756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
122s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/capitulo_5.html
Size

53KB
MD5

a23a032c9b394f6a160ea6f2f9abc789
SHA1

9b51d6a47ea46e266cee8215ebd2ce205fba6d51
SHA256

80c1190a3c223221ff9f908cbb97f60ba19ea9e6f658cc6fcbcc44236ad889e0
SHA512

f11dd5e107fc29465f7ce53e89b4a7c78e22d1c89eaabe3997fea196f5a74ec103cad4a55fe09997c64bdf05d59e2af44da711409601c3bad08ae5e19640559f
SSDEEP

768:PQ6fPQsYSdudw3V1gxv3dDmb44QLAmB8zAwXKjlBf5fmbjJnuagcMM6WZ9Lc9vZ8:P1fxd1g1Nvh+n6jlB0JnpPUWJlh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000218fec1acfe4e65463188a54b1e1946b38097c2d98fb9f863fe7cd50fe0d34eb000000000e8000000002000020000000ee556e3f7c7dcbfe202bda9f125627abbf51201b953a0d8071fa5dfc3eeab4ef90000000837b889f740aac9e2e5e89d49a52f9a5458345b4a1933ffa2bd6aabe0f47dd11c0e45de6499706ee3d7dc83b7dcb923f6a0e70a6ca12911548f0821eab741fb227a959c6d3090f6372993b3f7aa08227754400098892b033612a6a3abcfda8d3ad31d26b23c16a030a6ee94135b8e9d1653ab198504cf03b781f328d65c68e1fdff7889610a6be519a65ca2d539ce978400000005db7c009a700cc50a1be17a9162dda228cc70813cf71ac204eeebff23c08111c22c03bc41a45c42164e07c91c2767d832ada6b1ceebbe1ab54ad3cc2733e10da	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5435201-419D-11EF-8BC1-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c0cab9aad5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ef6570f41cd8c67013ffe24bf5e30f1da8e4af3868f7c4d9e72a1f3300e7625d000000000e8000000002000020000000e6d0b0993600429b06f317f079165325e659f9a941e9effe29097b5f11648c0e20000000102d2db8885728fc1b5ae52aa551815b67516ea80acb968cb10e7f385b357f8040000000b3da8b7782cfb7bca341341c8120d3e8364b2d1ca81f411bab1b4570a9692fab24c6d1153bb1bb806333fec8641738ee93747e3877da8dc358fc6686ee14586b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2724	2352	iexplore.exe	30
PID 2352 wrote to memory of 2724	2352	iexplore.exe	30
PID 2352 wrote to memory of 2724	2352	iexplore.exe	30
PID 2352 wrote to memory of 2724	2352	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\capitulo_5.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d541ff0c6afe653c7c9e224231de3bb9

SHA1
5d44790d66e75de2450ff08b6a366d0167d14235

SHA256
f3f07fcd48762f66efb643189014363301c75e36f83e8d368d4bd9b89e279a30

SHA512
2cfed8959e7e865dd5e40cbcf732a4455d1888d0e7cf32394c87007241b9666524772ddbc7da3c7a499aff1fff5fbfc9c1401aaf3d00c1d180e5b9ace208778f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14d81e2d4b5e27c96374daa67e0cc909

SHA1
9b2c8989f11b771d334d63a7263f91f9f64216d2

SHA256
9dd13f600626217d48635c39ef739880eec26cafcecbd832313532203594dcef

SHA512
334f8b879ef249694f08f9e6a1de1d162d7b4a095889747c578ed31e93b4c27c5153b7926514bdb223f0dc1bf2a288d65e28dba69390f03a8d9e00a68271d9eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69eec4b9ecb5108fdba726f5b3f7b561

SHA1
8e830ca12eb97adb0a36847a9a10b39730e7c4e3

SHA256
b77a7fdb8bd12df0972ab583b0fafccc6d2f5556d1953f4ed2a1a39f16423f66

SHA512
3f2c15d3a1bf05a0b4493674a64e4c5e3053da15bf8456f2c5f9e4179b025f7f74214d8f1ca30a03c6291feeea96584659908a5f5d42bf3f3b94fcfc58602686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82f10184e2c8ef883370d95640579fba

SHA1
5aa363c5e4662bd850f45f5287cd2bb792a9586b

SHA256
8cc2a3f02d5ccb274c61e125837ba74c9f2be169f6b763e1cfecbaca7b782041

SHA512
13dbc7b1db90df0bafeb0a6da76cfa68437dbb08915043ea4e061c2455930b5cb59f87e407e6b92e34a0efa5280124dc742e6ae04a9ff90c5ddb26cb5b4ea2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72205d9444320d288a5f040da7c68883

SHA1
41a66d23bc5aa4b389cd353762fd997c55338973

SHA256
9497754763c412f666e34c78428e1152f841282cd50d6577ac19d20f2a02d4d9

SHA512
d5b02b5fb99195e9fb41efca0f6fd2da35e8681ad95d0faf1abdd232340824d4b7b93c3f0890009684eb7289443daba6bcb1302f4035be8745d4002a74a9b76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
294afd07203d2a7cab62424e7c822bda

SHA1
418e2f839351cebb5b92c322e6886a08c0c06a95

SHA256
bc6e9e6804808d96eda54098b6d6f88089c302e1118e66f991f86b36d83a699c

SHA512
c2081abfa367f0dc564cb543712d29464543f4fcc77269c9a1bc6e2ca9b6775101fc6a73f27a13198cff7bd7c3be43aefde8d1ba45d8e75931ef50032093eeb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ab66d2d023ac98b0703f3b8c682a471

SHA1
c3268860ac4a7a0a9e247d7ad8849e4013213df5

SHA256
df9757ca91dd42803778130aa75a67ab5f34a348bef1b92ca9ff6e47323318cc

SHA512
5e22ecd5aa5c815018234166bfbad2337946e2282cb1d76ca84977555f2edf614c21a2e3164cfd16c0d399c6131294a3cc3f7ff73bd421a44d9e6371c97c18dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce03d67342039097b0a580f909ff4b3a

SHA1
9572c54a59b18d6ee702201dfd7be2ec134fc00e

SHA256
14f5ef6752622f64fc3bdd885ac93a623d9767d4a1cdbc5e6441882f53a71100

SHA512
636b5c0c048bac3d24f6c8f1a29c20ae986d957ab60b0bf57a18d675da7ffc57b3d5f6b3953b10036d6f1607ead9f002bff93ed8d0d4b2871cfc8f72cf0abffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1cdc1c6e0c9d8500273e948ee32ba2

SHA1
2ba3354351b49495bd1efb34401d391b904b8614

SHA256
6e70ab510a90e863759197f084d57610aff6c6e2a35e77769b52a867bb944a2a

SHA512
b75c1fe171ce494fcc792998a5933790d39117e897a2361de683eba4e11a50bd83bf048281c13144f7359fe3992ffda4a6eeae92dd67fcc7a9ba1faf2a927373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dbb31537842d3a7a27a3969b0caca96

SHA1
fdd0e3a48d821d2279203fdcb8acbe56097cf7b3

SHA256
c8ec7bc8fbdc018c86c9c0013a5417847d0b3598619c6c5d399df5ff4a44aab6

SHA512
038d46ba4ee49dfba531b2594a24747f70df96c9811b5d0ca37c8558096202437e4af9ec1ea1280cf8f8961577cb90501253f918b53ea2dde869b45802ceeaef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4d1174809af3ab124e228ef46282adb

SHA1
59172f8ac51aa5e47fee6dfecb55a5c190c4aa45

SHA256
5455c4a93ed92e42ada1f53663ce57484891be62e0b5b4bfef21b0102c7ca948

SHA512
0d06036ee32bef780506a6d3b74c85937da539a04326aed525acfea09986657695d04f1f6343bfe57b5148a34379c17d56110125f18d6d62e3dbc8ef0de02036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e44ffd66011c5c6eb29f90e90aa626c7

SHA1
d22cee4b0033e37e16d36ed79d6355dce36c1a9f

SHA256
6deabe1aca3c4df56f873c29cec58809bc1362a0a68ce9c75d3d724b2641340a

SHA512
dc73b380a80ca54ce93753cb6ed2442728b4c3894c6cd55b21b339e03991a56e0ce053c0b13786041af64ed98b402d17d3863c1f8d09aafcb869a660631c7cea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fbd896bc4e83a90ee0149994cca0642

SHA1
983ba5b440428463b2d2f9e907dccfa68d9bc7f4

SHA256
b264e190a131927f06ef71650222537e6afc9d88e6a4a8123ee26d0ca3c89aab

SHA512
e99979c60c78e0e25ed5ef29a08dbda11879bd7a3931ff1da3579655e52a226d413ebbf05215c34f967870416685cf0b539d743c3446dd2f3dc4ebb398fe07fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca8f9dd5f83cff1075b497614d0a4bf

SHA1
fe8eb79d9da370e1d048397434cda44518ac279b

SHA256
904b01a471fc26e7731905c7710f9b8d93ee4b72cc3e5617d08099f827ce503d

SHA512
cd1318c01ad78277ef7c14e342eba5a2d9f400bac6c5715e89cf18c844984a6f2f69c6ecf928fbb88018ebb1070bd66540fc2ad2e3220f7aaabd90a1a2e21830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82d4cde7a50c17d2c6d427a20079ce2f

SHA1
219be2713a7efa2b2553b5bae13c06b6822d8a65

SHA256
ab75f649dc6a5c43363221d59e5c4ecd53da7ab1bd9cfad9ad6288d8086b85a2

SHA512
5b59b02c80302381e395e562e4057478f76338ca85fa412076d10f7aaf90402c6e039d73f2b555ee79ec4c52c627e1ddbde5a8a1d23cf611e6783ee1070d738e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bea9ca15bbc6106dff68de0290240f8

SHA1
ad023789f7f2814de04596cd129e5226a1e9854c

SHA256
8bee7173c80daf408d50a36f4998a86ca1b53cba8558e8536d3949eb6d5f105d

SHA512
a58d001831673a4d29ae44cdb4e2b1164a83d64d46260bbbfa6320688b56a52f92c75619420083edb8a78c22ebd7372fc95012eac991245d727f93344c2b3ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ad9ab4d1ba7750288ca5713a1d7210a

SHA1
1c77fbe3f201e9c86e27307dfd9d06f046600cae

SHA256
74ce2019de5470d55335d9dc3f855d7ecd4e7456b76379866ef0d1c935d8ea9f

SHA512
9a472015a008b0ba32b707219e23ce65143e05d71d8ca452739cc2a2c949d32cc22155b8e5981b4342b15a4f624c7ac21077a377aecf3220e79271c7ce8a04d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9198.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9209.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit