2a743b1540bfc7ba676fb9ff51fac848e0d84a1f991519b86d5adf78644c4056

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload/block/language/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428064148"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CC45321-4A6E-11EF-A1AE-46FE39DD2993} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304737117bdeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b000000000200000000001066000000010000200000009dd20d5fad9d4b36a118a94e33575f766444439bceada1ea4086e2cb8cea2f64000000000e80000000020000200000000ddc3953c99dadc6eb8adadfec50b5b63641cd9382268578db4506357fbcbf599000000056811e50ed782d8056e70aa9ae4eec844c26304ca79839826668b662a7a8a2a02cc023c86ae06ff45b639fcf246e59afb10e7f0287a7957adc2df2bf8aa9709f705a61c138be2c5fc08968fa2c3367ea959109fed29ce76404a834fa755f8d266285207bb2ef486e85a2c74c89719b10de694e60011ed16747f70072a8d7907d3988f82633929d530b65c412a855311b40000000a3e754f67b112638b6dc7371d348d6b503baa0e7016f1d07621313c794d5e7ad62798c0f2ac6fa1aafbf4aff462c20bea2bdf854b152c2c6a4dd3b53e343b338	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000930ed985b08cdd4cb38e38023150682b00000000020000000000106600000001000020000000bf2315d6f62682f517c9b82ed7de3f6c688cf6dc859687d474da2a7ef7ba30e4000000000e8000000002000020000000c81cf99d8b841d63ba96f4ef00b4c94317dfcc1377dcc3d3aab2edce19f0467f20000000ef63f3ab46d612f928d3f8d5478a928e425cb87bf2e38091cde42eca6a55c7e240000000164ab8aa27e882f6c3c995ab87b6b3eb2431adc138acc3c0ebabf704963888b38fc247f1ef27051445e14742b2f6049617bbf3294d09059ed53d40b7172327b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2932 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2932 iexplore.exe
2932 iexplore.exe
2420 IEXPLORE.EXE
2420 IEXPLORE.EXE
2420 IEXPLORE.EXE
2420 IEXPLORE.EXE

pid	process
2932	iexplore.exe

pid	process
2932	iexplore.exe
2932	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2932 wrote to memory of 2420	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2420	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2420	2932	iexplore.exe	IEXPLORE.EXE
PID 2932 wrote to memory of 2420	2932	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\upload\block\language\index.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c093980ff58c1668aceed4ca14ccec80

SHA1
79a336dbfaeb7b9ff00a98bf89f0cf1cea059252

SHA256
74765411834e4885a41c6518c204af8fe7b25cac717a3299056ae11f035bdec2

SHA512
38cfc746c9afda7cd14467a9da4d6cc7d760dd24dc50453298258dfbe938c43d1eeaedc7ff23b4a75ec14f546d13592852197143b3c8eeb8b51b882d3667c311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e6a35f0726f0da3124acd693e4974e5d

SHA1
613cac43d4de41a1af060b443f7cc2b26c431b0c

SHA256
c3b721b9c86ed6c2880df003faca2ee5236c1ea00d1b0afd2f205b332b2b5f52

SHA512
56f3dd7ef98e5da03b7d13e7ecc4c125e2f724ccf9c5a42fe31a8bc9e60724e57d500327bfdb1beb91546c48dbdc5cce7bf89db05d8a82739dcc99dccca4ac36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c5d5a1a42fd56a48145a34be9f59c4ed

SHA1
4f17351c301437391583d8126095ee1b79b74c36

SHA256
7e5ce4a43673657f4c908dc1050562b9216310dac14c479aee8466f89b1a49ff

SHA512
234b637c91bc2679e6d12a67cbc37eff6f6e8e13f5da12619c67545820056cd18e45b9728657c0e8dd56cfde55021b3ac1e2697e5b87fd3463bad7b4cb73d1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f0e2bd25097101f67b48e1ed71ebaef5

SHA1
7800b8a16df5a73d76530d029165acf58d1fc7ad

SHA256
79d6b693c0e058cf0b3374b9b457bba40b9c0aeb2975b51918867ffc7da749d8

SHA512
7e78415bfaf09535cb18cd365f32550279540a2249a08358ba8f08e2f383a926f474d551e6347ea7e0f7ed67b52a2daff80326c4c7a6f8f4c7b83d9db4b5061e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8d64bb1a50e08d402a77520ef6bf860c

SHA1
9a56408ee6bebff973290665c6f06dce8fb34851

SHA256
54032d2e3d10cb7d20feddf6771c08aa718ef2be9b2f152fe02f2b1d0a236762

SHA512
3f44984879959453ba2b8cb55a8efc353eba2a681c314d6284c87c7d1ffb0a22505605eb8be924625ba71cc03a2112d52f02cc44403a5731445c6cdd4450c6fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
40bd73d85c229770c1ea30e7a1d69a64

SHA1
da321f5f6bb8569f8eb28d95a4f5ceac6887927f

SHA256
86d1334da2dfbd23a0210efeb3b04957344f73d1c31e589b67c1edac02a0b10d

SHA512
b4659216ecc9a91178a8c9388efd0ace8be7608f1b49b3f940574b92d4efa1c0c97a7c1ab0e4cfd6ddfe0934a29854bfd09c2c69ac431adb965fb8a4434ed827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d8d6e64f723d188fda6e84ca5b060d46

SHA1
aa26c71ebe5865e6f46cac32987f04301bed785e

SHA256
497e4b319964bafaf33921b33d3c36594f68d2045ea0bb4b22761299d0b34f17

SHA512
da149cc220ce62c6dcbfda61418f2a33482063a235a0d375b82a371d6737920168da3361ec731833401c642f2d25408b255bb4968d1dd1fee8050c1a18098516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d79f57aa5efd8297af111b25e59f2e50

SHA1
2eaff60ea6881116368a90a8a8a13d3ba7ade7b5

SHA256
3fda01934038ffced83bafd107f7de1046845edb3b8ea6b7735bc80aa22fef6d

SHA512
c8469d29982e1fbae0088039f921c26a396e3673a94a258c29a9972a71c7b63b59f982a2de8fd13cc7164cb4d214528c6ebcda6e2f4b6aef26896893dcfcd2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f2dbe1321f4fef984f40684ac89eae6a

SHA1
a39151267491a9f036e04c7d1eb115b123a4e16c

SHA256
e395445bbaaca0ea22a65603f3d6a1445a68d56237bb4a65cde3fd6978794d4b

SHA512
50d8b5d16efe5dc4faf203a2bc06f018eb15da1f7fb4f952b89156136473d701867a42a97ab06b592a424b21fbb96b4e24e5a694191b8aac230ec77a671b9ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c3a7a783c84c803652ff5ed1ccacc1ad

SHA1
0e7de4d4bf59e0f58227b7a039be77fa80baedbe

SHA256
3b77e5ea610e05c8c47e360d90fca5b25e79d73fb10bb13a464e03b39abb4773

SHA512
59c3ee4672f25acfe688455ab229c5b9efed227f22ce5697b7e31178cb4f5b8e4712ffd8098b459fc1a44a20fc96befff56f6788e5d0d360a0c08dec2dbb331e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
61d142e6dfaf6bb6589b0e7f6fd9cfbe

SHA1
fea7568f8dd1521cdd1a3a6cb66bcd20c6b31e01

SHA256
013af860b2ad7cd84d8270d3139fa8f23e52ab288e9b8040169a90a10d206a35

SHA512
c2fd54cfe7ac0ebec4897436015a193d1979a82ab5376c42bac35e6d53d7e706b45bd1e871c951f1983bed95c6b826fd00ec3a9d12c58e3f14722617b773f4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA70C.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB72.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit