b0817b6ad499d6e995c790054b3c348487fef158e3c9fc93b768e85869720647

Analysis

max time kernel
69s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09614c4a0ee6bead24ee56b6f8ea45b5.exe
Size

198KB
MD5

09614c4a0ee6bead24ee56b6f8ea45b5
SHA1

70c5e52406cb4ab849a9aab1c14145330f6a2318
SHA256

b0817b6ad499d6e995c790054b3c348487fef158e3c9fc93b768e85869720647
SHA512

7b69db354fd6c33bcc355bc899d788d142291a481aa25d449d5ae3af82b93d425cff05bc3ea500a332bb578873e0965aad508bdf6e54023265bbe7f48aae17bb
SSDEEP

6144:Cg1cnoDUQe9OLWyY2+whhKTG9CPUJSUhjl9QnIQS:yoDUQa0JY2+whhmsJSOx92S

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002b32a16938ba57d1dad6c1877b40b6860514de8e85b4fc8b44b67311f44974d3000000000e800000000200002000000000e03e223e0e5d1b56e9df814a6cb97cba95dbb2d63751a88e6a18dc774c00fb20000000e15204b7cc3bcd6ef7c78fb96948bfe94166604b5809eb09788c67f20423dc83400000004836173d511201e26de120733dbc006ccdfcc1b7c53adafc9c33d602b1b6e813df75aaa4b5605172457cc9e0b808dbf283702ad93c154670169562b073fd0f7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A682CEE1-A70D-11EE-A497-46361BFF2467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0cd258b1a3bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000be7cafd7eea785c99ed32f168e5f17c275d8ebde29dcbb88f0a6781729bd46bf000000000e80000000020000200000008d22b3a0bd8f120b9102e5f67db8bba16dd89ebe7e782b0e1371e49c9b071968900000000ecea6844204d642a748da62009be2f940af12b2f9032ff74674e8499e108abaf41ebd85bcb725787c89410fe92c6163b937f42d0d3539330d08695210a007a8fa103bc05a96ba501e9d222620a4db3031883d513cde6a8c4ce1ef79136cecf09517ed77147e0043d2637c6dc72775b2c40aa7086e4a4e64e35f3f56b83895d340af196e0648ababcf678ba887e6b81540000000edd2ad6bc317f4935dc75e90e98df787d22dd1c6f4ed7c6cea30666298f3b909260fc96b49e70df260958e0d52e3acdfaaf54cf6360af5000744d609ca8b78d8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 3064	2928	09614c4a0ee6bead24ee56b6f8ea45b5.exe	17
PID 2928 wrote to memory of 3064	2928	09614c4a0ee6bead24ee56b6f8ea45b5.exe	17
PID 2928 wrote to memory of 3064	2928	09614c4a0ee6bead24ee56b6f8ea45b5.exe	17
PID 2928 wrote to memory of 3064	2928	09614c4a0ee6bead24ee56b6f8ea45b5.exe	17
PID 3064 wrote to memory of 2684	3064	iexplore.exe	16
PID 3064 wrote to memory of 2684	3064	iexplore.exe	16
PID 3064 wrote to memory of 2684	3064	iexplore.exe	16
PID 3064 wrote to memory of 2684	3064	iexplore.exe	16

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.vivo.com.br/portal/home.php/
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Local\Temp\09614c4a0ee6bead24ee56b6f8ea45b5.exe
"C:\Users\Admin\AppData\Local\Temp\09614c4a0ee6bead24ee56b6f8ea45b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
975164096c3dd51054b54f97970be394

SHA1
f9e6a16640962e7a96cacdff74d47375b315e456

SHA256
33814c36a9eb26e782df9b927baf177a1f505c4daf5550afb8b67ab5014c3039

SHA512
dd19200d48b1437be9adf3b609a2304925f30fcda2a95d6d94204add31d7baa40f52785b1212a1e4cff97a19b242641d86d0ad7a9c0a4ea0f36504a92ae3a598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097c156c204a6a68cdad5853eea028c4

SHA1
7fd5a89ef9ecec548b4a287d1f351beda0893227

SHA256
248e7db0e852ac21dd7ff4a5dbb3f956d5ec8aab73cf7bfb2d01d9f49cc0b75d

SHA512
a2d0310bc620fdd8e3f3e6ace341dd4e6edc7cb995d7daf678f650aeb518348ad5155378ec1c3dd03dabbc8c2424e8b261d5e9da57a66c2f4591afd8d796e220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f040af9b5d89bb917a8f7e29e5448b01

SHA1
aa45c9c589d9c7afe3664d178ebc44ded2ee7c53

SHA256
90a3530b7eefd8cad513659d9f45cfb66faef0f31cb3f5d8b5d139e2a3183aa6

SHA512
aec1c3cd1b041a93ffb995fab593ca0363d3c7495fea31631c7161d1241e9b206f2c443edfc079388579b15ebab6555dac46e8b2ea3e68aa3045e572f87adbcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8137e139f056840299ba386717bd24f5

SHA1
319491901518b91ecdce1b5de6e2c6dac234aea0

SHA256
a7f5a481115dd00343763a5d5a508f6948c5183ed51aa0b94d1064ddc4d37b97

SHA512
fd97f56373d997fe54ce9361306a5a778c216764a617f979049d2576380630f3fbc88f30342d0aab2f0f3cee039ed819ee96d2c753fa97455759be23738e4c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7be0f00837166b6c062893938a0481a3

SHA1
5a8371e4867d858046ea1d8d42e63e49dda06435

SHA256
02dca3bc97ed0dbffa3f1821c0f282ebe9ff7ad17566f021805c7c4cc26e401c

SHA512
11f724ae6e7331bb9c5e02bb38119eae7205385fad1e2b46f7f4a29f2ba5ec8ab772d1d2256ea28dd987dd338be7ca23d099f710913777b841af4fd83bf05c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb599180e0a6df57a95d6be4da64c18c

SHA1
abd5defedb9659aa4d991fd052f9ba05919f6025

SHA256
9ebc5100de66edf34f7dc3e82b432a53ac0ae5f21083d88c87bf4c08c0609e55

SHA512
37c9b85b2d9e1c1ac998a7f3d250307bc1a801bb340e2f9ff1f53dc0135ac0f43ce394952d141ddb37014c6ffc9d0f070ea249618be14f2aded2be8661a88829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c46c6c9f101b43a4cde22c9678a503ea

SHA1
28bf354bea8e0a98d562f406e527239119783d74

SHA256
0ab41ee0169eb9582f95e53a0e71bd2831e59e541b6246e54a51c11392c384fa

SHA512
5328c9b06bba454046170a0fc78d394ecaac4c3326c393f974fcfa62b14c237d086db452740b5c6e5825f0302a6ce5a6fa5bdb70d59e59321c838665058b7dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
memory/2928-29-0x0000000074AB0000-0x0000000074AB7000-memory.dmp

Filesize
28KB

Download
memory/2928-3-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-26-0x0000000076C60000-0x0000000076D50000-memory.dmp

Filesize
960KB

Download
memory/2928-25-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2928-24-0x0000000075030000-0x0000000075038000-memory.dmp

Filesize
32KB

Download
memory/2928-16-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-15-0x0000000074AB0000-0x0000000074AB7000-memory.dmp

Filesize
28KB

Download
memory/2928-14-0x0000000074AB0000-0x0000000074B08000-memory.dmp

Filesize
352KB

Download
memory/2928-11-0x0000000076C60000-0x0000000076D50000-memory.dmp

Filesize
960KB

Download
memory/2928-10-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-8-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-7-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-6-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-5-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-4-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-27-0x00000000751A0000-0x00000000751AC000-memory.dmp

Filesize
48KB

Download
memory/2928-2-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-1-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-28-0x0000000075840000-0x0000000075846000-memory.dmp

Filesize
24KB

Download
memory/2928-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2928-30-0x0000000074A60000-0x0000000074AAF000-memory.dmp

Filesize
316KB

Download
memory/2928-21-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-17-0x0000000074A60000-0x0000000074AAF000-memory.dmp

Filesize
316KB

Download
memory/2928-19-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-20-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-18-0x0000000075840000-0x0000000075846000-memory.dmp

Filesize
24KB

Download
memory/2928-13-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/2928-12-0x00000000751A0000-0x00000000751AC000-memory.dmp

Filesize
48KB

Download
memory/2928-9-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download