dbbd216b76dad718749c6468ee98ecafbfa464250f24c4445431c60d6af74a6f

Analysis

max time kernel
120s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x64/Templates/TemplateCorreoCliente.htm
Size

2KB
MD5

ce4c1f3ba9e690c4119e8ed39aa8eb78
SHA1

dc2da00c92b51431c01c5e598de4665c9989e856
SHA256

e17621dc67919e53a0d1be6a03fa0d97f01c8932f8d8912d556327e620310432
SHA512

daf95e6329b060fe230096fc7a594cf0a13801e2dcf9869affa5530a2d03bf6c0dd2d9340be5c312b82d41dad48057f86811a23b23fba93b0dc9a478986ac4ef

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000000842a0e5566ed3424d1362778aae10408105aa6920b5e98a05181445eed5e919000000000e8000000002000020000000073c3773a7b0fe091b77fcb0643c49e89b5129e0a2c9aea5d9e43cab6aa9d2692000000029bfef67b90baa902c1e2bb695c021863e61e38e49fd0fde42e1438cca68265f40000000b77720b5cba2d459ef44e5e375547c0c21d790cd3546286486b4ffe53e685e2c6da291c571c28ac33e4f4a131b9a0aed1ce23ea9f2d3a68b8b76c2e44f89cd16	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000ce48a9d3caf80aaf421d4f5a6696f3d08f2ba71aac1c28d707f5714e53497bbf000000000e80000000020000200000006c47846543d760d71ab09e1645b3e9e9ecd95af654bcf7a17fdcc66ec490615890000000041b22747e7b93e29b5540fdcd32921787443675de7e3d1ee1e5b5ce7b24f712c0743e9758b945e563b1865c8f5768127113547d02e40f2e00682f6f3147faaa78bc02b14d315d83ebeb185e3a833d249aac4e879b9f5f6b7df49e79ffdec39cee87cd79f12b069f124247c87b3a85842e9de921866c809868da4184566f3e13ff89143d87449646577945148492f224400000006d4c634e003117dd1ee4eb32f07ec7746eb10d8940b62ae32545ac72b4ff737d9c9cbcb10530376735c1d0a8bebbf3c6235320deb29ef8ee0c4a82185be65584	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432231821"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08a51ad6204db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8BCA721-7055-11EF-BFE2-7E918DD97D05} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2904	2068	iexplore.exe	30
PID 2068 wrote to memory of 2904	2068	iexplore.exe	30
PID 2068 wrote to memory of 2904	2068	iexplore.exe	30
PID 2068 wrote to memory of 2904	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\x64\Templates\TemplateCorreoCliente.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
283cd5572119f15158e6d5f886ce3c82

SHA1
67ae876db39b8462e714398bd530619f90dcde97

SHA256
a70829e878f5a804905c508ada0fb37ab389c49ab7e8afe32f4152253317a615

SHA512
3a3857bc1e7ac14d8af9df937d229ebeccce20d0ebb8c15d54364743291e25f88f77835dd26c0818b343f34db295c2e02c38ae725feb2e423212b53e3cdd614c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
781f9591ed560276262eed08dcaa9449

SHA1
692f0eddff41bc1c5c7610500ffa7bdaf8fdcb26

SHA256
49a8191a8ec50973061bedd67693594f642e7c0552f792355c68fda433d10aaf

SHA512
c4e67c1aec7e940c5feae914ce258d7ee184e95395f705d125ddfadaeaf40bf6c983b2e51e609e3ac39097afe69ecbd5aee530aaefac3658c00668a63f15924c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92dea0dbe17670546e32b48c61496ca7

SHA1
d9a9bf9f85c7d6eff66afc719b271ce9a658c794

SHA256
e0428598bd105f868a61ff6f09ba1be7589a6f5c4fd34cd47e3d87d7b657393b

SHA512
c06eb0ad2b30c0f34645448a00016a7e71b16a467b0bdcfbf0c56ede74e1b87d85f9754df08421f2c62bbfc5082d088f686160cc374de456653d227f83427844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbe14f5992591d03f98967cdadff0264

SHA1
27604e661ab27c9f3d3b153486e0e4d781e80f4d

SHA256
942fbd3fdc0e33f450b595bf5bb6c6343ac9ec55f4304a4e725fcd7cea402024

SHA512
85af5c56d7ad4998d3bfbaea9f2ccc6e0fd60f6873eec4accb0cb46f7cc8eaa565fea62727c05cea1171807626a468e9cded4ec223d023b4d51acdeef1800915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ce3b34bb7db51daf701f4e51a35e336

SHA1
2b4c640a41c8d38b7c57372887125242c3131514

SHA256
14a1ab975511fec00f9c11bba7b2e3ff5f64f4874a096dfdfbea3ffe31a9dc9c

SHA512
c541a0c5b7b067d318b4ae3df99e1536fc6eacd08389f067cbc5ab885753b9b4fa46ae3ea88794d73e843ece2b0be08c1be50751fe0722dd420bb60c24f499ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a101afd974a28bbc83fbe8e005873bc2

SHA1
0f3592b55462a57decf9d0488c3cdc6cc665de9a

SHA256
fe621b063faf20c260ddea491c5ae8669ef53f67e7fe65fa9162d393b05684cb

SHA512
b454b0ff342f9b0d6b5a5093447dae9094d90721a67fa28d82e525127f7acb1329a0f8af48d221b7500fd44088fdf28261359d1f6163e05a61156bc4618d9cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cfa2a64031725fa91e47fcacaf881d6

SHA1
641f97aede88913cd9549f2660527ff49f79b72f

SHA256
fab14f0b01833d595c24af8e7fa7ac9b2afadd75646f689db93fc76ce6cd5fd3

SHA512
da9ef51762b0ebd2b1b006d053bad5345a0ec9d1e7cd628b37858948de2436e754d79c44d8e54c6cd935236364b1179040f4f7e5f4a16e3da7cbbcc722733a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6466304d98dbfb5bb61bdea0d3831fe

SHA1
cc4dd5e24220886068c2d5745f2ae71b2df62019

SHA256
72e5c5ef627870fcdd2b5a2a40dbc82603e4a1bde385e1bbd3bf3afb7f8200b7

SHA512
047deeba3e99eaf92b5b013c5aba831d3ebc9c8918f8d2d768f17dfa906c21c1b48b4e68e91eb384b9d44b9ad03281c292a45861a4d5840ac7eb1a5fe57c4b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fb4f6dc2a1de10ba8716d6e3bb6942e

SHA1
62f6ef7354c7e6a13ddf2a2287c71167ee1d670d

SHA256
1168eaff960d69aa152d185fa37c768a36d8b1e7ab400c1e48b7b6696d3f593f

SHA512
3150d117bf77ac1010af36af6fcab1e0a2e7bc71fcf6ecf5d2a3b676b8e564aff9311c5483b8a59afd584949ce7ced3579e022e9b884182bd095d965242c5c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab127A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar130A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit