000000bc2ad580a3b7ef2aa29684e8aef44fe0e2008dc9233c9b1fc0f1fc0abe97c07a60010000eaf46d10fea29f565b3c0e3ff8db99dcb3719172776715c4e236d132c38eddb5c0d6f753fddc5a2908e90d193e6e52440df1028a59a16c73c093d520a7a882b5846c610b93a0faa1a5b8b13e17f62d350d4d451677d35fd19b8d33f98caf4e9a5a541135b93c7876bb71a5db09f37a412fc835a660b6ee99c3d69aad32757145426d18ee5a7b7efa4cf045bf4bb2a04ae994542e9bb6fde8a2a27e9cbfc59640024483a3f7a9fe30c2fb03f2e92f8b5a87560b919eac2661531b467701b44423c8e1484a5f9a22894b875ff3790e5b1876d2394f1dd90a541fb258567602dc2cc1dbae606fcfaa58147fd6d6c6ae0c208dca868c7c8b9f7781c650567bfb5867fbc5592216514816559a308fdf45f65b4c8a0c8d1608a935f2b2e02068817f50561c8bb69c24b0e4e939df466eda01c33c249a90e43f520dfbf465aacfc30f748de4a915a2fc8c7305443506a3db602277d0d533987dbb2778f8c37bf19dcfdb4000000042d7de15ea250c5e6fac52c401475ed3e945552a84522944a1bb5355f3e850fce8e34f265b4f4d67ff5a1b47a09be16ff78786b49604f6acd9d8224e513fdeb9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382059153"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c49be8815c13034198d414fceb114beb00000000020000000000106600000001000020000000a185b7ee6fd8f81066111ba97d4174b1971b5eae7b724b3789f0b5e0c2b3cfcb000000000e80000000020000200000007aaa837ce465b647c8c66c30ba22ea1c621b039847a16153ec47bb9c5c1c3dc320000000014e220a4d68db69b4332e50d48a39d6952e1ca339ad6860254168f4cac8edbd400000000b1c56388de9d131a76e07c9b7511011de23b0ee7255b3253fbb7252391ff2afad389a0d1044abcd6303eab72a2b97c26511a13c13cc7e151829de82f6b2094a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AF5AD21-A288-11ED-85E0-FE41811C61F5} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c49be8815c13034198d414fceb114beb00000000020000000000106600000001000020000000f9018ed728cb2d4c7197f426572d9a398cad5580abd3edf1258a58aa622378c7000000000e8000000002000020000000fe6ccb2de4e3c48a456150be5259f31394e6ea7430ac1302487a2abb546680f46001000001f4a70514cffb24fc0223adb8b0e6df59f8834b5e7ae1006238c31dba7eba913e554d5669fa9adcd8b9812e8d06b5a7bebad50545b3ea8c1d845f15a41db85e09e15ea94c722e3c6927ccc8c1b93e3a26e2b72216b29be9ac4307f7ad3030a3612aca33b966b63e11cfc5f76456cb3c5115827ce7eaf96d493840dce1d92d5e510e2e8a7edc2ce8bb0076783dbfd87f930ccef3f69078d5bf99159e011aa28af36cb5c681854fe59b2321ac7275b52148c031a468ba37945593b0f024ee96e775b4e3223a9849bc7446dd7d65c1f41415fd130259a095bfb89a29f39e2e4157c3317297681e072d289e814461e033f04c8402ab5eced0faefcfd90fa4440f5848770d53dc02a290e162b45097c5d6dbc89261e6792f1431a0d39255a059ea764b6ca357e3cd7317f6452cbe83d3f35d64ad2112c49b88546523cd3f1fcc9fb077648aedbffef0bec7d65c5f6f330548eff67fbb77aec78120a62a809e6adc5940000000f4d5a54cd5c2da2d5c6e3f9b08db300ef341fbc9e01b0dc8dc161e667b013bc3914ea52bad54809602c03f76e40f5ebfb08a41b82e4440b578e5bc83c1a59202	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE
852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 852	1940	iexplore.exe	28
PID 1940 wrote to memory of 852	1940	iexplore.exe	28
PID 1940 wrote to memory of 852	1940	iexplore.exe	28
PID 1940 wrote to memory of 852	1940	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.ganaderiapuertaparra.com/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d348c47f5c635bc6501dde15f72e6b95

SHA1
5a6ba34f2c4863b8c2c494ea833ff51b69cf53ca

SHA256
d62fde04b922eb1975e1b10a7b3039aa9d009155178cbea0eb5f452a7ea54f02

SHA512
74dbda1ca4e2ddf0021c2fedf9ca9f3eaa0a76d67373bd00abd6dc4d6faa422175a63df5f29d85d9ca7e4abb1d48c16acdc2795d5a7f34fd56fdf5793dae3a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
13KB

MD5
45c85026c850f1687adc24a4b216a8db

SHA1
c340ba36c51c5c7889b9ca0ac7260112f1a1c23a

SHA256
e4ddc4f760f2b33af4fb64ebcfdb6352a2b2cd57e614bfab2b0ad20c705466b7

SHA512
09c9b9c07989c5ba6c8985df5117679c723f08841d70b625e9f3173d3fd8389d45339c4daed85c8e69b59024cfca180985569bc351dece8d85ffeb51bff241e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N6I0FHLO.txt

Filesize
603B

MD5
631f85d0666220dbb1dc29c422863733

SHA1
29eeba69a98af97aaddfaec6b27e4a799f2c7776

SHA256
6564cf93f50b5f048a7f103dadc1ebeeebbc3d9ced05224d61010b31245590a6

SHA512
805b2ff6a41cb92b03553aff0194569b200c45c9428628510941c81301460c357cd74682f3f8a95724a35a48f6e5fb4e832978c6a29aa431f914e52a0196416f

Download Submit