5fc489c4e1ca429a879cd6bf42202d00d414f4bc6492d50cb1c58e8289b1df78

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
23/11/2023, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mconsultar64244.html
Size

533B
MD5

9c9b12992071ff6b0313983bcf8d843d
SHA1

3575f84fe9f0381a8a6f2641fea2709b8a81b222
SHA256

4a97c71cc50569e1422b9456743a5b2a0052462ee1b5939ac7aa360f24efd9d4
SHA512

f6682e0c05e09f49def6f8f289d849a5f0a6e1c27d2f94ddbf636b068590ffda588406fd5ea4a03347f6f286c6cab8e0e048004ff10e305317d2cc37071f96a2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8D83D41-899B-11EE-BA00-EADD55BE30CE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f54000000000200000000001066000000010000200000008cba0dee551b4ea364e654e946a7fc2ea20571e39bc8bfdc102614b88648c450000000000e8000000002000020000000fdae29d9d582298a8e921d2d7a6d640938f7227e5ae2ed283341d8b114cd20a72000000053982a4b84b4e61b996241000739d687fd94a2ae6e85693974b3a9997762ea3e400000002e3bc08038722f06af16fca5b12653c21718282cce1b2e77dd38371b78d43f2e2f9683896b63b480be06702aa6bce059d1c34c2865924bfe62725cada9649eb3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005718aef034e0654ab00265bd8f8b2f540000000002000000000010660000000100002000000009115eabe96a250183495c50237f0ea32fd7f3a9376e0c94e29af934f206d568000000000e8000000002000020000000d481cf9210c190340c84fd252ba37268de1201a98727f891b60159be807f123f9000000096fa4ba64c306ca7205941ab313aaddaa2e6ff8dc0b54ae876fb9eba970e5e3f6150b661981ddf9e7b3eefb6ddc633d2ca973f9b58a20c1196511fb1594fca470fb89df102f582b5189a14a59570b388578cab963bc0e670b11928aad4fa9cdbca6dab0698adcaf179438150b74a7676f4ba5563a4d4e226ec9a16180509d3e0109fd9d61b0908d8584cea187fa590e940000000cec10eb8b2b8b39249c6f10ff90304d27a7b68d9fbc6d77a456875edb29d285fea598a325f8dde95b81258b9b768eb2ee8bc42acfb8d29df2ae184f315bd7acc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406863083"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ceb77da81dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1496	2160	iexplore.exe	28
PID 2160 wrote to memory of 1496	2160	iexplore.exe	28
PID 2160 wrote to memory of 1496	2160	iexplore.exe	28
PID 2160 wrote to memory of 1496	2160	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mconsultar64244.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d0fa32ccc2d2886e8ef6cf8c32fd726c

SHA1
b3dc25eadcc55243df838fa0b9392fa2f675a7a0

SHA256
822163d395fac85db6ab8814cb69880e65c30cf7ae3fea49e733ea25da62e634

SHA512
7b7302b147ceeeca6bebca32b0e15c07fd57493ccc9c52e3e8b1e0266c183e902b5ec7e8adaf257cc6c1a32432505eee967026d178fe4fa142ab667362d70b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd4c46b6c93c55eaac9882d0ac5551db

SHA1
095f1b86c5354c631705bc0b6d502442e7fd9db2

SHA256
61f0fc38b4b685bf43bcd963364feeb972b3f495abbe3e1ba4ba916503129a3f

SHA512
2376e8c8a4f6713dac972bbd514e2db3ca2a14191bd0ad7eb4512ae5a0e47f0744f00f92289d21fd6cb164555e1c0b3e145a478e90080efe5b1b989602391c50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bc18a9f04a43e04dcf936bdf683e6b8

SHA1
0a85b3f578acffa00ca7c2ca0612c57910f53dec

SHA256
ae30cf83d6d6451272e318c3419cf77cbbfb21caa49bd01060425c1bb8acf40a

SHA512
068c541783e37a5ebe2c46916c1b3b8bfae52cc5118a1e0283dcf88a40087900d7c8f4aea8b6402d2eca44f46ae8b25f083ff19535679a7306003445b01b05f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b6194ad6d11c79bcafd04fbe4e808c8

SHA1
600615f68d97c0158a466f15ef4d286d11a652b9

SHA256
61a4c0be94ccc4cf1751ffa0cd4192000e92e9d9d6c7a0dd43557f3962203a2c

SHA512
6f7236d6883db564d97f9cb9cf112801c16d3d30b017093ff49c29aebe58276f62c88763a15bf324fbe913f9d1e63ee5716b570d259d8f53dfae9b4cb3392793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca1aed19b3259545ce9d9d92f7176cec

SHA1
33b5f00160a708b3102c0f615ed9b5550400a71b

SHA256
18182e02730391c0adbe29e38f0500ad7c0998ed8da071c17ffd9d7460c0a915

SHA512
e4488f59fe6da21de106a1b8cfa7bd91ff3ef0e63dda1043d9fcd7bf49be53b71ac27de83c09720a183e3e4838b172f4e36cecd76a8588d284681f5eab9675f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d08e415fe7cca13ee4ca04495488141b

SHA1
1259824df0939e627b2390eed7ad2c8b79f23df9

SHA256
71df9deac3bb4d7d9fb34134c39c53c495b83c64e6f9cc9369b5e7997141edde

SHA512
edbd8a138d6638227f7186ac264d1b55685196cfe2563b75664107736b289d6bac8eb627a17db22c1d263b30d910136ad38762ff13b4313739f13fdb6af82f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9966f44b17c77497afab928979d7db1c

SHA1
f90bcaca08df94cbecee267571248dc43b821aa6

SHA256
754b4ceaff1d6fc4029de35d99ab3663084430cb2b49d2a86430b83ff0d6a14e

SHA512
601c936c2aac2416ea54a4867cd9b58f5207cf9352c8ee6256d8f221c4f5e6e7eaa8de20ea286a2fb73865e4b4050ddf80ce50c52c0a737a907543c53ae44ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aea928509f195d440ddc8888618502f6

SHA1
e199c4242b7fea61c7f06a04d4c59b755c4e6d56

SHA256
d37ac8bd30e2a1d067f9e0167a39592dfebdcca51916066d331dbabb3bb3c1ea

SHA512
bb2fa9087d2a26fc720e7a61380021d1318264782c1037d5572c23c5fce9ae7dde73a2213a195cad5291812c16694f5de30d45774e0d0e98cae5faa332e469e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
235b022b37d8e1c927ff932f95872fc6

SHA1
b968a99f3465459dd7b52172b9b1f00c60c4d33e

SHA256
f4e067d861fad600845505ed18efb8d1907c5da94534a5251d218c7f3b33b141

SHA512
9997eac0ce716f70b93f9e5eb0c82185943f475a24de9aabddefc2839d0e9401cbc01e9c4bb46c4111f5b6c08c1f34626624eea148f3c5ba36ed45d897a4a11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4275d1e80979d149ea32ad12d549eaa

SHA1
88e2bf9c78692f5e0818da142976de85a20e0110

SHA256
8bbebd3aef017decfbdde12c422f24216c151fce049ec70bf27fa1746a9d575a

SHA512
08e3f859b5712fb40e24bc33de08ea0e9e39aa2e3187f722cd48bb41016c9b76a194511e7187e876e23c33715c82affd817a4f125daba5ab12704008475f3019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1704e19ba9457b86c0643083d86d5b2b

SHA1
fa2d8a83e6d029308228ff7cbdd26dc19e941219

SHA256
5a1483d2af9eedf8634b75b28c1653b71da02606096300957dd4f1f23157a5de

SHA512
9e4a0ad9a8729365899cd5d511e10a0cfe79f1a921c540bad6b56a536d1df859e182e22a9c2d0b44738308dc4fd0c303c3296d4d71f13ff7928bda715ba53a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
173b2122353233ec8dc6776a3038de8a

SHA1
995a0d8abfbe1b6a29ab5687a9f89e6fc0a89dea

SHA256
d81a69698cbdee1ebd4d9addf69fa505b4a5daf03f2d14a36f5e0838ee8db4ca

SHA512
b710b5a8095d5604c0697674c798540ca9700323ffd397d573d51e15b1ef4f6c757b63def404881944c81e4b1112876ea9f19a6f4cfda3f8a5c0356c580216b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c450352eb9a0bfa1f8f01e40a3f7382

SHA1
5e249848d951da4c9a110734333c788c0de55b40

SHA256
08191965c357bd3b2abb33471b6b8e0d973cfcf6d8c376d8302fffa141241e1f

SHA512
6fde8768551c4cc6faeee13a6e399a0a4e25ae21aeeeccdc3cf2017c27aa5db7d15133ba2057f543d1c39b1a5de6ab82aa9c8cc70a5d36f506a81d0b1aeb4dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47d6f90f450cb59fbe574ffa97deae3e

SHA1
5a8be73f13a7366d2d5e6c1b2cf033d1e361a70b

SHA256
f7ce1652f6673b9c16a024296daf968a3243e3b521873defc9790051855466b5

SHA512
c20c46183d4827e4e206050fb3e25a151f0c68b3949ab0c2b7a0b5e6f13657da29f5ac0321e7a44e956d9a32125a9e176b687b7da74d617a01cd7e34251add26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f152ca99291c5f3c87fcb0f4055e8463

SHA1
87ee0258f02f9de7ed7326df29e41c06db3451fb

SHA256
0cf5fe15b4e212e22b4ee137853985fbdc3652b1cc99f1add4fba45d11ecb2dc

SHA512
d79bae029a9b93a98c12b31aa9e9b6ed26c23e25381dea7d407b72f541caeaddea3368a801e27c06f188d0e400780ca969d725fb65f5a6ad82bb13e67410cf89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b83364a1bdd0372c5dc992503e15da3

SHA1
b0058a2081579fa1af6fac83e67e63c4d11d4151

SHA256
7e7bd421959b7ec500293dd7fb9280eecdc32682520780e371ca621922365cbc

SHA512
0a24aa0446acb8dfedb6ef5a060014f32034203d4b99b9796ef3a875adab555b2bd9541c8264ddcaba588a7ca9c2a6e4a148fed31b0e2227def80adab833363b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e70f3b42d4a164f16aa390975666b09

SHA1
6c55201bbeb735038acfc4b42b8a75b0f01b305a

SHA256
d395c7c9a5588b343ed349a4236faaa333eaf23d7530cebc4c391e218bcd4bd5

SHA512
d633e2751f774b7f4d4986a6ea36688c266bb3105b6233ff7449ffd4cef9e431fed2207f10e85cddd9f58bac3f456bd3799c3900d799c1433b0c8ef883f5480a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7716.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77B5.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit