c148c4ae4e093b3653496766f69a01b2fff54fce595836e71373efc8e4ee6794

Analysis

max time kernel
100s
max time network
137s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-06-2023 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

crear_transaction.html
Size

3KB
MD5

d6ff756b957c9d1e55de124e692099d0
SHA1

9e1701210b37688ad5c76a656aecc8b12fec5f82
SHA256

5ccdf32d36d4b5596d51c7d3776221f7768733c390b8cbb62a462e5ac6bf1d8b
SHA512

253db3579712b5465cae7554ff332ab41ae0577711c89a21fe68d0a066d410b15162045573bb31f03fbcb7a17ae530a769846d16a4d8e1503d42b8328f891795

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4135E7B1-06F5-11EE-A9BE-C6A949C40DC2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005dd10b9d624be346bbbcaa0ed4b817cd00000000020000000000106600000001000020000000da6e6fc0c43c5dc1e207261e2140f53bdf358fe3ff74e4ac5f5a640e275464a4000000000e800000000200002000000028b45b07aa4cf5a74cb7332c401b6be3042ff202d2a089fc9f015b9da3a0d2b820000000b767e3abeb70715ea17e64c5009bc57c0abb457157059caec6a3e8262a04c98c400000001db11e1247aaee41bf08f36f677cb850e7440803046c1ea32f0abc64ec87c5dc0f98c61f5776a2bb1137dff8b100ef9fe097e736fda204a4b88810c60ba3117d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393101069"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a82e1c029bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005dd10b9d624be346bbbcaa0ed4b817cd000000000200000000001066000000010000200000000efbf2336e2ac585e6c7078c285bf5da389e2139c4bb9cc0c3129969ea4724b6000000000e8000000002000020000000a07e3c9a934840cc6cd82714baed04ab81d2bc21cb11558c6f715fee43360e1d90000000ca63b85969003ff8159057d125b26d43a8ade3c3555ef2f6d0af0db394dda1639e1e7c918d641cc7395c99a566bbc6bc0fa367c080affbc3b6b76e8ec033bd6b62c9fdf33f5effc540e7c72eaf95ac4f28bc554945999e765ddc315520523705d6d2b28dcc0194db2a06003ff328822e18930b5e8121c2d94f99c5fa041c63b391fcb5bb5971f9c272e339341518b790400000000c41de595bfc003c0c60b868141bd0730f062c4a81b45d08b112a5445221a94297d56df1e91e1e91f99446de376032655a512ba12d045d36d4b0e3fa2ebb07f2	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1992 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1992 iexplore.exe
1992 iexplore.exe
868 IEXPLORE.EXE
868 IEXPLORE.EXE
868 IEXPLORE.EXE
868 IEXPLORE.EXE

pid	process
1992	iexplore.exe

pid	process
1992	iexplore.exe
1992	iexplore.exe
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1992 wrote to memory of 868	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 868	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 868	1992	iexplore.exe	IEXPLORE.EXE
PID 1992 wrote to memory of 868	1992	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\crear_transaction.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
7ab0c4bfd65e7c79fa6e6ff6e3f6b517

SHA1
d6d058f0ed5d72f6aa8ef8f0ab2d8f4a2dadbe95

SHA256
338aa51e9b143f4c1b40dc3c69de62174463b1d8d408264212b1f1dbe8738034

SHA512
1aa3866feb744d2b3b23c95c99c37e20698823ea43171d37f6a70dcc66ee1a2c5a709d03a2096865c9c63d75aef44e93491c130111f4561cd16f94a782f957b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
4966c9e73fa242afc34e31d6b1292b0d

SHA1
2ff214e5c8c6cfc7c39858218dbd7797eea21bbc

SHA256
0a5d1232fd237b15a7db518e2bef623d689f19faddfaffa0cc31f58b9735cacc

SHA512
a336dd2731b53f08706a665beeb64df3659f3b164378d5b431c6a79fadd0d1479f4b6e7ff4c3c1f0915bf52ff07cdcdde3e308f84173a51dcecdfde7b7dfe9fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
3ac0bc9409bff77568a9f952c90a1ef7

SHA1
f9d465e74156289d5db192720fa4f154d026a950

SHA256
857315e22f273fe2c1bcace1d9589b597e592d71c9aa4674d0b2e5feba88f39c

SHA512
b385cf5dca85979af10fb95704c96ba1b06151d5f25d41a24c00de831f755887899cf38d51e4094428c33a9c4a99641e8568711fc8ad7b4b2ac979e60de3da0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
9fc84a06f89ab7f4bbd66178d23dc8cd

SHA1
5951d0fb4c7eae81c93f1f65f901c7ff4b7c3799

SHA256
42e014309829b0f814f9a8e20926ccb02de9dd559c8b01c1330811ce370f180e

SHA512
54535d626df0c9298326a0e525c3250a460a0f8589ca4d02d06f85bb10640dcf0862f9c19a2b6edb1fc30c04aba9b8e83fa58a95232f45a0855190f91b63b056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
60fef5878a68160006761b9fdfd9e9e2

SHA1
b0744a55631f2cc65fd7001efe1f5e7d57aa2b39

SHA256
b18dff7df76d483f8a1383b99221e4c0c4ba2ed52ab05b43d94c2030e1b3e50e

SHA512
840f285a8c7b8bf849c355e77441c1d6a230abdae5d4e50a6b80613363597e8517b1b498ec022bc2bcb6da55eba94a7593c522ab99127e28819853f156ee3863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
304B

MD5
56eef7e629429912d8eb6c2bf092ce9c

SHA1
2c5bbb3676a6f31f041f585c8f1088771ef1c87a

SHA256
bf3963cbbd401a3c48109d6f50b701850ca6cbed642890b7bb19f024eff28152

SHA512
9cd9a4a922eebc9cbfb37f5768208ebcd50245e2c68ab889674162c7e3bea3512e0e53ba904831266789abf0fe6dca47366b52a95b64f0777713b44ed86b3562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a7e136ed5f04cb3eb204b2c6e50f4ca9

SHA1
c19f2edce7f5025fcf33ba1602687eabdae0a571

SHA256
5a03898cf0e7fbff5752dc103563a3ab7b3f7bf40ea6efa3d6f00e92efa0dd2c

SHA512
cdb208d9f97c90c106bceb6d4de07618a496357808d8b6a9a677a2cf511f6650b6890adfd73596e2c16c00cf486cf874b86773410aae2c5cf83c4ae7b2af6780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4D33E1QE\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E89.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F48.tmp
Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E8B.tmp
Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4111.tmp
Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WLAEGNDQ.txt
Filesize
601B

MD5
9766766200d23c8d9467d77d4c849368

SHA1
72207f0a4bf9242909ec8b126b6203cb0294b219

SHA256
0b30a572e89e45d15baf7797fd3ee909a494b7b22250846db52b31943c077c9b

SHA512
d08af207c6d8e3dbaa8b804b6bcbb0440d717df39a3252415ac35fd36efe3e93ac8e8b9ddb264f2c2c156642bb7dfa8c4c0914fb38d242784cec9e994bbb5056

Download Submit