1bd73867aea3aef7c5eebc0c3184d5d7a701b05cbc2692d54a371d96d61ff887

Analysis

max time kernel
44s
max time network
33s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

5KB
MD5

4df7f6fa8234c9cc55df0a97dde3d3e9
SHA1

3b8e8870b97fefdb3222f9a1cf4b799ce5429818
SHA256

1bd73867aea3aef7c5eebc0c3184d5d7a701b05cbc2692d54a371d96d61ff887
SHA512

4ddd12e3e55527060110ab1347b8c1e21a7f546963f03e0c83a79e1a0a3e2f130d9acc9603522ccf0ff757d810b516b4bb4239ace88dc4c582eb823b77a9c62e
SSDEEP

96:UkTGnW0k4wZONuqh6fZOanWMYk4Z66uq39hcbdY6h4QqbyQubq4Ke0:UkTGnW0AZON3hGZOanWMYJn339yO6h41

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c51f5f4a59d16b452bc553b1bc068307789b69607917cb99c62baa1e72d39193000000000e8000000002000020000000381384f015cbe6b5b171dc3abe64182c9ec786a921cc20710f62d27d413af64d200000004eec91ac249a3f4781cdaea56d9025991ed71f22a217e0ff337c9913b545cc96400000005fe3d1834fc768a8bebb876e2d9d5fec8ee348c6eacd1a22dc23115e93d59fb0220f16b71ebc9e613751b8dbb343c7309b53fb933f72d142453dad6584d0be0f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008e339c7f31814e995d6c4197fb3e98ad6e0a72504e067231c1aea29f2a8728f9000000000e8000000002000020000000df8216901168994b432cc60f281b8ba4293ee2ef2702985e8d5819d138405977900000002dfcfaf39af7d9f563bb2c76db06d34cbef0f49c717d5c7fc43e4d719636c8cd377da8780e882667e1050879707c2bae4d7eee212a75012c1cfe80acd84f8be1ca307de7c02cd208a4d8bce78e795032770c139cfa3b5ccd6da76162bdfcef264f1a31765ed580d3bf090b10cafd6916df1dc5439020468d39dbbbd4e30d36ace77b20f3260dcfe79e5cd3480193adae400000002e7d88d93a001ee82d7198cd2659a04dbc21e3f834fda743d10148871a4e16aa2fe17cd587d99b810e400bb1ba5fb44f278b86d2d2f08a97c20755c036d29ff2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38C10291-4AA1-11EF-AAD0-E29800E22076} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3023760eaededa01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3332caadf80740452a2bfc7df3fdbc2a

SHA1
1834ee2908341fb55a9959c9e4789c154de0465c

SHA256
789af8241c1b91a2bed967cfce76a8385915119ff17dc42ab5e0e49b810f4b74

SHA512
7b7434971eba6e7b26e7148fc4d3200bf7873e5caa9b9b4e937c26700ae13514e0b08fd2de269ba1aa81fd71fb0f1a6f912ced3c742979bd98d93e98f2e7e2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
322c382f8aa57e445144641a65f0700d

SHA1
0a16b474fcda93a00d996514323eca0328db1b77

SHA256
0d79cc25cc91089461f1a00ed218f38fd3f4fde99c08740d7dd1aab8e40f673d

SHA512
91f76d79879c09347b607a809a050eb8faaf87f1063995e22f5948f2b42593042efd814fbeb8649251d8c3cdbc8789e4a56d71fbb8c893596c7ff1e4f17ba408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52a0ba5f5565b7ee2d1e9195f338a7b1

SHA1
22e831824ddde3b75ff9f4a28cedfb8befe2e9b2

SHA256
8d53e09d0f34e212878f2a18be42619dab88cad87a011292a571130c6022fa83

SHA512
c0205e99ab9366821a8500c75daa3523daf2db654a1db0aec02840bdfebda58cad0498258727fe22178f7ad4a196561a1f1cfc9e9a4c8c31f7ce59374b4f7d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a003e7be5c97b03e628e153feb3f7bf8

SHA1
a5e53db986069a5d3fbd7ebf0fd61d247f89f24a

SHA256
482689fe458a629ff965ae6746079afb790d7e4e792508e3528777ed5289fc55

SHA512
8d74b8deefbd4d07b5107764c63acbebd6720bcf9b78d327c636ddb94bce9976b94a7f8267fe0c76d75b375d4957c4f06b3174259e7ef39f12061d32d3e4d9e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69578eed84a40f1304092597b93a9c47

SHA1
e967f5f854b785104e6834166a6225cd5d77bb68

SHA256
66ac85be2439f6cac70e616bb823fa51e74587b99d5188362dadfe5dc9437a70

SHA512
f56f96352c68fb2acaf99053bb90d80ff06b515e40b0e03150d5b00cda3729934ae733abacf735f046b205429de16a9658704353b3d897d7261a6faa557aae78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c281aa54f5cf66fb6bfcc9cf209cd82

SHA1
6d0b81d3c1b92fa713d5db42a424aad30ca48bc8

SHA256
71b8a819315e44db3ad527bf840a55efb7760ae69b1d227063840d02960ccb73

SHA512
2798224f6bce45606b4062d0461f2870893bc5d3d997c98a74ee1285d6520eefd4a3c5403c7301e314c19528c37e69271ade0db17005bf69fd59cb2f7e27efa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f592d4de69be1f4089e87a02f7e4bf68

SHA1
961851ce0862422a51b2f9786fedbc0fe9d1f301

SHA256
546d59a4fb629999731d30207588abe0a6c68fc2cfd38d4c7fe608129752ae82

SHA512
dfd2ccd9a3310e8e2f2970de6d4a8e8f100d8cc3dfa24158765fab7aa9bce8b54f0da2ada1b2e75793d7f6a2f7fa9778fa559ec7ba195d84ffa1810366a54f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ce22f071b529d57aa0426354e9fd1e3

SHA1
e8d3ffae827aec16177782f24c2caf0df8445efc

SHA256
dab577406235fb01c728984f4ed09941169527a7a49a7a2a325c4e79aa536de8

SHA512
a20f52d90957d6d2e473ce61bed004392a3b4b804176a469fe1884e6349d6a513bd627796ea223e21e199602a2acb7dcce8e18fa5a39300d0b422e2ef67afb50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096a01f6af91f6aa5d5ae0e16da4b083

SHA1
09923c5c145b8e2de827f1c273bad61d4bbb2587

SHA256
171eb7a78a79d23dbbdc923f8b55bcbc3871bcc7327489094fa3936d2d4a9079

SHA512
354618d65653cee412a1c6cad6aff09f9240154cca67738d48c5625392c865f61aa114469db3d132fbb9fb39137c42f262add7ae91c973ad95ac5bd174e3734b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e690d59d78923dc1a093431ad12d3edf

SHA1
c4b6674cf253e9d9092be623c861a193d3e45e76

SHA256
daf847c5710e2a4cea9305efb6d44d464644fa62fe4d591bad63112206494b0f

SHA512
fc1039067a354165869b3c94f967979bafd593afeccc677f7a734a27988d359bdc327a7583c3bb7cd69f499c12ae6d2513ad2a51218f9023f101469db7527ef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445c12fe59e65a61821bc3d54a2684f5

SHA1
939da4a01b944216427c7e94b1f5feb952a0151d

SHA256
386f58902e494ad5fd7e42894c74bdf0687d1bb4880a260f4a35ea155b5ea9db

SHA512
1abde6deb75918be3e644af1c04b258a80921d07bc61322c208d14287fa251e16530b06c307b5b9ab8352bab3d227cdfd4cb7c67c81ec359435d06fb613784d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7097a025bcad391edea140c1ee5b04d7

SHA1
49e5608d3665af8619cd7a5f246206e09ab5ebc0

SHA256
07dff9d897c32c1d9f24c9fc32e8cd27564a6445b9376b536a7eabfb848c0ab5

SHA512
10c8e46565c4e4c2291c7e11768dd7db1198fe5744234e4d5ceeea91ab59bd62f54585a52f9c55295e45429eba85098883a0197dbcbe60a81e265254da50846a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b892a001f52915f913171e374b32b96

SHA1
b2889dde7b251629e739f2527ce8b7315ddc4571

SHA256
dffae40f0eb1715c4891ffff2c5f611694b79a5c83b2024ac3eadbec35547c18

SHA512
c9c2b88e4984fa17058c76ebad65ce829174aaf82c53a6247b528ca3beadbc93bcd34d7195bfedb65b78ab3c41c192e47377143c77b7997d6df3c691ab431ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF701.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit