392d9c1f05d8f8d67fbca464690af0d925046f05edbb75087b16c277627b5238

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
07-08-2023 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

POLITICAS.html
Size

4KB
MD5

f46056bc8e46659971ce2d3fb24141b5
SHA1

c3d351783f8ed9d4dba97006c0a55b4c6e6e7926
SHA256

f95e3e5be63531b79df9bf966b19e33cbe779fbdfdf977f1fd242a487e4b6c1e
SHA512

9463195227d39e2f4ad729a5319873334171e50045d4ddfea4d2bb2d82aa1c74e244d7dafbfc7195b14fc7f6416b0dda5df589c42797d9d0e97cc59910b53b65
SSDEEP

96:Fq4oz9/mCDMtr386BFwynS3hlFJ9aMFR/pa85cjl8mOke46eoaqJ608UzGiVaT:FzA9ToouEh3tHZ6FicT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb00000000020000000000106600000001000020000000cba5fad5fff14c99ce5f6a8fbf50685ee52045fc14f780b0e2f0eec082dac92b000000000e80000000020000200000002927e4509b78c8f1456455c079580b5840c48c208552ba6107b3d9500fc07bb890000000368004d724b9cb1737db4453a1ca64caa1898056b54d2b3d065cf515e2d9e6318dfebce1a8ee671807cbaa397d5e6f506312112883bc8e7c380e2db5204c7b0666e67d5c0e14f8d3631defe008b038b7d8479c2e1726469ec4ef47f99238df53dee5d5289299472a3e08a739c736f466519311752de360cd16d2bca0f6c155270441719bb06517d764c9e738c38d7c9e4000000007ba1451fec51fb448c8319c699193bf439c87bca65877d4f509b85310c2cdda884d7180582c9aedcd1f927b7bfe7c202e645630c82d8e408624f86c4aed0564	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7CC1591-3560-11EE-9480-6A17F358A96E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000008db0d095b3a751d6bbafe58d4551896c6a841b561326f155f1120a2396c780ca000000000e8000000002000020000000932cd681b44145f80b3e32044d2e3b46ed21d6181c5f360e055e20545938548d20000000120ab16909770085afb0d5e3d3edb1a23b3614f9dba590268cd9c67e72f366ab40000000acf2f440730bec5a0cc110338c2077172cd9df8bedfc67fb7d1978f43e77b8edb00d7fd57c977a66b7fd66241f5391bfe3610f7dc8d04fef3bd54291b0c04c73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397601871"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8002c58c6dc9d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2588	iexplore.exe
2588	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 1624	2588	iexplore.exe	28
PID 2588 wrote to memory of 1624	2588	iexplore.exe	28
PID 2588 wrote to memory of 1624	2588	iexplore.exe	28
PID 2588 wrote to memory of 1624	2588	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\POLITICAS.html
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bac6b0a83d31cf0ac3195ac0de3588b3

SHA1
60cfbade67759c2a343512e2d79ca5c4a5b524f4

SHA256
a03f9140cf783971c2e9a642a901bdca670b65f32392f6d609905e882c5b6109

SHA512
25739e1d557527969accafd1cd4dc8f683999dc5e87aecc66a04a46edfdea7ec2f7801a613c660619dcd8809b29525c6681b4c14d806a4c1e40a58c8f11644b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0ac93cd2b4b1af40e4531418359d2fb

SHA1
089ae684939c3090cfef44556d8ad893d9396ab5

SHA256
399a8fcb804cea0f964243fb5c97f06f963dcbba7407e269ae221bc428489c42

SHA512
1568a04ade7f539b6fca3f14e856eba06afff17191360eb79d3fff2c131874d9574b330711390274aeb92ce0d927280faa0386d3ec02f1a936b03665be5956bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb78a07bd0713faf9f1bdd955186e60d

SHA1
65b280629ddc986a44606fac98e3d4f8a4047e2c

SHA256
1e664d9c7f4975e787d62783b0920d2f32612f46f76a702f1b2283b1e16fdafe

SHA512
7038ac150e1020907174ae0fbebea6efb5f8cf5dc86ba54550ed1c7255a21563673b0b4b794b3bfaec8d18b493a7a1a8150ec5d7d9f4b13d51395d48c85245c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0d8cc2961e648ace7cf0dbf2adf0642

SHA1
b993d8f0d1b274ef95d7b32929e7f7198e41c536

SHA256
55d62e58c3be7b2b3e2cb53d582a241a1698f6b042cd64e465e3ed37c5468fbb

SHA512
f55dd8a57f14b72a866525906670eb38cab994c6debfc517ecd5d8e2328474f97478073a7a78085345da9a1426be55b80b8c114f41b9bd45c8aaf2f89a1524b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f08d07767c2a5c775193c58c3d2eab47

SHA1
862af673ab6896ae468583af2435893364ac6884

SHA256
b1e1e3e2f7487dacda0e463aca3c2a30d0be71efbdd115d37220bf49887d8afd

SHA512
e4dc52cb0a0cd51b3603e0d5076e43c140975c4cd3281e814b92bf11576d107d5e3b354de99008aef5f92f916112e95f0e489c7022627a370f0a8c8fa0af6d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d9c9ce96a29bb2e6b568941659b85b6

SHA1
58dfd08e3b2a03706b6b891fea8fb75e46d3e08f

SHA256
f43faeddc3d3c3b2d35b08bbe7dcc7d918a1f14a905bdad92f56500577dd908a

SHA512
d771ee80ddde24e8bb965f66bb26cd7757edff0582758fbd8f518fe11382ec264ac5b790d1a1a387d96e7d1c4a4a0dda87058c358e40e6cfc4145d0cd02541bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5259dcf28cf41af1ccdf8be24400ee49

SHA1
cafee9f29c6d09cb870161b69866d749e7fa614a

SHA256
30c1793320bb76778df05b92f4503c430ebe607981246480371562e50a95256a

SHA512
8197dbee911a755bb428833538847565f06e6fa2099fcb18f45183e71505d3084256ffa729cbd9838294a45473c52a37fbfb2a28e078a869f9a0bc3235b106ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5ae11262687c4c719259b35ca195c59

SHA1
d7854f88708dcda5357a650b941efa4a3f232b92

SHA256
a87579bf704ed278c26f5c715ee55928f83e41474a1516ed9ef79212016872fe

SHA512
e2307faf72463f9582b9f23550128b373bec32fd6f562a2865532f4007e7cad949b4832adf4e9789c58156539a5ac7a1e69255d61393233f2838d14dd91f78e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fc469aa4dd214b33e5b11b0740ff8312

SHA1
63593b836b7dd60c9c87d6e9dbd4cdfbd96a035e

SHA256
0b306ba03f924281963dcfe2fa0a198586e78a51c25e1c318fde23bf923c6244

SHA512
c2bda824bd8e794ea0e820a22c5e43979915862ad6d08cacab19bb641627d092f19de87d91068df2a2ee4c6972b75b7d755f7fd515009572da5ea8be40679520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fe3db67297cffac9bc0f1ef130ce23fa

SHA1
8cb784f6c3e9e7e4553752796fb124c71dd6815c

SHA256
ca86841474b4442aa7d2d3603e9b0396941a3ff8824015f56d09e7c5c5992554

SHA512
64cfab28c68191f88034e7a5f3c0fdbb41bcbbafdcc2af04f9b9b8fe733b305504d79d519c1167cbe22399b69e07874e89ad753c53631c18540b3d3f241304bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b177630cf21d5df91f070fb012738059

SHA1
3ff67138443d27e8c555012aef9826d36e8dcb07

SHA256
57142aaa1a4be2814ed294b35ad2a78f21871dcadb8eab9cec20d04ac8aeab9d

SHA512
b7fb9449ad3c715184b0d26f48d63f3e6a3d01cf4ea0c5f07db0838890bee39172e4a90e9f73b09b7a58ce73a2db2d06b0fbd2a197a5ffcda46d0593d795eaaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74aefc7e4082988636518f400de9949f

SHA1
7cac8af3ca60c82a37647a246f0ce2644f8cca57

SHA256
34729b154b26d409a8f6e1e9c96ec0dfaf738f39cbf41724c985564783184b62

SHA512
012c089f8ec6be9c5281c048c4cff0ae3d6375af8acd7e771485686803fd6d4029ce231cf66555b9037992346022aa168833a10bf0309a92a46ae56d1937b063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a0a78d7aca6f6cb98e8fa3d6ecbdd5e9

SHA1
04cc59abc5aeaa7dda8fae1d9d14338e02ca4581

SHA256
2483b1e179ffae838e3c315cf07f0f0c9bc3600060e6a45e8ba19fe524d53d9d

SHA512
8f378afd49fce4665beb262af2bf1d9aa71f7818fc536d826ed61b8bb7a13c89b99376062894f7a57b5c0066fca3bfbfb19c8728f01e36631dcdcfed3d28e57b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E3D.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8EAF.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit