hxxp://grupo-cgd[.]net

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://grupo-cgd.net

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB2B9771-AED2-11EE-82A7-E6629DF8543F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07e9282df42da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000002ca5ecfc53012feec2cb2d8a0e2565d42c815596c0c2377b345ab2a02d46c9c3000000000e800000000200002000000074750517cd674b84fed0e0bad5b18811e2e184483f23ac071730077c74fca4a4200000008979bde4f92661336611861ffe157fb0b3b129eae87f3ec75c2a65446d33d99f40000000404adaa2ad674d118d6ff67cd4e58852d01694e6ad0a4bc1c350307aab6f8875d8d3a38f76dff4f7999b09348f62226ca527b9f7fc9ebaee25f86aee0d2f9d31	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000ed0e42217fb7cfbbb336cea0a69e41f686b904243724a91230720cd556efdbf4000000000e800000000200002000000073021a2d67c3fb852eedeeee01549dc5f47ef298d834ec095b971ca3beb5114690000000ac81c6b22848598226ed2cd092615a94cf83f4f0154941630b21f964f3445264c29b9da87f04ff2b5a21ad45b7cb881389af05a9574d12ef4981b9b431b9267fb0dc35ce80d82f522a071a965612783960a73f42dd71a43f04c6aed7031a528009d64e203950fd97fed9a25e3f3972291d103053c2b5f2605d37038250fbe8f090e3bb2f8155d24c2f2689f55f88a4a6400000009b4cc04d318e5e9c6b85f1d7d288c4aa8131d841fef6615a2098c4bd22107ec78f9d3929f804f38afe5e10c3881fe3c10b49020872ab3715683d1d72a5bfb254	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410954900"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2828	2432	iexplore.exe	18
PID 2432 wrote to memory of 2828	2432	iexplore.exe	18
PID 2432 wrote to memory of 2828	2432	iexplore.exe	18
PID 2432 wrote to memory of 2828	2432	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://grupo-cgd.net
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f01cfe5847c808e43285ca259dd5ebea

SHA1
988c20baff96f8de6e5e6fa4c62e8b4f1afc8d1c

SHA256
79f743c9a49006e02aab6c4675e21ccfe66ffceff2d658cb6043a9d38f667ca6

SHA512
643c1de9a215d2b8d5f6457831b76fa1eabb400fc8bb584921b886d0da0ae7d4cc38f0c07a12a7344ce90612230f9cfc6a861f661caced36404f1313b94f8599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
284cf8ca22d8bc96c6e605d6efe31188

SHA1
dd4a371b956a51e4e755ea08058668a2a4735c23

SHA256
c5c97a4c5d588f8dbef92d61a8424872a2adecfbb6f7965115ce35aa6b13ae45

SHA512
05b17b5d136310c4bc59e2103d83925348cd4a332094e3f19ba0a59b1366fa05081583c1d5e5e15c1647312e487eb732d3f4acfe8b1e849b3189a55af2bcaa67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
287f556c9cdf119f569645c341e1156c

SHA1
08d8580243a61b95bd74b09f298b4712f4728595

SHA256
317e3c4fe9c7b8f7c5f1b1bd214f3adc468ee776797015edbfbe89792acb38e8

SHA512
d97a1bdc2b4703a1a3334a2a32a87a61305204d3e62321002e0020b2640238d735109f0e9388f1648b59105663e914741afb587b5065789ac9acaf4325e7fc19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ca4f42a8b20e56fdac14af2786fa6a2

SHA1
46c94e2e93a99220272f8173093b0530b80b548c

SHA256
75786d59420311b0dac33bc4468333cae256d3aec1bf02fc37910c29b50e0a34

SHA512
4fd540a3bd5ddb7a59d37b508928278994d207c682b4c840e5ab8bbd0d199f19c8a65391714ca33d94f979b06151939cfff496006050692817adb6677a4fd720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13eed3d97a69ce8d189d5b4124be7dcc

SHA1
d88d7be6515d58151fb9d4e773420ed201eb4ab7

SHA256
38dc357e0adc8c8f724deac9d9339de642214da676b65b02abe23b099223952f

SHA512
c4bbf669f93551616f0e973b47202d1e81e83c1f3b07104156a9ba3b93ab03284fd33db7787715e16459d4c52ad8287b8a6562bd47a5be58bf1f9b18cff16a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
295f362ad1558726b71f27cba267ec34

