8fb53afb6703822e54a5159384627cc9bf50195da4516cfe54f25f0056351565

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice032024-Pdf.htm
Size

7KB
MD5

32d6cab580475195c13e595acbda7690
SHA1

49c328f5859cf5a409c01191283ecac92c728b2d
SHA256

8fb53afb6703822e54a5159384627cc9bf50195da4516cfe54f25f0056351565
SHA512

71c857d579ff85391f33c33e8380c11531d8c31d447703e6bf7c95769d980a4065ef07f0caa09ae517251b6cb680c98603a91a98bafb92ffb18989bd318df920
SSDEEP

192:t9AYuWLbYLrd5FaRgXFMmjYWhLuwj2h9FNHo:HAYuWbYLrLFcgXFMmjYWhLuw6hpI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428139697"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23C6A611-4B1E-11EF-85EE-5AE8573B0ABD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9003d3f82adfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000008c453966159eb85d1dd96cb0f3ec81e18c6ac83cc136380575ef493c26b27a6e000000000e80000000020000200000008e6038473f20db6cfabdbacad9094beddc2880c556017d5caefde3722f096173200000007c7bad8d35d92e00ae7c6c846cf19183089e5159caa490927f044b4f727657b040000000a3aa6342d222d32b07a3ef47c899550cd7355dee3cf41fcd71807abe765254cb6977c3e37183e28c3bb9efc9698ad3cc859b703150051223622f4b8e86d93bd1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007779cda74ee280b6968d032872f46d98a6a2dadbccb3f651ee2063e59230f652000000000e80000000020000200000000786c8ec89861eb7bd3534c223ef07bcfb4f5795ee460230f7b6fad94d9f439d90000000dc2c3132fb77cf9def71ce4d79378288501f8bd85d8d0aeee4669ed2af263b8068ceef600f96ff6fa72550ebcc004e8b6b825c858ebe4762211a3dd3c0a5d5121727053df4b6383d7cb71273f8d055045566da8fa98a07bd37feb760ddcf3799cf4e5f3f4afdf00d3a63b6ae2fd6cc3078128447725c1e611d7c0121c6943731ee30bc8862f8c34b42319850445e0ef340000000e4176918eec6a8ca38f10bea55dc2842f9b615ad1a43d251b17c13ab6043b6937f235b06dd4008c129925a1cd118bd420e7a0db8540058b22cef9ba682a37302	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2680	iexplore.exe
2680	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2820	2680	iexplore.exe	30
PID 2680 wrote to memory of 2820	2680	iexplore.exe	30
PID 2680 wrote to memory of 2820	2680	iexplore.exe	30
PID 2680 wrote to memory of 2820	2680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Invoice032024-Pdf.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea03607ec788a5e53f25564e473f5f2c

SHA1
93ccfaa60007969db327d55e53ef8c4327a93045

SHA256
186527fae0f2446fe6757e3d9dc753579ec97eb42c72cee7eb02ea549fe1f4cf

SHA512
b436699ebe070dc90c592f1f1b5a9ef8a5e5d901fe0e8412285ebd72c3c454b131e43e02191224f4b52e426247c63eddb4ab1688ce1d616e34be06f5089ad29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cdee28a9ee433ea6ae440253e4e9f0d

SHA1
6a5788f3efda897dfe476d9039dba48d225019c8

SHA256
38448e399e4c53a42a12e4c5c568c69800b07bf695737debb6c12523ee1ea707

SHA512
97f36021f0fc244c94d9a2e177de7c51ccf6f83ae89d8cdeb6f7a7dd736f0b421dbf91ac11014c2020df96ee16f8c3057c343b5b7ae78742760d6e037a6b325c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d26229dbf9c9c8b7b85e19ceae6c387

SHA1
da9f00da34673ac8bedca8926baee4b1bdf3a3b7

SHA256
302d1b44b01a43e412e80bcdda7d1bd590c1e61d2e0ce6749834b0a90e727d28

SHA512
b665fe1a43582608bad40d14ac6b4895bda4606452e39f31fd9622497b2e8d4945ff56a60e497f0816a781a575707af9966a93a702de8780834a9c68d8a521ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b1771577b92164609770f6b51d7eea8

SHA1
bf0f8924acd98586a5d2606e6784fae127467ae6

SHA256
060edf0a5029f7e7861c902fd936d32bac811a2cfa76a91ba8393c11eb0a84b4

SHA512
2e6a5283583739c05cba00ba75744ac216209ea469a578c1ae46a6572144cb8f7e96ed307592c9fbfe654de4b09fdb0dad27a25e677a8ae7ff7405bfe50d5e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
307263241e28bc8646a2fd4007a0741f

SHA1
76ee31a37ec14d49fd9a842ba5df8ff1880f60bf

SHA256
53bbf54442316325bd483fe20d0e40e36660303fc629259b704baebb30ee7efe

SHA512
aac0b38acbe024dea256aaa5523975933f823d98977a634c993e59b06bf53a576611a9b7121aff49e71287b340b0b408bbf955603a5fb119409804853cf2f2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7510984fe2274869c88af0ae36317853

SHA1
68c1d2430e9f002e6482aa5c2b61a2a8c989d430

SHA256
ceb430c2d9780736e7f67d8356cdb0056e23b8564071aa32c0a3e17c5874af55

SHA512
37d9af8e3d2cb63a71641e95ce711779e96f25330e120faed097c73654e6d005c3faffbc24b70a4804b08a9fa099a27795836a963d8beb42e7d71b6f2e7894a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb6f32347dab9f9ff0b307584a21831c

SHA1
accbaf2f4d6c01b3a28157c8e11d0eda7b80c5ac

SHA256
a5d01bdef01c3e59c75c6162a990caf5d5f0b2699e572decb24956546127e5a1

SHA512
50117e4e40c8a5742a9e24960ab7bf0dcf331a956325063886be791a005dca76649a2856188b1b546ebf76668a1a2867fc3080881df1154dcf431cd229b5b1c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6be0b468606e248791b14aca625f1212

SHA1
b2f713be4473d2f06f8bbbbdb0ef9b4fad4d034e

SHA256
765c0262556bd05ec10bc9e37550eaba657010787cb9e9eb7bb1bb39ab36d457

SHA512
fcd60c3b8b06116c10348b5d7043f2d9f8723935d6a0de916cf4b52bd5ea7df84ec72384fb986a0560037a067fc02b704f2a51f6eb5515b481923201e28aa0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf39dcd12486087bae1ed5f1a69885fc

SHA1
2254de1980c6132c6d75a6c21b0cccceea535f98

SHA256
3cad1dece1c7e7ed4e4b9ed8a5d7125b6489a1a418955d26e3cccde0dae77214

SHA512
73a37b0e06e3351afc295306d6b1c4f3854081f986e284d2725cc7e57a180f133879bf840af0ee3e7bec5ed6344cedacb733b5b1b980e474d4e46735093c9018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef8d9292922de0b6bf5dc0567c706391

SHA1
0963a1d143b678cf7c0f90d1ae09846d91b817db

SHA256
0464b148b6116aa0f81108338f4bc3067b4e467b8ec1c5deef8ed6d87b27b185

SHA512
95f2c0622075b426c813b3798469180cb58e49f1db25dcf988e8f72700d475fa7387ba9fbdfdd02ca6ec16111496c4a0f524556f6bd948cf43cd517f97b94749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3e7902142e1ffb0df3ef3c5c7b5015d

SHA1
1ab806850ddc1d8b1b0a2637c3329eda0f5d02ec

SHA256
36a3bc247cc334afab84a18280ddeab7a7212bbad61c0772fa1f860841d38da7

SHA512
4bc570ca3eed8ac89339b4b5fbb74514544f05fda09f672009db096addb3bedd19a4375c14eb670956f746ac7a8ad21c3166e98dbe81be121533de3b254ebd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e748cb8316d3ca1af5fde463b3d744e

SHA1
3cf36076547648b387c269d3810eb8549b2ed090

SHA256
8eb6c7a269944aa393be39ae956be10d4d468e26b5e426e73d07e2620551de6e

SHA512
40bc8147f00c6411e5b66bd946deca1b4b61692fb889c95f70dae4e6254f81e39ec7567124b70e53ec7b8432cf43b985d3431a43672f11f960650d8e5ef8b0b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08a001b546e26be396ea5c5608cf4642

SHA1
c42601364912e8c43dd032922be6d21ac23405d3

SHA256
10a2aa4c739f76b3560aa9f618a54baf2d909cadd8c7ba03af555e7fdb8d6175

SHA512
6a46913d63ac930bcb99694f5c31d57bb0d9f1f2363da33668c777f01389cf44cb8ce0a57344f297de960069cdd9aa50a788995a562cb021e00a8621de4cdd1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77f08f7a7d3444e057f5eb10897ebf59

SHA1
a9d26ac01aa08c5d4746763d08cad20dcbf6e4d6

SHA256
e7ec002c0485bdbe05c846d1074895bec15a5f8112dbbe45d5ef75e56f5c8f40

SHA512
1f279f37737d07c127af2e50e343d05d972d69f032b9d980b9de11edbea8f15aab3f21639515deeb0aa5ed4bfe0c847b08630fbe7b19531ebbfd56468d380549

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D7B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7D7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit