756b3c17d28d81b66a24532b91e34f0aa54b9c7519b0f8fa6dd2b65474d60555

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OEBPS/Text/capitulo_3.html
Size

18KB
MD5

c2129567844d60fd622d1086ee3cd6a6
SHA1

febf670abefeaabb6119ff0ec313e8cb4347729b
SHA256

d8f554a3acd3044fcffeabec206712cc1a6b95ed5c9e78b20af1febec2cdd94a
SHA512

a0b97c44bcb2bd74e6948d977999aa1c034939c335875068254c36af64c5f99c30b8761f581f6f2c8ee15315c711441e13a549a3a5682fbeb7093ff3f9e2055a
SSDEEP

384:PTzlWH9O+eRnhJXeSPOVGVhjpIBIda/JRZrb+dlcJVILozE8YBkDLmGK3:P/lcO+e1h4ScqdI6YHxb+dlc7I18PLRQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001ab05ac711509f0406359731a3284cd9fc6ade5e09ef706cc8579376f5bffded000000000e8000000002000020000000d529b7ee16b0c836e343ef8a1f030f594b2c21ddd0bd75113b8448a7fd82c541200000000cb5f93754968d6b9f64d3c1ad6fccc70410ffaedc2f62a07d0f5c44b95d6c0c40000000570a77fc58c9a67f057085d7c63766a0fd92a0b859b6868a1fdbc07670b141ddddfa15ce36106003f2c350298a3b2bc89584c05f1126766710d73f4896fc4f7a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5550D11-419D-11EF-884B-46FE39DD2993} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f3e664a14049be9c093b95ce6340f2f96748ca79682524932223340a9e525183000000000e80000000020000200000008119ee8ac664a775e66cc4f637f4beff7fe36ce04064bcbb88d0af712f816603900000009e47f524766fb40e15f4e72402d486f657835e0b83abce45a5500e3a0adf9f1cfb77c5e120b9f06698bb9bc2ddf76e9caf6b00bf6ffecb6ed8676b6b00314aefb3a6f056e5f4fa111c38fc52dcadfefa5d3fdefc04f82490a9216b8926a17c19128566f1fac0350b473fb9696755eea1e1d33e86ef66180cc8285793d0e1c4ab8b96982e27f5905f404c6be0095eeda840000000a11df0721b074723c3f61a6734c68e10db6f3cb39806b27fab9801c4756590bc5c3598291fcd844a6530f34e5b44e305691de400f15d650ef079a1593b35313f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01bceb9aad5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427095058"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2780	3036	iexplore.exe	30
PID 3036 wrote to memory of 2780	3036	iexplore.exe	30
PID 3036 wrote to memory of 2780	3036	iexplore.exe	30
PID 3036 wrote to memory of 2780	3036	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\Text\capitulo_3.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c365abb6b8b0b80e70f7dece00820618

SHA1
27649e551e06fbf0a99aa7114c629e34ca023b93

SHA256
dcd32b1994362de6b224c9eaaf8404c22635405c81988c011ef308c3913feaa8

SHA512
3fd2cc26e960e33dcf5b77ef4dcfb3aa8d07bbb171a825b830a4f92964c3c2c42465d0f11bd83f2e49269fd765fe67d3b91c6e8968a4f6407aadb69c4d996fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b13a70d7de8d3985d4ac76025118592

SHA1
8547a5a670226a214ed685578e5b2dcbc128e153

SHA256
9d69c100848fd2d0c8a77d24887b0972294a3de0347130eeb3a29914bf3c8411

SHA512
d226701ccdc0e369f891b2a29aaf3a9696ff4ea9a3f917f48ea3e931de5bd058020004b663464c05089358f3f2ed2691833516e5cf8aa46d39e460f47b0c4f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db071197c04275f9cad6a8a1462d2af

SHA1
eb33102d92b625463806913a130e9eafb0977b83

SHA256
dc046c31a4c090423e67be22d7a5e50d644f03b0609ac8f4a0182f3829f7ed05

SHA512
aecf1f7035a63176bec81a0a160f8f536aca529988b3326de07933532629bcb3c5b7e8a8446c1bee9c5a691bbd522710672c0a1cd2ee50a7859eea0c18aa67a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bca62d375de549180f4f1e6223935a2

SHA1
ab5e23284dadef0af3a00d29700def3d28fa564f

SHA256
a7b3d83d024c26749ec940707bf051b33cca0d7b0d3561b5b1f8725d954c4f8b

SHA512
a8c9e7610850351560a1f3b141a97542a448bff2f02a25643c2bdb24609ad8bdb48b53293d4470a26723bede9952ed9c03d14fefa6d88dbff251d452ebf4ed65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77c496ba2c0a737fd1d4aa3047c7f677

SHA1
efc637fc1b2c68f66454f9059ae8f489581fd5cd

SHA256
645f1a7bd9d03392284a2a0ca338c7c7121ec50cac9ee821655d6d8883d4257c

SHA512
09839f5d3a2f834cf52828a073fb01c165db4acec7f4983c8e0e7fc54da4acd849f0dee6f68549111898040205dd7bbf378c995e5855df0203a9ccbba55f9236

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a144cf959e15668cbd0f7976cc5963de

SHA1
867849048df44f3f5133b6a6e259702c54d1d943

SHA256
30bd76af49be3ea687afbc787301ee895510456acfcdd5110c274b2fc4fb8720

SHA512
e209bacfa00f45119f67be2b23733f17a50639d916c38edd5ddee74779c04c856189a124404ddd53d504e50876db2d784ec01aa07f223a44ae0ec60ee08894df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9a09c933090792b1a9e1acb02e0d25

SHA1
8a8ab3252baa63ef3e627018c7ce853fcaec2e96

SHA256
c6e5eca5b6511f9bac1a5d39d83787fe40880448816d77ce1aad64711bb2eec1

SHA512
12c3c5fc10137f564431a0d3e5158fd0ea4411b3da9c1018235b7525264cd268489caa95e2e7288b9dc0116f96430bea65027ed10393d6d098f877cc9d40cb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d00d26027a196710bc5337c5b14684c

SHA1
31e02ff49157e7370f487bfbb71b2602c3c70b0f

SHA256
d2d25d423f4f0d169944c614d4655dc15338632680eecfd87cb6e92424048b70

SHA512
d03773a6404465ebcd3ecde507776270b956dd115fd34b2330f4e1df0bfa53bd5308c5f976028b83fe4d94b0a1ee94ce37cd8df73d1ea5423917db2bd29be7da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d350e8f30a888fb8b807c07c4336b259

SHA1
61917bf950d77d4c7b7bbaf1e8636bbfe910ca6d

SHA256
4784a7e689c8a7ee336464943097a6389f4e847512ade405bcb6ba106c08fb86

SHA512
ee24973974bb7dfab9ec61316c2c5659bff052c5c674eb0dc710d9be05e30c2bd4c4d14e8d054774794c4ef711e86fbc96bf8dba3c095915052d177d8bd0f0c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
384a1f74fed089d3ed84241986f7b868

SHA1
f4d304edd1bd3d2564adfd41172144e65d7b4cac

SHA256
43b6ba1f9e1b429651c5196c0ce9db801235974c79da116fe3f3f65a1d8d2f57

SHA512
2124d266e5ff8734244acf7627d2ad03b52cd36100f544a77e1d4f6334626e47ef17adb003d3d8b1def0c23dd03e06d867df7e97a917bcaa6a70a60e5371a9ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
232890c39df4a524c7031730a28a6e32

SHA1
aec8a6039471da027ba83221fbcbadda16fc0a5b

SHA256
2771e8d995e157fab7ae42b71720a8f02264dc2c20e14bf096854eb19d778b49

SHA512
6ff4d01dc9f424a58d7f8d673d1cb53b336a12d01c3e22053577474e527c98108510d39b8fedda5efe19edc97e2a1c0ae9ccb288af6d540fe1f09d1d4e146c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b0317d06aea33617cfc0d021dfd33cd

SHA1
7ae9acb679620613c244c270d9b50a47cbefffed

SHA256
043feddeab9f7629923f437a672f3d4f52300a2dccfec051a437cba83c790348

SHA512
5948403655f1284610fd97dd41986b67345184089ce6c704823db814de61d3eb26dbaba449164ee40e2a0ebda81f834c9977c77fc2603b8eedafe0d2ed796b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e83aca5d5b8727df4bf6cda0a333bb4e

SHA1
df745a69ac2afde03570a6190f414e8e90dbd923

SHA256
652900e8f7a978cec31051bfeea65952bfaff8c78b6722f45fe0eccbcffe4cb4

SHA512
38ec5cb27418349f5bf587a6b9439cc9701f964d4355ceefe7de22be8f8faf02f41d20ad793ffdca309c0d7d55a9ffae9953994161887074a613f7bc8c51fa09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1194fd2c2015904ea275c0899710dc42

SHA1
d1dc572725e0df89db6562313e7a5a3e06bc487d

SHA256
3f013349a5a32f4f0b969249f76788c41d7bc53ce91560f3150ac101e98629c9

SHA512
29ef230a05471ed1114c85eee5eb7d8995fc1e4f1770c0633ffda4655667de3090b7807d4855e0cb814493ac012518df9517686d0cb87b3161c5ab707c45c727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
526ac84183b6b3e29607096f8f09c7ba

SHA1
24d119bbf74d8eef1ce22abefc50c61e7d21c647

SHA256
5b6ac201a78713b278f411e4350f6d29dd1536040b025804a16512682cf75d61

SHA512
8a34e7a43395d66e549d026c5a8bbb3261abf14706dff7881ee8240a66742cdb3ad13308975c5584c4df45f9fabd58b0837545c3a53447e6369829388b77c1d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e37d6ebbf39479d820a5ed76bc75b9d0

SHA1
3231f830fe6ecc620822813f73d74f09880df0b9

SHA256
da74df59d23ce120651d3bdc487581f96e79f8b616ed52fa836cd7c9938093e2

SHA512
f1d7d93dba09b87e0209d69c8edef579e8edecd592613ff761c289e96fa319c6d29429289e03d972e51ac752f77f46a76ddadaf590188dc022701372ba9ede25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6683.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6713.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit