cd7c3f2c5f79c619b75afa181ed0c7e7215025a8ea514a2680f8e30bb424aef8

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Notificacion/mural.htm
Size

1.0MB
MD5

0832ce4e883bb104673bb67adbc15411
SHA1

55c2a7d66f36222d3873746aad55cdeb298758a7
SHA256

6371cc7843e5b8129a6c2f1a310421dbfc0f13466da7c087bad405fc710ca3c3
SHA512

d08a0b709a888474d1e0773fe2e87c86c704307d09a8fd872bb9228042c776c59cfb91ec9bacafc5ff2659875862e95acdbd2acb6498c32168a5cb2a0d6c8b55
SSDEEP

24576:uHyFvkd7/t1jCae7THzaAgs5+YwDrmi+EehQsR5ParqNZUZWveiEMzzQ:rqd7/tEaevHgrqiSD1EMzc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e6c536dd45e544810d6d5cf8f06ddb61c83227d530230e8a661094e164073dbd000000000e80000000020000200000006a42cd29021381d4c8e6e14d5e7739db334d392ee00aa112820e095c60b9c62490000000e539fc0a506609dc42b95aa5da6d0882ca957d67703e4718df80cea593f429f59bda813e4ea57174c1337bbe54acba3370921447d963318b39c71f6ced134afd5d1300217131545234db56e3b711d16959d3f51e76e9676535fa67aa11a00e7351dc1efa5735857e12801b13da5bb6b0002efc458748e91c991a41a6208976278550048c5161313b54e75446947a9267400000006409fc7abc402586392019465885ba6a571578cd0687a2d4129788a1fcf35c33884807c41e7256afc81aa7d281a81ca9fb9373d2a9f915baa2db05e7499c6c03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{418D3891-E623-11EE-91A4-56D57A935C49} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0379016307ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000094d95c2abcce8a1e923668c619c06f80eb0b9ed4c061837c402c31187f8984b0000000000e80000000020000200000006c7ed4c6e2c179f03e4e493c5a2335b51aa9fe1ab6bf36744bc8ce80208024ab2000000035601d0824ce2e625086bdc84ede5f829c0e6a8abd023bc4f1bcadcbe86d9e8640000000364ee78f9d5eebc481964bebd20b5d1f519ce7ed3acbe7896a16877236b0b5beebe96781aa6dfe20b94f5dd3ea380266f87222cf72bd390e3e4d198cf67b064c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417036834"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2944 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2944 iexplore.exe
2944 iexplore.exe
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE
2940 IEXPLORE.EXE

pid	process
2944	iexplore.exe

pid	process
2944	iexplore.exe
2944	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2944 wrote to memory of 2940	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2940	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2940	2944	iexplore.exe	IEXPLORE.EXE
PID 2944 wrote to memory of 2940	2944	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Notificacion\mural.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a56f54e1c478bc4cf41c5b13ecbdc17

SHA1
4ef1c2c7c91625fc28bed39f5119c44ad7a9d002

SHA256
72d55c7602bba96bc26fd473d1f8f891220bef45a47f3996d9738e519b864d61

SHA512
bb6b17671ca4e813b0595ddf7e60a73f2b2678308074b18d40ac7753afd21663e29779d0b41e25c4d5d4986ae87395aea82abb9b9ecefb1ab2c0332760465720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aeb19b5525d2031ebdb6934794b9ef99

SHA1
f4ed8694c1cbc943416cf5eb9ef82e7f0939aed2

SHA256
1620174feddc6e7506c043645944837e913c00261411e1f0cadbec1b69735d82

SHA512
68d4f85d613cbbecd7f262281f19c9f1dd1dbe327ac19b814e4c1541d25cb2aba0c79062d1f8f55096e38311e037f1f56cb29480359e8f782a2e2ac14c6ab0bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46412e8f1656968666d4bf7613d148fb

SHA1
003dde90b0be88552a27ed0dd7919a17d71d666e

SHA256
7b6f91dbc6829b10f5a80511faaa458140aa12c309d21bc547f078c9d26c3f12

SHA512
f7684e9eae602d8154bf87bbe3a34c4c0183c97b16bb18f48512e2ef4e1aa244b77cfb5dfb4784cf276a8ff5100613c5288f9ffcd4fca31f19c3a3cb94c78b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
205fd0997f3a0a1e21723287751df256

SHA1
9a7a9296ce78cbdae353f7ac802db96242f5b9f1

SHA256
b7dcc857e06491b483968e9394e7833f545cafd2eb8ee52c4f00b6295c2efa2d

SHA512
5e52ee5861447b440804e2d3c9a160ea14b762065f6acb2dd40a6dada041a5bec70020319c152769e0e687668def7471face5000272b80e636019815b0a4abd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03ecbb883b23ea35d84791da941c9068

SHA1
167bfe36dfd1b14b2107089fe9684524ce819032

SHA256
c99e1b80ef16adf4e4dea98b3af8b4ddc02b52b1bac386eb88f13db65c5a01aa

SHA512
1cc86f3809df36b1906bcf5d75fc7475ba3a51d93471c72ab75bedf5b02856468b145b9004a5f2aa286f571cc97f494897c06091f9de987f5e6516767bcb0b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0442654d836cd0b1897eeb94d4169513

SHA1
faf4507c0336f5115d6e453f1a819e7e981bee6a

SHA256
3c58fbc73399a3804f34f15f213811d90742b3a1313dd4bbaa472b884d91c8a3

SHA512
c86b35e29f88d1cd1168378714cbb7ff4cf7e803e91b2e2e9b7e31a88c55e36bcdce081ce6c14ab1e46505a98f04dee0d4b0c9d4c3c36f2d3d34b9bf92185d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8c8ba3995c4fd918748445a54b39e2e

SHA1
16b62a5286e2e31e79bdb2092990933ff0a337fe

SHA256
09596efabe6c3d4496e78077d485429cce939593e30a5b2a37ca0ff28971860b

SHA512
609ca899ff3baecafbd91bc199b494542e53f28e64fe9fb9412910d8388039fa3492d92afd5f5554c5f6da9ece45aeb40a2895541c5b0bd23ede4b849fe0c75f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
382be5f6677fe590c1a342db627c7f4f

SHA1
e61441b0f70eb8393f48b60019c71225e7d5290e

SHA256
7fd4c5d14b885b1e9d5395900149d5716c6efccf4baa2426a57f31ae24d311f4

SHA512
50745a3740a8257552ecf44ac53cc7592aa7876ac07b99c17111276983967c13f2759a22dcef27e9794e95fc720aea31e49c77e45a16ff7c059283ae27fbd6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ccb8f086c0628ccb04f7c6e951448b1e

SHA1
639a7c254135ec3654f70cc2017f3a88827bb76c

SHA256
656d7c8cc58e4ce838299a97d5bd0ee42d657e8673297937d1a5f71dca63a731

SHA512
cbe48cb396322e81c1e1eba9c390ad19602f3b4a6740da7f8be8610b05eaaceb8d4e5d690547460771c97a631635a4b8aa379e6fc26663ba03ebb3a6e092a445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0feeecf91804080db435bb5526d9836e

SHA1
8419a0f70f59b78760eea6c29dc3bc2f9b34c409

SHA256
29fb430b0be035c8d6c77fe4a7379a3948243f3b20902866a3b086de3b8b5b64

SHA512
4f99fdbb527e731a3eace56b3b841377ea76e28b1a88a6dc5a76fbf39e611fc9944bc313e6171a7b8f90e1de340e7807d3acb04c2c7c9da50c4802e70ff62b33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba6e59b27966505d3f9d3327994b5e8d

SHA1
7ef9a1a43ee83f6956ec2f7050488ca8dc8e91a9

SHA256
4ad8985092bb7c13ca68b7739b01f940821a54f1a30338cf45d925d2690da506

SHA512
227b2d78a360cdf4b37381afba2da639c3b23cf3ee34d4c93bcad7899ab5a3eaded41f8e2925e672aa3395ff58eb5780976e2a0b1dac72fef21ec19a9b0bfdf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5b10d3899b8cadcf103adc9a1eafac2

SHA1
fda7b2a90aa61254fd3de4d3cc07946a5f9b59f9

SHA256
0fa2f8c34ed34a56259ea7836e69c0ef5d0b9cc947310246bdf474302c38077b

SHA512
a9be25dcfe97ba0ef6a75e618e063c7719b163ea1bb7fa81a94d15a4e5e6a4f6f11e93cbf24daef9634a7a3fb8285e8b31699498e425ea7a73e3e1ad1140b762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e9d7875d6b60e7a2071afc7882cb0ca

SHA1
acda536b21228e9a762745481c62bfa8bbf24501

SHA256
cc603c53376ccba10f5d564c4cb6afd1fc2754b216a37a7f1a28823467ffa0f1

SHA512
c8d995eb7687334358ae96c9a7bd08542ad2be1c33d5bce09f3cefd42f9417797a26dafa1e59a87b998e9417f864b4d2dfbf78c8d45c5c6c91326eed0f6f9e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c049c1731ac408b9a625a6a1a25d7153

SHA1
eeb4fc73ff959bbe2c3382ad09ce8897c42abf67

SHA256
933ca43c1b5d3059c92fa305c6ad2f923b31ab55b8054faa1cfb1239635396ec

SHA512
7fefab3c52da70caedc1cf2ca71b5c8dba87309564d848333e5d3fc1fe88b5f7bca15f80ccfb9a3aaa3c20bd81c73ab1e5e2f012f2f133d206d9a6ba6913e7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc4d1c64e89852ac74b79b7c53ff78e2

SHA1
c2f1a4e3517154dc5eb92d6adc5340eb202951d0

SHA256
42be1554b2b2b28f6739fba139ed982084f0b2646b90b2a53a4490e38b79209e

SHA512
1914c019700b0dc6d042ac8d5f031d3e04a65a8a8ce768362e1757f25c63f9c064083349521d0e86a13f4f6571506119a5a3dfd4dcd503ea0cab5d0d4b2cbf2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EC8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar415E.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit