756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-07-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/capitulo_9.html
Size

12KB
MD5

100fb0ba0c922e10d494241d3c6c60e9
SHA1

0b4a641d4482750e80ebbb5658f7e56ae7a91e06
SHA256

a27a811bedc222ae394eeb0b4b1a9d797e03405136bc40050303896180e900b1
SHA512

1053cfb2c93c46aa5754fa3a0c3ef4858c82d89722bb9a62164c2ef954649ea0bcc12b67c5d38e305ad1c4cf7384bc888aa18e02a3a94ed60ee627bccb19a8e2
SSDEEP

384:PTVyHmyi8+IdogJFlgKOJvrsyflRdSzFFZuiG6J:PmiPIdLLW9RjflReFYDy

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009f3b86cab08b15eb8a2977484c8ba7f4e8ceb46c37372945f9c1fd6938df7987000000000e8000000002000020000000360b727868f5ca5ddcda3abbf255c118e08ba35574c42b954dfa342de0e4a0d590000000af069ab43fa603c46ca609163f19258afb1ab96cdc3661824e1d54c9fd81a456bff1cf062ad5b0579c23be66e0e121a8d4e391be2d3dfae0ab6723764f8d332b3d1d2ebb5cdfb013a61642f56274ef6966c337cb69c87a3d704db8c94e6c2cfc3f4d4ecaa14450e5ee72db059dac7acb7ad2e86dcc372d9d1287d5557352b53f5ea5799ad75efa1d9c3ac9e93e08fee0400000006566d074ed6d3d2ca9243632ad698c888bdb9e6b5cee3c06c5890f701ededb98b40d3d19dc5dd6bb7281c067b513ac19136f38eb98040b855f3e5930bd2758c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7A71361-419D-11EF-B913-D2C9064578DD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ef3dff86ea4c37579ed3a200d6986d2f08edfb82bcadf2bcfe59b5ca31194eff000000000e8000000002000020000000b7eb725b0a7639f06c7de4e6c3fac7c339f06fba6640fec858cbf39d3dc69f3020000000e7ddff82c65850f4f4dec15c8dc62f0c1785e6856e0f6468198cc8c36d72976d400000008326b260e5274ec11a9af8ffc97dfb429b23bc26d60b28677868eb5d0428e4827a2fc421e9337a0fbde33a578f5cfea872dfec0818776af965819b6156ab3913	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80452bbcaad5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2916	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2484	iexplore.exe
2484	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2916	2484	iexplore.exe	30
PID 2484 wrote to memory of 2916	2484	iexplore.exe	30
PID 2484 wrote to memory of 2916	2484	iexplore.exe	30
PID 2484 wrote to memory of 2916	2484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\capitulo_9.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f431cf91e201c253b6fc460aef8f96

SHA1
8e53beb2ee1da9481d3b102007f92a87ceee5652

SHA256
643f49c871aae3c2766067abe45dc2b326f38f86c5e4373cc733ec4e2cbd6ea1

SHA512
26a83e7f865c5411a518e6119a0886f122e2224ce1cbf38e0653966924c66e9fd251163eca35ab5ec98dabce4cebf1337fa5918ebe70bb528360e63593f33d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7418f4b8960b6face9ca50afcd67397e

SHA1
2d95ea7604ec08d2db6303773a16ce2649a4892a

SHA256
e3ef0088e93f414e472917bfd85a8faf4092dbea023b80f65425227e258bcc45

SHA512
50db19f3c77324d0d35265625ffbc2424839e494b2ddb15cae17221934f561697253b06a65efb76ea45e02e74f0d7a6dd6c3215ec0d7639094250408e5a99bab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d3d851c44bcbdbc4343dc55e4a9e6e6

SHA1
830bddf067135cf6cf8191d7d5a2b5b09c8285e4

SHA256
83f2dee348cc934526a5a53527f9c09622ef1cd134b361de12f9de5f55b96b4c

SHA512
28d1e2f686e0f9a36651732176edc3a246b6d8c41d6c58ac961217a4bc72c3eec71c765ee86d92c3dd3060bd20d3b029d0bf993068cc8ef6d5ecee24f1c52c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c760cfb70e62c7c5c3c9086341fffac3

SHA1
a449ce44b0c009cf2b23a261e156bba921fdf90a

SHA256
573a2de3912a87b40733751c60baef0776ef872821ba58782057591f58bd4776

SHA512
945a58bda12047917f60254e786dd325e0385926551fdb6f3e5e420fedc8798e8448ddcd691ec02b5cb45b52de5a9e495a61df3774284800e86bfb61512138b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0411ad058f86a02f4e0543b0bacce46e

SHA1
fb884819fb54f331e1e687a6a4b236ce7b620926

SHA256
3d3115585d735c6bd7f90b811ed143416320e3aff5ec9795712c2bce944552a5

SHA512
c9db8f87838f099fb62ff27271ed2ce2d074b35ac4fa014e4d260ab6359ca86ce9f7d19cd4973706b2fd82eb735d233e469b4900d5b4c70001be81aff92b6ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533c9e9bee62adad4977f92bccc52090

SHA1
9d93d03db3bf4244fbe03b37c6d273c7fe731e35

SHA256
4dcd2ea52868aa1f0cd23d5c853c008909eb45ff1bf972cca068358ba38df12b

SHA512
1197d108e0aa28e3133138896568a80b9dd2e5f509e35b007de1fd7b6bc900805896b8e86d66c27d94924e9aac1a807f26866cd33f041c3a5a74d887659c1216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d49018518611e4eb4a347983100652ed

SHA1
59641d885ae067e2d4a185fd935f4f1978baa743

SHA256
0939e150b4dfa637abc04dc8c51e358dbb797671c6e7b17e8a3214d8a72da2b3

SHA512
72620621625298f7aecc3a1a689c3b4ec912528405f17b27e72bdfcc1f42ef131901ccb3fd6bd47ec2be675ca8325a5a57e095b2126bea0e915114c80c2278b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b51fdca777b6c49e2f1c219cfd2b1c4b

SHA1
b8ba5440d2de8dff195290934bd1ea281dfa023f

SHA256
9406e40533e5dc16a92295955eebb318f8342e19de570f6f96e1687d51efcef5

SHA512
3ac80c4061fad515aab65b0bb20f7ffd9e706f54a80d2af7ed3e282c21dd2ca6a9c7fc5819d239778416aaf5428f2483204782c91ba64405faaee88468650298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d878934826466c22f146b05dd8dd6d9e

SHA1
abdad8032114f3e0343200e612a3bc6a1067c9c5

SHA256
853250254bcc6de622f06db4012fa0e81a1fa08ce56bb2ca717be65e05215a46

SHA512
6159c6c0c42563f55f6e0d900970849303a64c387a50088fcecc45f83f823b8c33962215a738675719605ece7d1ecdf8516aea9a5a4acb1d50c6eb123d7646b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55856b7aee2fc4735060fbe7b3617251

SHA1
64979bccf559b3a9abac9754c22378f7edc2bc27

SHA256
16235c8a2f0211b581f5c61e1a5960fdef3415c1d18b5ecea125e8a4b3cc7c70

SHA512
cf5815370ca87745a4398c40839b337f8d782e26414c6b551f6c3ccc427ea043ff7ebbfe45d670c4d79eafbbd9b159d8db9ee8eea74d9bf3a1c5994e842f4865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cecbaa7a4b288280b61af287e4288315

SHA1
0796b01b2bf40d510f6308acd9c9a6cce6eb6318

SHA256
fc4c1bb1e7a98ecc66c2d379036c056146cb615a01f2e4bf7d8812b59793adb4

SHA512
87526623baa288ab54e7664c946b25d070aeec91086fee1a316fe13adb3ecba52d51808098d1f489d7f71a1bd909686f869057b4a2cce3d400079b9e1b0f3f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c3d6472f607eb03c63cf5c5b81e7949

SHA1
a5e8a64efba4f612dbec2c9b4c5b354c4162c146

SHA256
29115eddff7baea936a78b0d05629dfb200f4933cc18f87f8f8ce52deced3835

SHA512
85d1fcbc076792a4f256fa499650639fce5c1835b5f9d24e997a95ffec10bc73fb79686a33e6f87a8989eaa7f0d618cf059d3342f843513066bb18c0555cef60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dd5deecbbdc967053100eeeab03d04b

SHA1
126d921abaa2836391c46357f7e855c039ccb8f0

SHA256
974bad0eb9c2c1a2235ba1b6b0e994ea8cb103b462e5a4395e3c24585fb44017

SHA512
1e9b1e5e2f8ea3999a83a81752c53fd2f755f54b116d31b467c4952b689a42a10ff910f46d47fe9cc6eef158939fbe406d1531567a32c7934731a7a1e750a0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF59.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE69E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit