136e4d375075ff864b3cdad31969835e4ce59847e72079a730c65efbf794a58a

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cvery.comvc102543525255525/exe/help/cover.htm
Size

471B
MD5

2549963316121685109b84c2bc42dce3
SHA1

509b57ca32820da96c8ea8b7f4d56c9841349554
SHA256

90d733c9c3791a996c1b24eaf446e9d8fbda0e2002fec789fe503a8e0bec802b
SHA512

77fde8b96de20b54ac34f5617f1d610af76089ed926355ac754f22d991451bbe966277446e56a577b27e68bbe22cb7041c31fa28cb7697ac457d3075b5cdc693

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428230284"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6047ffdffddfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B876981-4BF1-11EF-838C-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000498489b8f59463e315618b39ef2f62ac6c8c2c413a7c978284ed4cf0401572e9000000000e8000000002000020000000985c1b976ef7a4a9485d8d93be64dcbcd6124c0eccaad9c2d6fa71cdcf0399a92000000011be3cae4c83923e18aa04fba414363f8b698d02f60e21d06ffac52494f99bac40000000a5d8cf083feeafa2dde5389127d48c703017f2f434248f5c06bedbd8f79872b2626219f19f6b6cce0a2cd95d5a2e0142b1439aa8a879c639c2c995c6106f4c8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000866e898baf618f1eee40bf2abe8ef964a7fcf10ba8d41846f6d2c108ab06b668000000000e8000000002000020000000ae073e0cba2967f97483d973f1d7d11bcc603e2c2d93e3a63000ab895f540b20900000009330d89605a5fcbe98be8290ca2b4e04392fc1b2720228cf3cb700c44a851da21d81d96617f168d1c8f364b85c73d88d79177f5c44bf0a58a34075851098b1448acccfa3157bbb98d39521ce06eec88e04e1dff44ff12826b4b8b5ee247a0914531f1a0f9060d0cab971747942e4324c9523956d37a44dbbfd1edf920567f8dfead6d40f0cfaca6d5c2057642d856191400000000ee44ee04f244950351db52454fc30c61c2240f718f0315621aa991d80538a72634271514a2ecc1b49d7147d3e8f47074a05889277a2ae9b4fcbbfe49a8e42e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE
1620	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1620	2536	iexplore.exe	30
PID 2536 wrote to memory of 1620	2536	iexplore.exe	30
PID 2536 wrote to memory of 1620	2536	iexplore.exe	30
PID 2536 wrote to memory of 1620	2536	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cvery.comvc102543525255525\exe\help\cover.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5dfb46d1422c6df1bb17e3f54068091

SHA1
fd8518f5915fd2bc5e7c9801a306f8dd4d930434

SHA256
dfa23516225b8b2822ecbf11a8daeb08ab08d0991334a66defcd678a78f14c7e

SHA512
eea103f8d6cca0110f4276ba140c30ebf1c597e179a4ce21906a45c6bb4be170addb6bd0e30e584035d850c2edfd6a43457bfc983af6330a008f79a64c7a4467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b35a8dc109d115cd8b7d9ed6804d639

SHA1
70e8ca9d6c14479295b9d78f2d388cde713e2417

SHA256
7fc8e8bc19c4034988cf803026e2688ce8dbc5fe5541ad30a95ec88834f30d44

SHA512
ef0e942190a5b705d68ca17e7b379b006ebbb75d7ed1ccaedd6a4183788be5a1a265c5591bed7944dd53652dac9ba141b69b86d471e5725a2bb610cc8533bfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3e0a0434fe02bd96c536d5bcbc7693c

SHA1
3085b2d7040b63f7031946b81b2cc0c73814105b

SHA256
adac89dac655a22bc9ae475f577aaee91fcda84f3810f9a75b1684ba8ab3493f

SHA512
f76e005f88959bcd0cd18ff2364091a912e777109cc1655af8c41754461fe76c3cf43bb0c7bd7ddd04c9d5e8f4084f3d97731748c5022241fd8a8ca0aed47992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f31551634c4dc4664b74f54159a48b37

SHA1
a4b75b09b1994ca291672068fd5de06be1c8d1bf

SHA256
206aa4e99673af00c92d1672b0d4a6273671f1aacec4f658767b7caa9da7d088

SHA512
acd921d722e353d9e36af3c066844411815a66ec0d5af5fc8c0ec12292ea32b0ec854718fc3aa0daf19f32a38aa0ae73ae3b6e501fcc1252e9bf06c408e46540

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0c608ed1d0ce65e55813b83d466c979

SHA1
4662633263a049ca780ca14eff578d67cc976c79

SHA256
ae001ca9bf09bcc720623dd3ae044dbb8fe2dd03eeb8fcc68c99853b3cd1d5e7

SHA512
f76a112ad3c3a87ab5632dc202c3a44cb8aca1b389816e2dd1fe5da9443b8ee55664f7007d5738d12471cf4cd3bfa12b1b39dd9c5b56d38963a533217feea367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ab3edb427ebad105b9b370a60206d6

SHA1
d75386d211c395ecad135da3bb8f69b1d8688b26

SHA256
0ec397f59825811f4d5aad1e4eec7352a8afda38c2a1b595b455cd99762437d5

SHA512
0dc0bccf0a3da8849e5572f5eed74c9165de3c468fd76ae8922bac4645e8638d80a4d80542349e8d09f7fabd8ffab559345ae45f767f1d86a80da253b104db3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f58a85d5d6186a1b9b8cb238d0ee8fee

SHA1
5f9fc33f70dc53767a38edc0408f1d09b5d8a201

SHA256
5e3cfd4c3cabf2696d4b3d7c78cffa78e6f4bf31dd8f29c463e31a361542073a

SHA512
fc88770482788cc5b9c66598b1016afc24eb2f5a12b7736cf38e91d8a1da9d8c9ad64bcd0ea5e77b23e374ea4aa66d45d7b96ebd43cee86eaba7ad246b76b9b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5241541a28c580c04a14bc1268e22da3

SHA1
47a1aae4a7e89270a4c1944fb966a63015bfc002

SHA256
a8621e4a84a23e3c941ecbdd3cbd6cf64e7b5e241bc3ae5c32bae78678620c72

SHA512
7db1d74c01f6a42afd6fed497efcec888511d35fe16a7ef9068bd5a4427e19248c3b296e744fcdb040d77720c5ada338e039016fc291d22fa9ee3261788b4c60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2acbafbe5d9011c528b93753bc670923

SHA1
ef0fc8e3e528ca149aeac7eb0371320a43f6b5c8

SHA256
701d53603cb373d1481ce7dcb89a54311c03c6fba861ab656d040944764285be

SHA512
2a2f5f98a3fad151aa26b764f46636340546f22a4872e9dd4f03ef4e567f9f549e1ffd64707c6745b7ca87dbb117e0d71f831d9679e60791b56778c08a91485f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB770.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB81F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit