ce58646be16ffe3ea9deb7e9184a18e0106e8141e882b0a84a41904048e2231b

Analysis

max time kernel
237s
max time network
280s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3a7bc21b8d091801b53330617a76be6e.exe
Size

43KB
MD5

3a7bc21b8d091801b53330617a76be6e
SHA1

b749c65a7e077f532c395e031d144fc3b0fd8169
SHA256

ce58646be16ffe3ea9deb7e9184a18e0106e8141e882b0a84a41904048e2231b
SHA512

807cfda82082f02fbcfc7b259afe99d50e6ea122393d4643a48ebe27e65f95cbdc030004cc1e51cbc3e9ff69ebff6244feb48d6ad3dc2250cc9271a02733a860
SSDEEP

768:PCpqFQuwuL+9WiMOfP6gR0z96A0716ezPv/t24jtVjhzJZ8x:qpqFQqHJOfPZTAETnV1+x

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410656745"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002bdd572940da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72B4DEF1-AC1C-11EE-9139-CE9B5D0C5DE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000eb12e8fc0058b8306c4594ad3685786ad0d9f5df7b1b72a5e5ff41d4547b1531000000000e800000000200002000000020070c2e277e3badaa9f8836d228431d2188fd7b8bd45172b83654f3abb46a4d20000000c284a87ea2acb7d77cd487085e503b4a34d02742bdd6aaf72ca78a0d4fbbf04b40000000bb8009f73755acc65459c3334fe5577235a8be07ffb4373a386c5f82e80f00aadb46d2b998641800946e26f54287ab4054800aae8aeea5c32396effb5dc0cbbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000009f0fdaf1325498ce7ee034563ba06fe27cebd96ec4ff679467e458a55481efb3000000000e800000000200002000000070aa4d39fcbb33e33fc48d32f8f8742d7e24ff80c49f11b5340960a44a4d6891900000005dea614c8da8fcc46654762b0a895870e51c88adcd558e70278e68696c661f6df460752cf2765496f424a0deb7fe5504ab409c21856e9953951f192a68b1dd37d6c37807a4d9a2e787f487bdad7760f9f9b41cf1170d6c056030d21df9939d764a8151914fea365605589b68aad409703db8cf14b446c07080a526320b81648b61079e7398cabbb4292db07b48812dd9400000007cbc72b3670f3296d4a5e03c84a6baf8bb4502f3494f2646d5bda8c7f82567b86b3818f98d329440c9c3eec3edad1ddbda75994a527d136a6cf8f59b54d75219	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
308	IEXPLORE.EXE
308	IEXPLORE.EXE
308	IEXPLORE.EXE
308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2788	2920	3a7bc21b8d091801b53330617a76be6e.exe	26
PID 2920 wrote to memory of 2788	2920	3a7bc21b8d091801b53330617a76be6e.exe	26
PID 2920 wrote to memory of 2788	2920	3a7bc21b8d091801b53330617a76be6e.exe	26
PID 2920 wrote to memory of 2788	2920	3a7bc21b8d091801b53330617a76be6e.exe	26
PID 2788 wrote to memory of 308	2788	iexplore.exe	28
PID 2788 wrote to memory of 308	2788	iexplore.exe	28
PID 2788 wrote to memory of 308	2788	iexplore.exe	28
PID 2788 wrote to memory of 308	2788	iexplore.exe	28

C:\Users\Admin\AppData\Local\Temp\3a7bc21b8d091801b53330617a76be6e.exe
"C:\Users\Admin\AppData\Local\Temp\3a7bc21b8d091801b53330617a76be6e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://paginas.terra.com.br/arte/sonhosepoemas/amor/c_amor.htm
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca3ae6d74dbd29ddf6db223047d74c81

SHA1
100a5e0e94dd77cf6f8046115ff81e2063661733

SHA256
26f065b5f2cac6e26473298d404aed4251505fe4e5fd5db02ad1b8409f750dde

SHA512
78be6895a61e9a88d6a869aaa1e770021bf553a17bb2604861ec04daaf4601488f52c89718112e4fd03abfb7138e68084e36795f8853745dd8efd8402a8315e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
662d3e34569388c7668ba5cca5a41479

SHA1
99034521a9d80cc8a5c09da1dccef17b4e97a7c9

SHA256
b5a85e993198acc603f3fb937a0e073c1902eea7e4e0005a10941a0de89c49fe

SHA512
ee7d61c4125a148a181e5762a844d9814e70a81e906e203a923eb241b203aac0fc1ddc3088f738304b83b015a447136dad7cc6baf783a4386e10673e926b6fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e6147d96f5887ede304e24a3a3371c4e

SHA1
52fb7d33268d5fbb447d25d2433119a788f8b30d

SHA256
411cb7c7d6d0433448becff4b716870b5e4c9dfabc698777420b0c6642aaa221

SHA512
caddda505bbdd06fc35d5391bfce99fa9264e81e6d72c90cc700d79b3b1b9d30d71b3c8674bb1718ca206bbd517cb01b88931a287d0b11b8f692a09720fae197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eda35dc4c53cd9f02ad645605e8a86f

SHA1
425a348a005113911370b36018c086782b99aabb

SHA256
0640cca8aed67aae7afe177a147de8151befbb06c371c0da60cf270635f07d43

SHA512
623056d6406007f969f628169047eb041837d0b2ad7083b3d6ba7f0ad9c45ce06acc84752ffb54c79e36baf15d12e3884fe3807046b52a679b55d7a9f5bb62d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e61b4a0819a3b9359009f84fb892b08

SHA1
2e658d878e212a9e090ef316c20519263e22ff24

SHA256
873b1202d36be5a196e8842413fce91984f4969746045823d26de5cb71feff7c

SHA512
070d8905e89bea8789a7debf28dfc4026aaa8bc500ba1fd81ab5ce94502c43e5e5a3e202f3e431c3a7196882269296fbd4c3c5d0510de193094d68ad550933f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2392388e3e13fbb193b0ace3efa6c51f

SHA1
2a301c1a61bcd180a4a9cb9fef183b8857006359

SHA256
b46997b560d2553f98e3fd3726f27a58a050146bf7160c23b31ddb6694d4cabe

SHA512
d1b400c59ea5d17e0361d7b883f8b80365503b8175d47b054001d30fd1617ba1b207bc8e628639c3a1bbe5f48c7a7167211afe47e3910d2ec69ad8e48ce01162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
85e56edd3a8fd03754757215c5814e23

SHA1
5cda2e0d1b1471ab8d891ad2b44f2ac2d75daf74

SHA256
9cf8f1d018acf3323db42894383b44127b2417573f11d08f9d3a44727250fe22

SHA512
df8ef7f500ea72a8382daca52d196b45e68477c25f5955e3428baf7d94f434d4eb057d20af7d085aff4fe5f4cbf6fd22e1fee517f9e7d35f2a75551efaa3a259

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a151b4bd52deb475577044ab714536af

SHA1
3036ba3da4ffb3c699334a7f0b0bc093c71638f6

SHA256
81731bc8a1cd68c18d4a751e5cd195919ae19d7b8ea0cae37a1520a57688843a

SHA512
011bca622ad97dfec59723be0d029bd6811609d134dad3a1f705fe6b71a2576188d66dc7336d27d9deba2c9148878df8bdcecfa881c71368c2945cafa5bf99c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71255a7cb1a57aa0fde687deddc2e8a8

SHA1
af041b6ad6bf21339243f489951905e4f2167ffb

SHA256
fbcbdfb24c5aa96376e5a15908c5898394b75e6326ba3d96cf933a828c72b9a2

SHA512
256b2953554150a8aa30122ee0409ac95098815b284f49ad89cad21195afa83935ea186de540e9e305d2f9d7cdeb05ca7d9f236f738821d687922f8c6b87d3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
273293c13e541b53bfefb75a91667449

SHA1
a6f8a0d39eaa1b0c8c6585ad757b0af834bd9322

SHA256
baa1a4166af84b6df196191476ebad5bd19fe79f2a1184abd9f9ddfa4a4d6dc4

SHA512
40c1479f69f2ae27ea05c77065e80623bede133bb1e91a1da33b1418311b5c4503eeb3dd5e954361964f6eef98baca902ae5d02ee91a8b950661291e5c078fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b2000926aee1a43413709a0506875c62

SHA1
db31ca6375cd5c27ffb4d1ffc9fec8c3e112f82d

SHA256
c6016f327aad1c6bc45a283791a00436e8ddc6b31a5e57018109af112fdb6e32

SHA512
6022b6a485d26f3efd14e8f94fb017d91f61f31515ce7a2052f625b0f761a2b4f264f425550d9a613a623c6d4b12298ffcc0391b889d239f1ad103002a140157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c129cd5551477d7b5cac225e24abd57e

SHA1
14623748e799866f34fe173213e6410f7d5f8d59

SHA256
faf3f69f4ed068e72268d0c4ab0a1b582d8d7d24b455c982ce3913b7bf8e7299

SHA512
814aff2ebd48f46c642834a7f75969f4072bf9f986eca6a00d3ef1ea7a20bb4b56b8a2a62c99907966bd14e9b1b755be4ee5abd05be2e310fa140af143823b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
627887fae779a3aa9ffb9016cc72815e

SHA1
e5f70c46705a41fb38196a8445d1ffc38e0bebd3

SHA256
16af6effb5275c21c076fd993fc6d7a5ca18d7d4f6f49f59cf3e1ed28fc20c89

SHA512
ae02222fd0506abd1800e47585aa2075f5528fe93580696b080ca66298c16b2f74cb58168480c55bd4c56fccea28a1b150d4cad14b21cb78708f0f56c7cf8791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1679af367478781c5340689037d5cbb2

SHA1
b258a67d55451b9237fcd7d31eb3a5ceab8e79cd

SHA256
893f6d8921bb8fce3bb0ba5ffc6f218e74cf298c5abc96275c3bd3716b5b9911

SHA512
9110519ff663fb25d4e446cbbbbeef41c344ac5c646023899d4a2fd05d0ff2255a17252cb951bde354e94d9e309875addeea5bf898615c086bab3f58ea633188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9e8bf474670b79333b8029fe21094eb

SHA1
4b90c1723c685cbb66d8985f19f10dcb653a6642

SHA256
8df7525595dc60f500d00a1abb3ac9aafa41f25f3d77445fccdeb4dd194e09ad

SHA512
fbffc3dbb40d50953b22446b4a9646e36521989bd4d2acf54549f679d816dc73c23c3b7119ae363164dfd29ed30a4cec006ab3fe5a96f997b650970c8569dcef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5dbb5762e628fa8740f42469c9ee33fc

SHA1
f02175bbf1442d6fbb18927a0400511a19307979

SHA256
516d0f400aad674e16667af368f98d49ceff70030221f2002f338a02a187ce6d

SHA512
0d9c2f2e7f5a274f9f682d8f26e44dff550e634866b1b4b28a0ddb5037f32d5abe9b52b9c7de1a96efb209c54cd6a4141327c01064c13a86011ede648f38fefb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar93.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2920-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download