hxxps://brad-or[.]negocie-aqui[.]com/s/wW7LM75

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://brad-or.negocie-aqui.com/s/wW7LM75

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95E9BA31-BBCB-11EE-B59C-EE5B2FF970AA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807cf05ed84fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c8a8f92369cdab732bec7be8bdee0f71445a4e79ca6f89f3ef71394d8ca3ca4d000000000e80000000020000200000003ee075532493be25adae8b9d74e104cba3be6fe9f377de24ca31191b34e65aea9000000069ba3ce5351df9ad0b992e6a4f81652171ea6844e9d0ad4b266fc5324f57fc12bdfb4628b8a57019c6a4bb7aea2f3c28c80989ea194924d5eb8b4e8c3c7b6517904831a2b84fe5371c72ab53884001b8719cecc1ae2732f4d7297e865857a08341647d738ec112785c6ea524e32c78558e45ad4c250ca6a7cecd4d9cc2fada381854744e7b2c2c2cf036e36f8826d420400000000906608505c37cfb87965f5ab7e17c23db48fb5f3a89212e69365da736a4246b41d538a96cf2bcb9e43f34ef11534a398164debc4c174f3699880827ae1d5a4b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c1d072b6e8976c744bd17cf9df875357f24a73717a73651c82b657349b33f206000000000e8000000002000020000000962a1b68ad58943a957e3a5e78139ac1099753c4a0e1be4a4b9908e1a9da093320000000f4c60e091615ebf520c31058d33a838dd01e2f3145b6938ff37322becf063bba4000000001dfd8f8cb073e434631f959335bed835adf73cf2697ed5a7d97eff07ae3a1907dcd1b79a4eef32c4ca2866dd54eedc83d76ae64e9bc13f912de2466ccc8fa48	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412381224"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28
PID 860 wrote to memory of 1272	860	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://brad-or.negocie-aqui.com/s/wW7LM75
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8b91d99b76a329cb3e14739dc784f757

SHA1
c03ee16660f300b45b69fc5d46657bd1342cf8b0

SHA256
1419aabdc5c3e18d0042870a5970c77a0b5562d8a412deb457974b19ab242fb0

SHA512
2fe957619381cb16f6fdec0a69899e8a41430544c3298a07c6070fe62e03a8baa6151ed491899480fc192ec4f560f972c582aac74cea37e366151ff69d3cbf1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
946a20fee1c329fcb6325d88aea900bd

SHA1
55bc150645dfa2dae978d88b0a24f931c98b1eb8

SHA256
8bd1bc9b2c2a2dc3209f1b32bcc713f975e717077ee95e37942ff645d32bc552

SHA512
6f8180e6d103368125bf5ca9ac592d1df5e5d4e08516d406e29010e56efc909397de32f239ee07e428ded4fb005d631d76959e28b8ac85c63f03b881b3a0f5ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dd3e919f94d853ec251bbd5e490dd01

SHA1
88a0ed7f534e1c6d492e516df89e7e5f06d8e5de

SHA256
b054879b08f1d5284d6e64ff4d95fe5e4db820b88cffc3ea3b724615401f772c

SHA512
c7051e29856dfbaa4a313ab19525d5df7173df2f0c4ad4f0c3c99b4bfdf37b4b56fb89e46eafdd77b5eb46acbd569141681bc2b4f3535181b92f98a1275bd65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
747b68925dc30f8e25ee9ddf461a12e7

SHA1
49aafe75a1cf99d7dfeb805f635002fc0ee9ad33

SHA256
63e172f273f085b732577372aa29ed5741286fd5acfdf29d6e06c1dd74fa78d8

SHA512
b05ec5ff2e9197bac2bda5d1230a0cd6de1f295b8444e41e32301c0426e7eb58226f11a8749b317694d022c1fe5886db1be369896b4e423c6ddb884ffaffdb70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bb4d418805f81e7d38435d53d3f4e58

SHA1
2a2c2fc87fc253359fdffc2d33ba09b259b38e3b

SHA256
f015136f738dd6615c4edb9e313a6aeee2c144a4e1211ddee38096e5cdeae339

SHA512
a4ab51d2e3f9057533e4839d400791b5621bfa2d2f94bb8a50924f0b2746b192def985b65f0db614e79b32606c995614508ccf78bf961ec36e1d9ae815db2e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef9d08c7e110e76b066fa8f79b653ec0

SHA1
70b3b4de9932e9a3ae73a7636377eb0538d3e7ce

SHA256
fc29d6021e7ad457a0af5045051c6be48a74d3adb927e1bd39e4d7c03322e5a3

SHA512
9dc93a72942cfa193874b579ebe5e8b6d41d8b94e1dd9e582662780fcf4b11e0c24eb3ccf604a168c33e27cf45e1c5a8739e34cc46a3d03559784394799e3d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34058f4c029978754647534f875ee74d

SHA1
7593ea4bc1407868b874064958aab009e512151c

SHA256
7c4a82700038137320661d8d6e0accc023858419bbe3e4951f6b4b76fd164934

SHA512
61298597189269955a08bcb5b8fa56facb709f81c0e4c85312e98da117aeada02878520e234494f24c1d2e763506f462123a8fb737c31d7e6f48ab77835e1a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2613c664e5dce57cd7feeed5fb4554

SHA1
41fb8c7cd8d6146cf0ab4bd1ac90e15f7b522e27

SHA256
0ca8db70804be3895925561b511629b3fde15c65723366b9c23c33134aa8188b

SHA512
5b5aa1fdd86c5755813084a419db7ebbee763f1781b69d712077c36f91ad58866da02e621530f2a3cf8489d4024a20c598f38ea6af069a550e70dff661583f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
238d16f7ffa6c28a636bb3ee9c7630c5

SHA1
670163279e410323e0be4795d6bf8bb2cb4213b8

SHA256
ec62e3c7944e6a3551bc2162fa37806063f8c4e167af952d1e4ebe52cadb8752

SHA512
88decf5682a48a9a39bf6d9712279f994c203a7a8d89592f15879c416b83b8eb6abf34026fa4c851cdb5a86922455e783701ad169c3a6da38c44363413a9ae60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5abb5ddd75db34dc4e863352d5dce26c

SHA1
7d63c42f2925436413f8d6adfb7ed2935587b46a

SHA256
620e293bed2a584b5314b6a84bc13b35e5c858486020b423fa1fcdc2159a7cc0

SHA512
03b81875da16d20744c452b7763a0e7d7f3f3bd570b3a5e503b8d51cbca92a40c9ddac5bcf1cce40a3ece6e9d969e561519ccf8769bc6b229e550acbc116600c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9f6dbc52aa7d02dbffc8c641a616701

SHA1
13102d25e95587ce6cd325e953e68be3a519d4e9

SHA256
3ca4bf3e5df9335c5ec5d09b2755ac23e267ae530ed8422b8482f4605a3f04fb

SHA512
dabe1059f8a5540a9864d8795b2e94584315723814c30e2f3314938a587af88e0ccfd68781c0183ecd3974d819c8ceae9f5dc6ab9ad575266c680f713d753b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0540933a0cc78a1005f70103ebcf145e

SHA1
934fc144dcbe5fc1c0428ea9ed30bd4cec8e3a04

SHA256
400c4595d31a172ab56916b52e0c694018721d2c8fa276a20e95e57e34fb2a27

SHA512
e6230a9af69b54fef84700eb3f2c740816dc72ac17360b163eeb54f889cb4babf74e07c79b43a5177b8e4a602d35b745bbbff6e17650deb54d603fc8dedaeb9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efe737d557817485bd2b9abe8548dfb6

SHA1
bbc81d1fdbb45f65d7e5ded8051814279e3c37a0

SHA256
3eaddf388cbb39604665c063b7456d61b458a0de7a84d6716eb1e6d3116e3989

SHA512
541bded9493fee15bf842d4881b6846936bed07ca63ca8fb361dd1f81a7255704f3ba7cd0dda496c60107916c5b2dd211897fa208dd067fb9f325faecede8b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a466efc7c5d466ba5a3986ec3590a47a

SHA1
6e7c0551c5197d63e0abc908a36cdbe48828d6d3

SHA256
f82f1fa7a15563329aed641c26d7ead24d1b9ac5710f0995517db1eef623acc6

SHA512
ff15b16c658ad4b144dfbfd3a405580c32f6932db3fe6e8f06e878ebd5475eba0ac0d63aae2cab7ad699b7924af9ccd766ca519da1e63d1b44e024d884d0c3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
490c502d24fab0c30cbb1b30eabe95fe

SHA1
a009f8372cc8870404de7d383b0acb2344c597b6

SHA256
7d5cbe3d88fdfcf40d2d4c8d78fa5fb160c0452c958d16ba004db092acd286a6

SHA512
83cd6f1b858eab5f68ba18b8f7025098bc815b30775151d2b42df709da5c8ad3e5b94ef36da9c036beab8c836fa97f6fc6c2bc73501199adac00a884e776d498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17b68f53a195132691287e5750d3f8f5

SHA1
a18a5c9a15a48ec3000390de6a18dbd86a5eed9a

SHA256
4af770e0db95217418bbe4ef01339b6ceabb61f2af9f1f633ee143ba75d4d331

SHA512
56062417406d974ac928852290614172687f6d175845dc36d729551b68ea20ce1cbdee597cdb121c78bb1c47638cbd959465bc44e032e5e24a5a12ec1ac9d073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c2df70879116fbc3430dc06bf5dfd71

SHA1
ff79a0ddca195cd8e637150704c6bd6f6dc2b819

SHA256
73dd0ded0f90ada4014040b5470181b37ccf37c9c6462bb99f4386d9b87a596f

SHA512
134caa176e58a6052e8a65e8cbfa78078656d97792dcb54c6d10faa0225a2c68d13e2ce0463352a250b68c6a2adc6327d74c62cced4a8ae93dd0fcc3f72fc00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4a009a2d12d543efb9ff313285a598c

SHA1
b60255f695a11cd67bf9e345b10b03bd34f9d654

SHA256
9634d47fd9c6b3fd6a3b3174b183c108d39023afa7b625938c33509b82c23a83

SHA512
00b456fe4f3ba8e651db147e96eede720e4bbf1086df5056af11a0dba3093320b25f90f6ca29176a9e5badb408b7bf11171e5e5c348b37c5ad832e23e74daa1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b372e0b530275a19ac40e3cb6075c306

SHA1
61e575190b9adc7dd61cab4570f33e5080d1616c

SHA256
6c66b14296f2ec53fef8d558571e73623746dea04135df423031cfcddd9e0915

SHA512
52f580d16fd37defaedf7cf56a34d5eb7a6e77265bac9ffe0c121bdc4d8237ad1985fa78145fff3a5a8dfb59f09365a50ee1f5e20402f6cd2aecde439543dd90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab347B.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar352A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit