e0245200c78874849a380463230f1a248f37fd03517c2c27d030030505f8875e

Analysis

max time kernel
101s
max time network
136s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
12/06/2023, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FACTURA_405087.html
Size

294B
MD5

fe23a235abbd669172522fe885087532
SHA1

1a0ac53f3d6aab074d31162f781d8331e6e7078c
SHA256

e0245200c78874849a380463230f1a248f37fd03517c2c27d030030505f8875e
SHA512

d4cfe594c1953295b60c02ea783bcc86dddb74d332a046573beb1d31b5722068327b1a7007388c9e26aa4dcd5dc693f6e5217583eb6ef9a7f17d9aa1aca87fa7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393354363"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0131BE01-0943-11EE-ACB6-C29BF59226D8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c895979c5f8d247b2191029c97e68f800000000020000000000106600000001000020000000e369693d4643c3a81d49302e4b3871b4246ccb66a39e417be33842cec3cd35cc000000000e80000000020000200000002b8f8b35eb8db65ca3029fdf65cf12c5442ad2db9b4bd02f7cd8ced56bc08c822000000048d1fa766917b6196a9b8c847f664b6df00b8591901a3ca0d1ffa8c82992ba13400000004ac386f8e4e7e9cc8a42b89bbe452719c0acc23063d692fabebb26874bbdbd36d0677f1cb555ed9ba4472a2f23ef7165b3772e739bb5008fa4a7af00a7fc0dfd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30793bcb4f9dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006c895979c5f8d247b2191029c97e68f8000000000200000000001066000000010000200000002f115e1a2b2950bc4e687eb3a2ff84b4bec24075c6d28c6e93be59cec8fa79b4000000000e8000000002000020000000c50ced757d128544e52754f83db8643513d7095d2e3d30bf7f6f88a581ff935a9000000040d818b798ecdf4fac4878f094ef7845032fbe6897eade7ff8ec352d9d83ba249a904ff5a669945a31708ae55484ac5120c8c9542dab71b5bf5cbe1d4ad3cad61b7cc215c413a90951eb6f10f3e21623547bf279dac1fabc27cb53eea19f7166b0b1bad18ab05eb903f63952fa41d93f1cb666b6dcc8c18dc0d41bd402896d36e5bc6f0a1a003a7e7ed9936ae7e583804000000031d0a5a6ce66fdd59ccb640eb40bb29693338781be3dcc07819939e25b322a0aea230ac895ba8cb09c3994dc10651f0e56a7f63d4915a6ddefd30bba7cb72560	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1620	iexplore.exe
1620	iexplore.exe
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE
1872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1872	1620	iexplore.exe	28
PID 1620 wrote to memory of 1872	1620	iexplore.exe	28
PID 1620 wrote to memory of 1872	1620	iexplore.exe	28
PID 1620 wrote to memory of 1872	1620	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\FACTURA_405087.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
016e5da3ed7ee17eb608caeab5daa9a9

SHA1
f611466d226fd33d69d25d406ef5b9f3b7990c3d

SHA256
b008cc197b959b775e43494dc9af013a21dc9f0a83879eca01b17ac8bb48bf3b

SHA512
a7f0d05e07d8483dd132870ce621fb788c9ef18aaa28c6be4c7461d378ec411bd75694a6aa5a2015881ad1d3579fad9657aa85c71709eead6c0e147c2ebf1f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22499d81cab80b5c52aa3394007a659c

SHA1
c70b128c805e4c8c1d1b9bb1220e4c4036a3cea2

SHA256
aea1da14efe60717db5723caa3714bddd8a3ed03180a9dc3d2b53960532e2c53

SHA512
d4db3a1efb8b847067c98fb7e88297e2eb1c018249aaa58dce630eb7cbb06f23ac0142a1a66e3c5e6c864883ee1657a7cad77cd0cbd706f5d8660f605c9821f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b75abed7c01e5379d803b217b48da04

SHA1
c721187b54c81df35d6cfcfa82bde452c936d2f7

SHA256
75474543ba445853ce3bc5b25c1be49c3f5426dfe4d029e61f16a0a710247e6d

SHA512
fcdd6cd1b674b4f5b5563ce0771c4530aebca401bc327f771ae919ac636b6d7e165f90c9b190efc05c0e3f5f07c1a03722126c4173e94a24d6ede7fcb2b86866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5d6b005ed4359916ea622629365a192

SHA1
375b7022f3a001e445a9c13d18464159dc7fd349

SHA256
2be76c56030f353282b2c27980e5f3ddc5c397ad39cf4f7a13831a6016263b3f

SHA512
cbf5120182a84ca1a982d44ef696ee9fd4f3d05cd9033dd4a584b708e9e7f24b450d7d6fcaf4d1fae0becf50629a253790ff2b13161570982ddb6aa07c38b6f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83dc4b56eadc57fc570348d41aede871

SHA1
626c0d48a4de15858ee9efeabc422c0e705014ba

SHA256
a6f891ce16a46756131f356c59e2f7e02716f51d8ea3463795d6c4dac1f8de12

SHA512
1d0e0082799fbe0384131699735a671346ce9deedd87dbadd74e64840785b924711229305b14118a1589ab9ede11b7eaa527461a32d97b4ec8e88c04ea1bd3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5148f08e8ddb6e968736b098de9baf4c

SHA1
58c14c0446390b047d3306eca552b21dd976fe4d

SHA256
e7f50b14572cf38ae6296e5b4d863799b1a3867ecf118dccac8a816c86f4aa81

SHA512
8818ecb9b6a87e12259f862755f5d7fdbf72d2bb178bd7f7111f0a5f1b45fe9b1a83b2b5236936d4e494dc2876b5c71a051d53fb18274b409a221d38013a7698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5a4dfb59f1528ebf2ac9fe5226c5adc

SHA1
b55be7a45a35a90258056564847af4ae66176de3

SHA256
e2e599fd22bb4ef9194bd6ff667427b414cb650da90c76550df3bc1275662bc2

SHA512
7fea47175f4a0d5a86d67f33479dbaaf13ad4a41c5bd904ed9bf6f36d56832422d2b920c4d6dc90dad3dc4365177edf937e7a8864f10911fdc3b79e831cc60b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70bcd358c3fc165a2a1b133ce90cdea6

SHA1
a3f7bfef78ac14ea709d50027eca85532937a063

SHA256
94f8f5dd46d0e4badbb2c8472d4f96d15d2b4e85505471ae15fc03099cc8aab0

SHA512
aa9f38411b3d192c4ad9aac2cf2a47c3efd5a776d0f80f8a78f0a166c0029eccb0e758be6d54c32f7d9803e46a4e0496a6a1b1c1484b206aae0678513e18cfce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33617668f0527e4d1b5c198400f0478f

SHA1
3c06af7c71a471529465fcae0c172aca3543e69d

SHA256
36dff87d68fd00e9ecb85f407dfbb9c6182c2be9d7e05143f95806e6b9530b5a

SHA512
624bf152a2d6af819d5ca6222866d9eff754aa6d28e6947961756e1730306776fd4555d4ad8bfae1ba534d4cf5d5b85090055751d3c5241c8219b66ddeaef403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8de17193ecb4824ad0f679957b66ff86

SHA1
5999615d28fd99ce49ab8b982a64f3aec31d89bb

SHA256
cb13ec23c7d47b478dc33f4e51f71671ffa02560d5e63ee3d26c2c31a2912980

SHA512
a729d712f43d64636c558815c58e5a793e126a8a23d3d1def9716d2286fa7692d84324a6a555a8fd24f80a3855d57e98fbeb06f7586026a8e56d61ff7402f754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f8e61723501bf093b66d8a5f76832a76

SHA1
76b5e679f6cac7b0410e59f329d5c0e356ff3a1b

SHA256
389e3be4f6bef416942d4065055ff09a2e7465ac121d1009774a87fe20f47a8b

SHA512
116146c3c5549bcd2f2b9a1b16f9a5f63bf0d10f049c5af47677b36d6b63dbcd30bc7cf706245a12d527961374c9786669e4daa31da14e8b5f8c9567fa3d06c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d585b39f2d888fa942f7bfbecf5a3bf2

SHA1
50cb487cd64143c8a49de0c312487eb9ae61e823

SHA256
c5365ac9752e4228257728a579e563735cc5d87c42fcc43b4144303061503c82

SHA512
8df3ffcde55cc1490277fa157c979760e270216cadfa0a921fcbe4a5bee2212c80e10e8e24ac129b3061cfcfb3f25e4062120941fde27b037dd433af3394a0d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6117.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab63D7.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6552.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X4X22B94.txt

Filesize
604B

MD5
98a3449e7eb13f6c46b89193d9b4a6d2

SHA1
6e6b87581e0a20f2b6ba8fc413bb04ecc8806029

SHA256
6ae039480b83c3570d9cd8b39cf7bd28ff96ff909049fdc95f5d7d2cccbb5319

SHA512
a085b4e1d38c13de47eea6f7f98d31ff9c3c00d5364efefcfeefe145943d143309833f01e79a8bde240d1823e4b1c8556c3d98864d67598fcf031f03d1b0babb

Download Submit