Analysis
- max time kernel
122s - max time network
137s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
12/03/2024, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
002 NOTIFICACION DEMANDA/002 NOTIFICACION DEMANDA.exe
Resource
win7-20240220-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
002 NOTIFICACION DEMANDA/002 NOTIFICACION DEMANDA.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
002 NOTIFICACION DEMANDA/mural.htm
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
002 NOTIFICACION DEMANDA/mural.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 002 NOTIFICACION DEMANDA/mural.htm
- Size 517KB
- Sample240312-1mcjaabd5y
- SHA256 24a2b719b46a393b8ab91f40a8a52ccbdec64b9dfbff319ea4be7970e68691c1
- MD5 67f92638cf40c5f3da35887f8a1b68ed
- SHA1 65a0560e3300df974e6c9a6b246d01b0f078dd61
- SHA512 34be6422a84de72279ecc43d86c83ae67fe6e66aabb40f0cc29225e63249d2eea654efaf86eb1f6cf96c5f8d567dfa8cfcfae1325ea34a4ac4714a0d2256031d
- SSDEEP 12288:Hcu6QjbYacUHGL0oWGFmJWz+IAP9f972nrsG5moqWDJG:7pjDdoW2mYzz03uDQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000d5a4aef6e0046b15796679d3b845e0b7078df25a45d7d97e832f844659effa3e000000000e800000000200002000000073e0264693722acb64c6a624fbd0487bf6e3d25f315cd1e011c3df597e6f1f572000000007228bbb70b9f1b5b136e9890bcbba6d39ec813a5479ef42d0430eedfcea6e624000000006a3ca9acdf56bd6d528ff236633cf1ead88ec671dd344becfdf0fc43a451f4bcf753c6a996fc5dead62804d805029ac613431fe24c44fa97cda98116be05502 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006830ffc674da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000d8b7a02b7d26c38f9db21ef29aa03ddd808ea74444e5de43eea7eeb1d6d24382000000000e80000000020000200000001c0e8d9be88a5d95f77c2c225f1f35bd20419eb5f9aeb1b0f91e2296d7b24eb790000000336f45e55098997a6410dfd0f227b4833cc85325e831c0c4936066a554a8164bdf86c67f5e3c38c9e8263e846fc7920020b379e6bc5ef736a2cd9390b15b12d087225d994d97a760c3c3d8a1e723cebd71d2d52d3766ecc5d293101e80a6917b020d7e3cb309d55f96cd25e72544d7524e7468f5d6f1e971639f93ad652d503798753401df2ed7ed2c51e40813d12c97400000004a91da853b0fd524120d9f849ab757b0ee06a749225112be5962f58b6b968c3f7c814bdcc8070938c45a28604ae759b94f2159d70c4cc354b030387d18ad57d1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416441940" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29915001-E0BA-11EE-A71A-CEEE273A2359} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2516 iexplore.exe 2516 iexplore.exe 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE 2056 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2056 2516 iexplore.exe 28 PID 2516 wrote to memory of 2056 2516 iexplore.exe 28 PID 2516 wrote to memory of 2056 2516 iexplore.exe 28 PID 2516 wrote to memory of 2056 2516 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\002 NOTIFICACION DEMANDA\mural.htm"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 67KB
- SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
- MD5 753df6889fd7410a2e9fe333da83a429
- SHA1 3c425f16e8267186061dd48ac1c77c122962456e
- SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
- SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 803f2119ec1f436bcf7ec8583dea0d66465955571bb17a7a4e57068db98c4997
- MD5 8020d709b0342ff218f7478470200474
- SHA1 a5c9b4a21553ef0d483d01939bf8a957390a777c
- SHA512 311477a8be661fcd8985d207f16355fb15120496ce933b4b554e131aa886c24a8d0f9994de3b328b719b08bd42642e96e971d52dd6f86594172d92520dbaca01
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 7480950848de35253bedce7d38609ce7c1c424c342df0fad94fc56de46810f43
- MD5 1c7b586b8b69542b2d14ac1058a44cb4
- SHA1 a21b59164e740192c0db58bcf551363aeb701164
- SHA512 c13c926ff10e00cbc1999d253472ea98397ddec3dedff7fc92713596407a7899246886f3940b3d429167714fab354bb0d9a13883f827d05a1e09d36dbd2daccc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 1ae92bb1447e8bff8453c652ba5565cf4f062d7506daab2032e38712f0e0507e
- MD5 90a79445469db56ce5656661067b4181
- SHA1 13b939b2f798dc34aee8d5a46f99d5a0d1557d48
- SHA512 82599c4f8915d0969b86d7fb9142457911dfeb25eddd6ffcf747e1245c489ad1fb48d663b0f25d728a7eb483595216eddaebd996c1a1e80031c52595ec4d8eea
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3b144b25e3636eed5c681528b9d34fd874afe0760c3b7b59f6ae8090a36e661f
- MD5 6163de93a187922c9c7638b38f8c9ac0
- SHA1 7a71afa4391164d84cf05983338f2dd68ee4c30b
- SHA512 4b7ed301bc47e6517ea8b5ca77b07aab0c2b1342b8e832183701f7e8abdffcdfaaf48c7a3f11a52f823034c3a44f862705301113da75fbc57cab98370c042a0a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c0031401a168f9eb7063927beb602ed7df33ff39094ba529591fa502cd60b274
- MD5 9ae2021ab2db03b2e99daf9214893c1d
- SHA1 53fbd2b2e7de1fbe175585b03a0cf3916316a683
- SHA512 e3c1eec82dbc96583d651e1f9590122a5ceb59f916c3622026492b0c33bb0ae7eb2c7bd348b58dcfa420fd1494baa04d8a65435e63fb0e46a67c76ea1f73f7af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 71d3abbe8cd267cdbd7058271f6917ccdcf9d10ee2a8a197475d2ec2ebfcc4c7
- MD5 57db25e2970b79f03b0210f7823ebb27
- SHA1 a5b8ac64434807677f6ee32d8b9d538390a36c88
- SHA512 f27fd09ca3333295820fb7dd69f1333cbd841307475bbc35e633d76f221946fe69d945f297bfe517ff215465619867e54a416e8100a8a7a0b9611c39450a2e6d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ca8897cec3b433e216805bda77021723d15e99c99cb2be8e131eda59d5dbef86
- MD5 016e773cc0d8fae9082848ba6ebd1f61
- SHA1 649a58537f6d8c1fbd2147bd0771c2c5aa5c9a16
- SHA512 64972ff6fb849ca52d92b0b013a395f4732c0f833a95e453d67aec41e04bf24dc72567b2baf3131a00d96a1957af2472af371443fc4b5bed72d51f19389c515d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 bdf6e8ccd926d0c24d978df62f1eb66c7db1550ba931f18a814f26a86882fe6a
- MD5 4aef7f1c8dd2a7e178738a819a70e62e
- SHA1 8d86ab505c82a2bb4ac4e1432717389ec6000601
- SHA512 2bf41a03fd65c52618902881eb44797d988bd06735b959e3864788410c0e1b5431d5f2951b256d1322fa0726b99322dd671a2912c285edad77f7d8b7f2de4655
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 cb7d3a5d4ff06aa25413ab9589e6a6d32400862c2c472e82d240b69336697c56
- MD5 2770337b6dcd4fb4f975be9676d886ce
- SHA1 fff39ad3bb461acce5c5ffe39d275151f47569d9
- SHA512 1311e72992eabc48a87eab8b4dd0f1ef7ecf82debe8b0eff911260ac45756707dbcd50f575ae3f3f1f63fe3c40ee1073a0e6c108ed2ed683a636964151a6e0a4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e063df4f0cc9b5868284fa86d9d74e09aa3599be32125d01fcc33f011aceab15
- MD5 4a204c5099e0540dcfdbe49c26897f34
- SHA1 efba257fb58b5ad1dd09ea3ef2e53622fb5fc40a
- SHA512 3d47014a49d707212f9fb6c97acfcd8b537e577aaa7562e94fc4c6b32efa12141aa65b9c06aabe21b9fe28d9d095bd945a6165b2994f130358057f3e24f2df63
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b01f73a564501b4549b00fdb18b357cf4fe2131d603149a1287a8321ed448533
- MD5 587254ed3010ef02eecc242539f31bb2
- SHA1 67090a0cd247aab20010d2a624b8c2c2a14847be
- SHA512 9d4ad4ccea6970297c37308e68d0012d7b8cb53eeb2f5ee79b49602b54c5d29bc88b540826d178d9db55db887df1145ca8afaab5ec8a96914323c9114b40c0ce
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab6876.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar6BE7.tmp
- Size 175KB
- SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
- MD5 dd73cead4b93366cf3465c8cd32e2796
- SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
- SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
- SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP