hxxps://www[.]solvetic[.]com/tutoriales/article/7757-donde-se-guardan-las-cookies-windows-10-chrome-firefox-edge-y-opera/

Analysis

max time kernel
26s
max time network
29s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.solvetic.com/tutoriales/article/7757-donde-se-guardan-las-cookies-windows-10-chrome-firefox-edge-y-opera/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\solvetic.com	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\solvetic.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5024000C-C337-11ED-8227-720160798C78} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\solvetic.com	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2372	1680	iexplore.exe	85
PID 1680 wrote to memory of 2372	1680	iexplore.exe	85
PID 1680 wrote to memory of 2372	1680	iexplore.exe	85

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.solvetic.com/tutoriales/article/7757-donde-se-guardan-las-cookies-windows-10-chrome-firefox-edge-y-opera/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat

Filesize
19KB

MD5
a83ed158ffef37b12ecf828278943770

SHA1
78c441543af5f8fc07dede15c5ead45c17ba0b73

SHA256
e3955876c79b0c5b2e5faab802f24f2df1c8a76f7ea0c4aa99eb89903f9575ce

SHA512
d3cb4c6f4ef4f2e3424b09af5dd6cc42cf6cf6875ff438e8d44c0dcefbe104ba2a718731f6aeb06ed8b384bbbef3c1a0c7cffbd9364b2d7e5780e7ec43d5b8d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\container[1].htm

Filesize
6KB

MD5
6aaaf8e11a32fd37fb419e3a4ce9696c

SHA1
1fd88f2ee4de5422e0c344debefe3f2b5abb2592

SHA256
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

SHA512
748b27bdb7c7fa082d7be6c69f56dc33302105784391320a5cf960531c594097bc406fd3f4690e4cf74f4016f4d56804a4296e9bd885562eb66699e1318f7000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\f[1].txt

Filesize
2KB

MD5
43df87d5c0a3c601607609202103773a

SHA1
8273930ea19d679255e8f82a8c136f7d70b4aef2

SHA256
88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

SHA512
2162ab9334deebd5579ae218e2a454dd7a3eef165ecdacc7c671e5aae51876f449de4ac290563ecc046657167671d4a9973c50d51f7faefc93499b8515992137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\f[2].txt

Filesize
28KB

MD5
633e9ed8d384df836525efd7e18f4874

SHA1
0061b5aaa925811d09eb6960049483d267a828ff

SHA256
2cf8aed647913c5f7454836bba1c604e414660118d553b48dd952577fb41368d

SHA512
30df5879ab45c6dfb66d92a4aba7d519b9fd08ffeac58525b3599f7a65e45d13376ac46d1bfea93fd80357f7a40bcc8d7766d916ea450d7c1138a64b77568205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\9feea485ee1eeb9d7fdc3959e2f705a7[1].js

Filesize
47KB

MD5
9feea485ee1eeb9d7fdc3959e2f705a7

SHA1
0b2a8fbc681b183ea6777a9e4f682cfb4f9c757c

SHA256
c02d2ad451ec8e54c91b5065448974410d10ad603cebdb47a2fa4e7f36d622c8

SHA512
50eeba2f0d9b866046014a22ecd383859e828dbb576142975bc1c023e0f790d14598afaf19d9f48a5eec9f673f2282e0c4e0fcb59b1a24f0a67a0cf947950462

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\_R-6bz-SB1GVaPKPMmuUBDSJlT56cW_J0yN2AL_23IQ[1].js

Filesize
37KB

MD5
4499715be70072223db114f24fbec68a

SHA1
3b7b74887c621185e1b4c7decda1e7e4df2586e5

SHA256
fd1fba6f3f9207519568f28f326b94043489953e7a716fc9d3237600bff6dc84

SHA512
e5342618511b3efe7b3029f349aeb792c04206a3a4e839b8c5459b61ca888ca5e1b51b84510200fe88d2a714a490af36990093d05c42f04c84671539447946d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\s[1].htm

Filesize
143B

MD5
e4e31b474d3e0b577b3c8856e91f8659

SHA1
a81311f7fcfa9b6b23a24d4e5c976d5f75b1b9b7

SHA256
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

SHA512
a07961eb39c4cd4e39ee19e2c675e64e5ba5367daa18e2f76a23772abd62f46b002e6be8fb0f35a70616941178facc8df579c4a68e5811b74313c12806aafae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\f[2].txt

Filesize
28KB

MD5
67021ea9e5c25ab4ee17b04eb126a3a1

SHA1
934d98b423f87f86b394f043eed1f05567fb9ed2

SHA256
80e6e26c955ada308d43c0df95285ef1f9c3642bf45647a92eaa7aa7ccde1853

SHA512
22a447773dc86290fb41ef1a66c66b1aef0391fe6b39d6a5c89ee6914befc5fd3602fbc5fd28d952f8f76d8e3887e0acfc60e757cc8ad06c015583abfc9571eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\f[1].txt

Filesize
2KB

MD5
01b5d2b1c33bb607d605bc345663153a

SHA1
681e30c5eb4133c11e621d351218121aec16f354

SHA256
9de103952ef65bbed1caa4c723a8c4a88760791eb92dd092e410f643a1e256f4

SHA512
4bf150c698930ac0e606ee4ee4be37abaab9fd5bde1fdef2dbb95a9289d36a80555208038a86013d1d33665968498e3d4ff8e8668dd5d08bbdfe5f85d7546f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\favicon[1].ico

Filesize
32KB

MD5
9d6433cb927907c90ac1c691ab48cf65

SHA1
1e8d25ee1d6d242c3081903013085801d4bd576b

SHA256
eab3c13a809b6429f82ebe6a3c27bfd5193a799a1044d96da1a9be6277c8f27f

SHA512
d742927a2526d464a2dcc6e66d28ea1ad7b28d22afa6cb0386127461c51358145799ef13877bfd5c0f777963cbc182abdcae95de568f165084baeb503ff94631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\favicon[1].ico

Filesize
32KB

MD5
9d6433cb927907c90ac1c691ab48cf65

SHA1
1e8d25ee1d6d242c3081903013085801d4bd576b

SHA256
eab3c13a809b6429f82ebe6a3c27bfd5193a799a1044d96da1a9be6277c8f27f

SHA512
d742927a2526d464a2dcc6e66d28ea1ad7b28d22afa6cb0386127461c51358145799ef13877bfd5c0f777963cbc182abdcae95de568f165084baeb503ff94631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\rx_lidar[1].js

Filesize
158KB

MD5
1c61eb91edaf03de9d2e9107ad8be6c0

SHA1
069429291a8ca55ba468c77e412d4a689aa191f4

SHA256
cb4ec597764d44492ac20e31d89a2c16f6c77d3fbe8d926defcb2e66fd35fb97

SHA512
6d4907cfb21feb37f772420e06f5890e2cf1bf2d41de72989135205ae782f68817aeeeae9824e14f28146ef16da427d64dac70bdfff5ff5c37c68d999bdecdd5

Download Submit