58e8cf2a77663a1ff5cc36aa9e0777ce952eaa258c9b8220cadb5a53bed89724

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

follow-traductor/build/FollowTraductor/FollowTraductor.exe.xml
Size

1KB
MD5

bf413ed840145672db67c4fa85153dea
SHA1

91c743f2148a4b902a88077b6e928c08538ff2a2
SHA256

c7b95e7b1c9848e601ec777f0ea0aa306360c127f5390fb7e141bb55c5407457
SHA512

8d71d10d257114ccc9a1b12901c94e31497e0a61eb1862d019e9b93a7e3ea340408cf6013ff413075790503c929943bb0b3274b7fb745b6163cf8f40b4ed16b1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382366418"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e5f0896039d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31013216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2287868908"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2301933419"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31013216"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B3659495-A553-11ED-BF5F-7218A89707DE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31013216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb00000000020000000000106600000001000020000000b019d857d951fd04f99b3e3b90ada08a167e3904c58a5df21db48e90ba88c948000000000e8000000002000020000000f61ec8d7e0ca1519a0a38cf9d71b5b7a4996abcb5ec16c1530e963d33bc55e7620000000626dcfc3d9b1c86d14e918dc8471da6cbccb22cdaf69217a4eefa6eb4fac316740000000397394316889b8dcb8582effbbf3dd049abb882fbccd482bf0352d8cf44f4a3e93f7eb199fe4dd02445cf72d46a38df50053f5ba89df65bbfca9569eff06534d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb000000000200000000001066000000010000200000001c80311a9742a3fb4999ce2f3267dd15a430559181c0508d9eac6af5d381278e000000000e8000000002000020000000cf8d437f057ab9b53944804065b456af9a0897e179b27038b067d53f3a3ab6722000000037afcb1c0779e5269d26730cc3f87dd0adbdf7e43e3fb817a536f3b1c3e5873f400000000587fa90937550c38f0999d2c95ef3979a9abe21d50c77e606aab3ea36727448872a644dfda472a07364b8c30fa1732add05134b30f32f9932edeeae91dcc04f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f06fe7896039d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2287868908"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

4400 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

4400 iexplore.exe
4400 iexplore.exe
4820 IEXPLORE.EXE
4820 IEXPLORE.EXE
4820 IEXPLORE.EXE
4820 IEXPLORE.EXE

pid	process
4400	iexplore.exe

pid	process
4400	iexplore.exe
4400	iexplore.exe
4820	IEXPLORE.EXE
4820	IEXPLORE.EXE
4820	IEXPLORE.EXE
4820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

MSOXMLED.EXEiexplore.exe

description	pid	process	target process
PID 4092 wrote to memory of 4400	4092	MSOXMLED.EXE	iexplore.exe
PID 4092 wrote to memory of 4400	4092	MSOXMLED.EXE	iexplore.exe
PID 4400 wrote to memory of 4820	4400	iexplore.exe	IEXPLORE.EXE
PID 4400 wrote to memory of 4820	4400	iexplore.exe	IEXPLORE.EXE
PID 4400 wrote to memory of 4820	4400	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\follow-traductor\build\FollowTraductor\FollowTraductor.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\follow-traductor\build\FollowTraductor\FollowTraductor.exe.xml
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4400

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4400 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
471B

MD5
cccaaeef5d856cc76db09fcc38d7ecba

SHA1
a773555a513358cf0dde7a4d7c6b8357ccd7270c

SHA256
8078927d5b22d9d98e14c642fd086ebe0fa620a6a2e83aa965354c119fd92c49

SHA512
a1c9fd1a9ba3c3b93bc9c2680da64b3098ee9fd101fc648e97202054e0d86ddbc822e0136dd85398debb1fd57ca67fd8ef404dddb567d3066d9131e0b7d8e077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize
404B

MD5
5c5862b7e6c8ae3ea8db687bc0ea7344

SHA1
16dddf283c400095249b79f1f3d936acc673e369

SHA256
a041c3d72e99721e42cc4b5997afa44abfc9de00e3108e06c002c435c5c1a612

SHA512
0def8086f7d0816495c224f769566e04d843ca36c6b3c97c460b6c0e62c9359bdd80242524dfdda1fab60a22bbfeea96b864f5175eafcbfdd8221ada6a45aa74

Download Submit
memory/4092-132-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-133-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-134-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-135-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-136-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-137-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-138-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-139-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download
memory/4092-140-0x00007FFDE6CD0000-0x00007FFDE6CE0000-memory.dmp

Filesize
64KB

Download