SHA1
7fc9582877486688a448c401e8e85ad3bb5f1425

SHA256
a45c905fcbd517f725b92de414d462ffe6dbbe969bf27b5e60948853cd0766c2

SHA512
a41a0d2b68a54394f8cc7880fdc00d5a53aaf3c8d00487bef634a5014d28ba7b9bbca1226bee72f685ceab6f0b2175afa4fa163a947b588afaf0af076863e2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b48d400009f4a2a131af5bf2c038eb2

SHA1
90ffea821fef53ac2effd05deef46845bbcdd598

SHA256
df65fbb7e1026345eeca222a8f6c42adfd75763fb36e820c15fc433f41767cb7

SHA512
50ad4f44a0e37dbb5c66f1c68173274bd9f7fcea48fcd5f08dbf7a7eec8b062165e67bb1e271a4f279aa64c4aa3cc1ebba23c77ae92fc023848b4e4ee26312eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69895a99145e02c5649187843adb5c32

SHA1
e4d217bd5cd1db92848baf10df59aab43b4889af

SHA256
55fa2cc7b419ee74f80a8e78ed2bcceaea9354b02d85038a0a0a4ccf17afcb40

SHA512
413dc4e147c291ec70aa1bd3a4835fae7d3e146c7cc99e0adc7f4938a34066a4a405d98abf5111c057605438dab5e20f70eddbd78864f13b9a1aebfaaf0993c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
781ce53fe72dc058980424c6662e823a

SHA1
0e642eb2b37b7997a20656978f930779a18d33bd

SHA256
e0f08bd023f6c6f1a588725329cd66c15dfd8623c96c4467fdfa4a9fdd42680e

SHA512
d98e662ae7039297b98861472ead3bd4ad217a3404d6e96ab57a674301806b251fb640c8046a8b6daf6eabffc99cbff8348f008cbd22aa206eec5836aeaeacd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8a2e974f869ae00df531d3c0ff0fa3a

SHA1
b27de80c865a2976741fee230869b75e67cfd427

SHA256
29de61e4d3ffadd066be022d251a3f7de64d3b45b3669512320946863cd89ede

SHA512
8d5ca359336f577ac9f5f6d54de3765c1cbaa496afe3bd657124f1f814a126e86293be232e9c3c990f7d78b0bad64c53c42a736fc08fedacdbf547e69ac8c47f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f6bd5b238c43b501bba546f1925023

SHA1
8b3dfcc1c67216cb2ad43c72964acbeb789feb90

SHA256
8c15d4159764d279204653260dc6f2f47e7f592ff9676d3272d6de84dab9b52f

SHA512
c287ceac622d5062a77bf9cdbb59b18d405a61a35c1c501018f69f67e4e1a94cae62496d821b90bf4901679541ba89e0f6065e3aec7e84e672c911b7c58e7485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54fdcb3722d205a30902a272eb14b467

SHA1
e7752180a86f9d68f8b68249f85c9952a53a3e19

SHA256
e562de529ca2722ed2025def5b5b1dff82da55f88e9c44ff2c20cd65769eb162

SHA512
651513d4ca2fd871c2c2214a91a77751fa26a168213cef393e6dafee27aea39f3dda2b006f16b7230cd21f98615978d23fa1b1aa7ff4184b0f4bd149512ffdfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68fb8818b8879868a416c80ea70ba392

SHA1
1edfab53b14ffb56399c5e59f7692c3f71e1f13e

SHA256
d1a8c95dcafb0365505ab3b30855846b233e3a46f3d7c075facef60d047d36fc

SHA512
8cde902a4d69179021245527249d3c788190ee93da02cdbedd594397c57fd4ae57d210737590e3b89d8f270e602a9dabc6885b04ee3c468662eb312bab396346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a58beed3567c94c921669153890bfbc2

SHA1
d0c2a9efb245975222d7b9ca77c3fcdcd8897edf

SHA256
afb1b96039d07ade78d909455a443a88dabc0feff3dd359cbb13f09eac951e8e

SHA512
5a28fd15e9db130aecd2a199548f9db55a9af6eab1c7ad2f143ca1ab0f73e94f28325bb2c3601ea2cc855716fb943d67a599d707d604348f446957e6d0776ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70DF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7999.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit