7ba7505b93e251ea5b32285b0da00ce741ee52472a4277e1321eb6de3c4371f2

Analysis

max time kernel
99s
max time network
139s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
02/07/2023, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

instrucao.html
Size

2KB
MD5

7097277cd9b370e618bfd301ab6b7c22
SHA1

6cd0013d1d2663c1aac4c2eb2402c151487b8933
SHA256

5fb6600710350f5783e18b5f843defad7e132d4f82e88b7ab5d8be7a8d1ae7dc
SHA512

e071b068af02624926a66f7071434c05fe7857e3a9235084f912cb71c9f33acbbdca154a52b9a348f6c9f03ff6b0d42808be2d5fe2691b86c7f5d11bc3248741

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a4800000000020000000000106600000001000020000000795a605167513f1219f0f07668fef139b88ef8f0697c4c7c8d19305a84cbe216000000000e8000000002000020000000f24f6041a7402ea983cb9afbece9feef7395b4987e05c94f8816fbce202db5eb9000000022ffd31757a9a48e16d1f30a78e2fff534a61c1fe6ed29824d9bf74fc181a02d800d8c5fb57fbf007f74eb856c4a405795a742daa3591d03364905d74a196d097f58746ae0d983eec74ba22f771d2729bb9b8a5d1a331b3b3357eaafd902a08eef87534baaa7fb62beb8b091db25cf173904a685e97bc6083dd4f9f990d3cf206c3806daf904c1f1b995b537315ab3414000000037167a56b83346693037f7eaf0ffb9fc7ddec3866b66f65fb645ed0cd934d6fdc6265242b6bc74c1dcd20f528edae06de9bbdbdf75a435788e6b45d1fae1f1cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395030708"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C9572C1-1882-11EE-AD7B-EEADDA397F5C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eba41dbc9f109c4eba713b962a4d0a4800000000020000000000106600000001000020000000129e91e21aa17ab992d5ae85ef89fcd42eecacc26c3708b51fe28d8cbf922098000000000e80000000020000200000001ddff5e9d71f9ee830af0d5adcea04e23165178f05243ed6959ebba286aa666620000000665aa3d64ed4f4fa0e53898cf9848e395e7a647b421db8ab25000831e06c0b354000000023b3341d182f245bb010b794c55de6c920ee717b570e48fd974d12fd5146c5ccd0ed8c0f9d07bc9bd0dc038f809fbd575d8a0b1b8c690576f302891ed32bb264	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3518257231-2980324860-1431329550-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0723fe38eacd901	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE
692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 692	1792	iexplore.exe	28
PID 1792 wrote to memory of 692	1792	iexplore.exe	28
PID 1792 wrote to memory of 692	1792	iexplore.exe	28
PID 1792 wrote to memory of 692	1792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\instrucao.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e87f2f9ece2c63190fd3771777e1653

SHA1
2dda9e3560bb0ac873f9c2427163eccc7a218808

SHA256
3dffce4d8425cd1586e7147e8df7b798225eeb28c245f9ff0d0df8ee5dca9638

SHA512
eef3de607fce80cc03828e09fa6dfed195241fcc5af06d881d47f40062b27d10afde90512b745962b6188d06c0bf6c861cd61a6678d563264d72571f1ddbf942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e3da669f7f6dc4e89bbc406488389c0

SHA1
77c3763b7b9165ef31b1d7a4a74a7e1921e6aa69

SHA256
1e707c96f8cd5d3000ecf6281f61674a8e6f119702341be96499a2e5188f0012

SHA512
22c9bf46f9f0d2c4cba309dc969ef78f6cd8cc840a10b6241897fde177ea9820923d91f3be30c7d1d5ac7323654be1c027fc4ce2f0988994e41501bfced831f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d315d2edeab2630639b54a804d0ba32

SHA1
b8f16d25bf836d045bc9de0c87a71d9296593c26

SHA256
927b45df50b3a3d8972379139f02ef29e1e770273ee1d6f1f68905bd3810ca2a

SHA512
9f087dd7aedecbdd47141b1f580038917fb3b2b431921b4b4be2feb485da662afbba25deab81a45c1bcd63c456de0419599a7f0a72893ee3f7aaaac7a0da3769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0f0de0d54ca41e9deab478d8667052a

SHA1
b1812bd5105cc32dd72003eb4a4f0d65e7fffc9f

SHA256
18defaf599e582075b667c73d6f43e3284951fad04cef9b32ca0d7d283f14e4f

SHA512
a1d05c147c02b6dc8ae73980af4d6eb0fd8365b75eee26bb567a669a5be90908e0429f4dd304e1c03256926a4e6235522ba3e01e82b64af0953232bf45666c91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b57d6aaebc81a64562ce64db8e7ced0e

SHA1
39b1672d80cd786150e52d1896230bcd3c11693d

SHA256
fd119abeb4b7d060147e74efb2c8ab44bf9f5e33cd975fc84ba1b9a989022fa9

SHA512
32eab5bd2294a6180d47a5fb07097054d1eb3655e665f5f6edfea068e3272b9fb497ce9f38c46be665762cf400f0d0e5e38b280441e6e3db0bfe0ecb290640d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
29fdea303e7610eae44affbb4a4b974e

SHA1
58b968dbd83f23cea95ada8d166c39be869ca28c

SHA256
99c2c64f32f1b5e544fe4148f78a48bad4172b482d2c770e1acaa957013dc00c

SHA512
960e9d03dfad1a6972bdbc8561bbeeb8e5fa5d5b5c25891a9a2c572d3fb9b12605bd617bf2101a790f07da3194610e3312147f176e8684230ccffee8597563e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03b1f4d7e1e789fae3e4e7e29ac23526

SHA1
b547f31972e9240a4a203b57388bf45722f0ff67

SHA256
8ca587eed5fc9f3536e2c3b5a53a8469f4c04c05434aed4b58f81c05e0502750

SHA512
2c80ca79b9a19084eaec32bb9b1e25bcb7c91f2e2e4b536e0b3757b8e6b8fd86ac3f819d154a75562cf3e406383d56633951211c762c7816072c5887b7d03512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HQLKSAYN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab522A.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar52C9.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EEKB33HR.txt

Filesize
608B

MD5
0c9360e8c23f8de5bfcc21ddb33a66f0

SHA1
982917ca45a92567c9ee36372d82788d2bbf7b75

SHA256
8d7e404d17b5940f25145e3611266883edb699de313e6f011f84982873316eef

SHA512
b03ca739704d7dfbdc2034272432f2573240fd95aeaf1cb4b4736d5e020ad20cc6cf91336ba093f699fb4c43ccd2acec398f4bec3c7aeaac742c4d370f3618ba

Download Submit