756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/dedicatoria.html
Size

657B
MD5

a58b9d6cd390dab8529f8a26597345ba
SHA1

50c8bfc0ac7c6ec3a4dd2a213e7676dc84f8d387
SHA256

0269f04f06a442d087bf0d2590c1d424bb881d1a8e8bd25ecead83dcc19c5cd2
SHA512

6bcbd70bb92b5a4752245bce5eda650bcd4ec10a21e71d53476d65f51acfdd75df81bde6745b2f2e3ba8d4440d81e7d578cc2621fb7c484e25ff032f5bc8a085

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095059"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000001ab13d0e2feca31d6a848d44a74c30612fd88ec83d72256baf27b32083513db5000000000e800000000200002000000091907dd6ee7524107d69684fe217ae84ed8b059d3e606c51194ea3c65fe9c43a2000000078f922e3a98f88f9705b7654bca0d70a28ac654e792712b77814469b8d742fce40000000f37cf96764984a049d22cde00d4ddb59fe48245c6d7a1d87b0401c73c3ef8b2b9dda1c99411d9aba73d35e9d8025c5530bdf3c1367752fa519fbc3ea5eacd3e3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ab4dbaaad5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000d5f07ddac5d2d0713300411458672a2472ec9f97dc58c67968a4d8f4d706fb0d000000000e80000000020000200000007ac73e5af2341a5e99a3c73a75b554f710abe3fccb0f45c82a3e8a7f17e8f1c490000000d4768154bccca12474a2bf5b3e8ee713293fb42af514f140005e4625e69027ef394104d415d1ead648a44cf97ba24b59e72c07b55592e365dfe9d87a822e6738c1cd54a9a87971933cba8849187c3529035b1f202751fcf192252c4417c7a6c2810cc28cb893981e677520bcd3700d445566eeb8fa875267875749297101064935d510f8c48a2388b152c85c5520407640000000d3c9e1986434413ec3d86ed2b014b412f7a13b62641b3303699d634a4ff9135e4f25a96820e99e87540de2e50cc582cc3b7786b8fd30899536c10f959a15a071	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5D817F1-419D-11EF-8E00-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2428	1976	iexplore.exe	30
PID 1976 wrote to memory of 2428	1976	iexplore.exe	30
PID 1976 wrote to memory of 2428	1976	iexplore.exe	30
PID 1976 wrote to memory of 2428	1976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\dedicatoria.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee8f0e5a502c4338ff2ce615ed3e55b2

SHA1
4cdaad63ae46f81a21e9ffbeb872a0c99e7bc3f8

SHA256
2751ed8cde8d6d697cfaee6c4e71358f96aa46583f6a878253c331de52a3303c

SHA512
5420c308a2aa5f94d5b4298a8a5c7f40d9d2047d80bd71e75e8c920884a35f6af70ca9162e5934329e146e330034759d95d0b6ffbf6c8be58c7787d19a4b4837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c1454009a29c07ba546beec6e4f8e933

SHA1
b4218da53814d69bda8e79d603a38a847c81bdf2

SHA256
c459afacf895b374fd8f13b74b79e16a8f2df8154a3d0fe73762e4c2b90eb8f7

SHA512
b2762426777f8c0ee1e7d4f0bd226d058baea1b05d165a38450d200692338d4a5bc63d7d828bff94a2923fee5e22a9c6c5e0fbb3ecd4915c59f5206d12ffa094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
10868900abfdfd97a2bae2bc4d0db644

SHA1
48aeaeffb6c468261e6160b2d397b2331b3cde60

SHA256
8199d8cc4b8c5b522da6054a23c44f8bab7bb8c8c04258155a90fe5b8362a451

SHA512
1b5e1af66041f9d2c5c1f5358579eb41df8b4bd89c18c5c7a038982a8b997ff7fcf0c2abebe1dde060a17a3c898d3c3929cc26d8dd2d251fbb6ef1bac6a228e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2fc2532e1ce32bee4859bbeff6ada384

SHA1
78455efbaf02bb3425c4cd7c485c5b2740ea6d34

SHA256
9b486392922360e4f5837154567e1190cb1a71c1c69d626f401505858ba822c7

SHA512
ff0c8bb1636f89a04c2c004cd02fe6c61721c2acbfe366b12efc38d7870b21be53aa635607666761740f94ad53e906af2c586bacd3662396d67b79e6104d913a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bfb29054932a9a92cd0fb32dafc361e4

SHA1
f59adf8b1cec5f42b509b80e84027c49a2555c10

SHA256
374a5236fa4f9e053ef11f01870300985e154b1e76d0109eb53548ab77227030

SHA512
0f552f43b7acefd82b751404e1f9c0bcf9600885a50998da96aceb0dd55b5afc14bf2e448e070b691ad1d66855b21147875aeb6f823b85254a068e5c2ee68b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
523b3e25543ec4c7b0f4c37152afd900

SHA1
8934b4b84a64621ebbe6b034378a4cfb9a9b1bb1

SHA256
451c25d091189264118614678944dc9322836e7530388d16852ff44aa96da888

SHA512
b84d9f904a87c0938942ac2b6510ac7de60ce12ec5d0614e402f95a266e7cd590a3290138a8e33720c34f0c6d63def0012db29a6b524cd988fac00b048da8a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
319573808f12a6a778d6fc1355afef6a

SHA1
8cb5274860ed44e6c8faccc172d98134f7e5ea2f

SHA256
e14943eb631e441189dcb43ba1ae35165091b66f7f6fde2ea6e9be702e664b20

SHA512
44d43d24992a13c622d1de92389c83a87ed5691595f4608825b3f031b9bcf69bcca1fad9ca56a1f2cef4552366a60897f6fe8c8dca65d8be48ac755642b88f00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a6c6190f92403e3989af653a235fe7a8

SHA1
f4b76bd898602588b3bd7575890f330bfadf0677

SHA256
748c69728b05cb8c82d634a64e26baf47a95ca42c2cfdd27ab8bf9b4d50d866f

SHA512
f02f7a6532401f08664ea3503cf2abee86f7b909d8157ec4ff9dba3915d7f775d4d20e67ca3664799dc2970c884c3c90542a248217022ec850a918639b865314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
44e0e4ba6bbf721fd43d4c5652d454ee

SHA1
301fa8712573cb5d42c1dc9ba960638ebe318821

SHA256
232e2eb3014d198405d7c50c4cf805ecb68948c6914d8def4604adf6478ec86e

SHA512
f0f7db95c10c598d59cce85bb8c5d8675c8246098d4bc52e8c663e6a82d8bd4181781be3bb02bce4fff01d685c578b2b4fec1135a299bfbf9c6ea317160e837d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a8e0e620fde108f250d503bd3a0f7888

SHA1
6e65891ff794fae97e0880f9915c5b887dbe60db

SHA256
63ebd2f0ea0c780c175ee3d72eb39feea8da39e171050a6c408f14112b5290ba

SHA512
0f500886e275f53bf80819860344cd38bd370318bc524900eb52d59b0346bd67505b4c6cab01e11e6993c530d593da99b2a8ad4303273376eb1b59b5ebf3b217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
022c92af104617da04c0737be8cbf990

SHA1
772843b301ddf299db1bae62dfffd045e46cd820

SHA256
809c246bff481345c401488c1a78af5e93a3317794e30a03c7d02cf0255c35ce

SHA512
5dd30bd9eaddb996639054dc16e90d60b925e262f1382c7d3f475a4fb4857555f00f7420cf4503f9f2203997830b90740b9b2888ea81de7aff8ca5dbf5a7cad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD56B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD61A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit