Analysis

  • max time kernel
    133s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 18:09

General

  • Target

    web/cn_list.htm

  • Size

    230B

  • MD5

    599f0856c395ee8d5908e59b09830031

  • SHA1

    4e526a265eb440f4311e4d3441a624e757470fb9

  • SHA256

    f36f6f06123aed41e5c14daff2ed891981f8f9ad06af71d21e97cce7800ef983

  • SHA512

    fa42ea8ec1f4cc59ca1d674c7b7786b9d2489ebd01a460f1b3587e1ac85d1d928392a570de69d0961c4e3a3999361c091f42030d27dfd44ace5624c9e4d2c5d5

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\web\cn_list.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d2de134d7397220140298002709ef92b

    SHA1

    3db0f970e86c5b453458095407487a735f823434

    SHA256

    634792de03b1755f5bd71d2b251f5ad63a9c1a6f18ea9ce2be737099d62847de

    SHA512

    3cdafe793e922211f0ac710fa2da3727f95713667dac20f78d3f51e1a32c9b0459677f918f7710b46a2891d0d939ec8867dcbb870b597de4f67df88b82343a85

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7ec090f7c1ef71332e9e89870dd0aa9

    SHA1

    4252a4b9fd9f53d3ed3e121ae29eb1b9cfc629fc

    SHA256

    38b40f00edf2577733c34a833803f650d4bdea7cf911857ff7371a700d9b8628

    SHA512

    514a3f1c3e8cbcf2f388811d60ac21856e864275c58d2bfda6d1f71d8731d862d91665b3d0e8385c730b6ecfd772eb6aaf42c168bfb5ad543605b231ad15ff31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cfe053d9c200db42cd2a1e2b746756b5

    SHA1

    07a89eef7a8234c6f8299af4b50915ad641cd259

    SHA256

    402b49783b25ea5c28e8a1757931348260ecbbbb0262236539e985525b852933

    SHA512

    37f5f0e37093a9d42a38063ec53b0b201c3dcf532404a816b141efda4e3b0a0352470a6847446bb50200b9934280665b74fb38875ad6675e0bf89e574347480a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b2854cd2dfe5b0a57a90d0f089722e45

    SHA1

    b6b27b1aab9817a5831343e0f598a303006d866a

    SHA256

    342cd97a61621033919455caaedd88d483770aae5d24ade45626156b20a4024a

    SHA512

    723d1d3683252044a675e5f224522cd6eff3ba73e2a83dca43e887042e79fda6829ee3777d8673c074946fe4416e60e7aded02b90e3bb7bdc867348912ab1e4d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e062a617eddfb4629be9ac58f6b6e140

    SHA1

    473784793210149047d9d9ceb0fdc89eae7601c2

    SHA256

    60c23e45c8c758cf7ef269efe3cb7d100598d6357b126569a2ea4a13e5a8b275

    SHA512

    c997da68802281093ca7256d08472738d10b0786305f97d91c859cdc4534e47e130b527fb0845f2cf3a48fb246116e0c982b7fd1de5b81f925ab1830676fde9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f3725667ec8a040e6a2f718ba32b677a

    SHA1

    687e98f074db8aa4657e9b4e96d69cb85d8dbb40

    SHA256

    f64f48343eebb3cbfb25c44edc74b1a049dcc766685ffe585918a59adc8c5f64

    SHA512

    ef189e054f90696775cada24126c2230f4c4310771fae100b85cfc2724e7e0d5cefd2c6847834bfa4457a257b124c976f97fff44ef3dafefc5ed7b9c3e24afe0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3ab8ae7a58dd92937038935050793d18

    SHA1

    e546cac7b0457835b64a7d8bd724da779efadec3

    SHA256

    e47b1ef0f2a5dd2969e74486f2c6ae327d49fa934bd2ad117f7264a15d6ca515

    SHA512

    deafa38a8bd38b331ca7c6179112bcb322c7c804a653a952ef077e609e86a36273f0a4d1f880b50d3161ebed4494b77c08c331eb373cc802401cf883064bf549

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    46e3766ef1329ea93397f3b4ba4f176a

    SHA1

    c8bf2e2eac4c51f7545a52069a3b2a98b3a01d74

    SHA256

    b0f02eedbe13f222271a9c79ad2933607d082f198da0e12ac4447724ae4e1323

    SHA512

    5f3d27266f49f2ff5b0c33faef83f72cdfc85ee299571ca2adc5e9c40266043d4de21b43c8ed3cefe228072008ec4aed1a2f7eb6b1bac4f093bf60b024fa3a79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3fdba82695fd1101858fa04beb267c41

    SHA1

    a12c286e778b256c99e449ca72ab22e02e0f4446

    SHA256

    97b0eead78f6e045f582d03158185d116778ac00e57252238700acef4547cec0

    SHA512

    1a275035bb5b324fcf1af87049bb89612dde2e5db32aa4f0bc87deedcfbde52f50c002f2b43c3d0cf846ed4dafba40d3f12f781fa84086ad7627466dbc6a6c61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f13bed092c12963997078d04c7ff0d96

    SHA1

    4928f6379709811978bd8a43d0391ccf2c90d353

    SHA256

    162abacd75210d4cbf3e69f63cb5b6766da6527d80d234a9467d10958c78a7bb

    SHA512

    ec33fdefdce590cd57094fbed4fd30c6864583d17abe512cd20aa3b918bc771212930a6dfd9fabe2631b6f863ee217b703bb610009cec8436683406f86c27265

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4adf51547bd7e1840a9e130817ff973a

    SHA1

    40a7278b0f42636883f46162806d2410e958bedc

    SHA256

    79138034f90a5accfe73c6b29af8db9614a5b9cbcc3fa5ef08a3c26f69d045fe

    SHA512

    6a2b89e4716c82f3698946271b9499eec4c2edfd0a7dad68544be74af6d92a7dfd14c60386e803d7cf80c82453c3ef53726d55580141ce91efeeeccc6d7979c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed2722f390c4352fc61991bab3dd04d8

    SHA1

    e75ed8924a17c047879a6498ca8dd7d604e7dc89

    SHA256

    2b1c5d48883d5d373826f8ab3356081ddc7b05e5bae741454a57d5db2820d0e8

    SHA512

    e4925e040a8fcd8479c386b8913fd7172172efaa1bc0d1124489eb4e47ddd08c6fe1d62cdd3bbf5d29e99aae9ea577d25ec5c5f27b3fc388f597722aeb136d86

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    24151917683341edc53f81cb429e2cd2

    SHA1

    9dab773bc808709cf459494e62bd5edfe2f87e8e

    SHA256

    5dd686c3bf536cf56c04705b41fd4d1dc98fd48ed0efb8ba3eecd9ef0c17412c

    SHA512

    9930a0b028d13d8d02562fdcd8b2ab60e2460d3a8e9164b8fd1cbdc9fcd2c14c3a161ad58aa9f1979a5222241eedc8446ee7e5c5684aafebb789c9c78c8aec01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eeff15a5054fb1ff8f002883d05a66cb

    SHA1

    ecc83f59a28607b1b3f9f71fc13cc7483bddaa26

    SHA256

    a637f124a6f7097790bb77907a5befc89dbac0603d5bc6ba676b394f5f17690a

    SHA512

    7087eda419d34e1f11f227ed57ca2873252842a2cc053c488731954ecb7077a75a38c6bd9c624b49f614db1892303c192345e56ad20f80f01c138e656922c648

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ed5c19bb4b5da0d2b63a487e44935d4c

    SHA1

    39fc0c7f5e7d0c7a214d5c02986c3f8ab53e7250

    SHA256

    8b189b18eb6b2989d0f4f702da7f0f5a22e5d0e9caf360ca51e3c04eff48b4a5

    SHA512

    a889ffd82930d1abc70f05da4f3dae25d33dfafb6e25278fa25a1b4df586b06d8ff2fcd2dc675725268634d52bdf80caf49a1aa7e7d85458ccd280c6df98bf46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3f8ac0d86eb3fcd8ff3ab935e3d8e146

    SHA1

    5adbcf3b722091a22a390f4b73322f741f008c8e

    SHA256

    9e018cc984994a1c0a9dc910b99e3a87d8ee766ca58f5f14615dc7e806ae323d

    SHA512

    eb52165979c6c63c8460a6abfa76fdbe9967706abfbdd97809e49733f8c2eccc85ea6ec1bd268054143a23fcfd30d56432040b083e355178c5822747d2f3c5a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ad6ea526ac7fb46d731d9c65f61da2bf

    SHA1

    73d462bb2df7c1e937a6bdd89fcc4ab6db649258

    SHA256

    82e6cdd722cab9a391065b2771413196514cfd173cf5e586de5129080845f790

    SHA512

    a24310624a1205aaa3149478191937c6e9626eaf54ee0f4ab77961c41b020f2ac6fd6ee1a4c5fd8d7fba55e16b841386624ccf2f7ae97188c53c5b994171c94e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2c892edd11628e79b590233e51c3cd1

    SHA1

    97d12aeeef37739dab2c436208d8499427339184

    SHA256

    ea413fe81b20b717ff7d31da44392b297f815088dd8ea259b612ccb1c59b05a7

    SHA512

    6c45981050853c8a63468af047caf4c0876e15476e6a4d09020911643dfc248e7121f862bba91b7f756fc109d5a8c8eb8fa382ca6f663a917717c62db6de9933

  • C:\Users\Admin\AppData\Local\Temp\Cab2F6D.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2FCD.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b