2fdba7c8ace34d0c44a78f7b9a9bf1e2acb1aec1cdfb7fdf52eadfdbc3e0f56c

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-07-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload/article/index.html
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E496471-4E51-11EF-83F9-EE33E2B06AA8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002fd182fd1189049eac897cc0d1c0f325b6ec7db72097bef80d731d000257aaf9000000000e80000000020000200000004eacb9ebda3741653ccf641b56c3d759ebed5d04fe6d7c98eda68a4d1d7e30c42000000060bb4c1b372745cefc195808903013f533557add7a1aac7018032c37b670cf0940000000d2280a2d536d9f6a1dce9039cdb1e299b0890f9573257daa41c24d048e8c2a3c430e7901c72879a31abfacb79acb211ccbcd466468dfc291d29e8676e28fca58	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f099b5025ee2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428491473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000079d89e750c6c72d45805a3968a787ce756c8fff4d645fb567ef7648ce884b11b000000000e80000000020000200000004a77478faa4b87124fd65d93ef5669f8b49a56eaaea337d8896b8aead42227b690000000fbd8729dba956477a10cd71d0f6d1337974383a30ec2d835c361b6bff1db35cb7482aa18e5ccd871649cfbee9e4d06ee462a42923d9a71ebb216f9cef0df02beb46165582a72ccfe1ff5a633f5130e93b393a8b511a4e5006f73ac9ac46dfbfff4382eecfec38d500543d2d0dae4997aeea59dca460c9b77b04125bf187ddcc605fb455f509b76de4daab3996bdb4f2d40000000bb1850eabb64d9143e53c3e35075b72dae7b356db2174260148aef0583002a12088166f673e4413ea2aa7c341164617422add15a703983d7cdced4fd1833ae2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1956 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1956 iexplore.exe
1956 iexplore.exe
2392 IEXPLORE.EXE
2392 IEXPLORE.EXE
2392 IEXPLORE.EXE
2392 IEXPLORE.EXE

pid	process
1956	iexplore.exe

pid	process
1956	iexplore.exe
1956	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1956 wrote to memory of 2392	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 2392	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 2392	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 2392	1956	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\upload\article\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d6c3b45821778d54d5c0f3d9b756a3a2

SHA1
7c95fe490cb3dd47df477dd75eb14bae49479dc5

SHA256
b36cce75876e3ccfe573820d939573b7109c3f01f29d2f757f2904de33e2f69e

SHA512
020b344ca448732c332de42452598b7ad260a24d906b797ed73c70355b49e4d9a4562f6b6bd99502b9bb4e6e6c033aa5946287bd794ac4313588e30288809d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b219fdb74ec1fd5d0af9f1763446ab01

SHA1
4a91cf8231c0938dda58409e0db5c636d407a809

SHA256
62e1e8bca8f7ff4eccc41c0a863cfa7c6295fe7e9a1b4217b384d4ba1c4718f7

SHA512
6af438c16a752709fc44bad586f4b16e7bdc1053b3b2ec8848a9ed782aaa209954b525d57b637598043f3186746f4718f5b10c5c44242d66f10293bd77b448f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a3d7597adae6ea66ae4892cb6d29fb8f

SHA1
6f60349cbb6fe8921c52a078dbc1f6240b875faa

SHA256
2d420f5bb313ef9c6f8268a017d10fdc8b63c2527b4e06c280dac00e18b0e4d5

SHA512
03a1a2ae95b621a183849ae4915f132d1bc44ffa90119fbc5889c6218f1dd3e70764643609a03e2f671e0809950494973c900feb1913a4ff8f16a4c3db19c8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
097d89e8777b1b39060c794b90d550dc

SHA1
50410f06f0f4af2f95e76c80c355a2353893b305

SHA256
83065e5efba667274b519afb36c8e230122678439c0c12a1b0737966c7eb284b

SHA512
998d3b3dd428623b8d01b6719a0b5cd248755307e9c9abf8a2a6aaf45c1fb41ba2c1f476c0c128971394f0a783766a98c3bdb9eb3b97e20058878be4107d40a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
7b8d190fc2eb54ecf8f89d0227d5e65d

SHA1
f9c77b987752b418ddaf3d8ba573e3a81a49b66f

SHA256
186ab3330efcdfd2a808d7be6a23124ea99dda2e23202710d94e4cf11a998131

SHA512
50bfcbbe64bd9eca77b692e5a4e2d23d01702f5b7b8e6dff63b00f4992484d922a0bfcaabc7ddf118a6e02d1ed897cb25d5085bb8398234a840d0a633fa71131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
191c32d5ebc855071ffe4fc0039c8c0e

SHA1
7b1351cd0abc14c81da7b5d7c1903c552e9fa4eb

SHA256
2d7524f725a52a40d06035602ef8fed1ebd632a1a2181215f28bf585fa71019f

SHA512
0cd08dc6f4a2017be0adb91126b8a8648f445970bd21b9c08f89d4ba1548a601b7f72aada5b50b2579a601b03717f9b7232a609313b31c7d3c6c91f6334f0c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8715ce6f8a17b30ebb22dd9cbff7b6f6

SHA1
5d7b1dee432ee546f89ff6b076ba7b57a18b168e

SHA256
535e5a78b3915c805f350af8ca1c8847b5444474544818bc817026ac040dba2a

SHA512
d5af660f3c2bf90a8edec3a006c7bc4b303ed8e80dc1422aed0fd17fa20c95d43e68b24971fc2cc8439d3fffb952b8c5206d1c5ae7c247dcc239d2d121092933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
240ae3025047714c5d7a5feaa28836a1

SHA1
d1e757b65a276845c450b3b2328e86c29ba182d9

SHA256
f766717ca43ad87630f05d3ebdd763958b329e726bfc8075406f085e3246ec7a

SHA512
93f73f24976cbdd025fdf4010bc82b2f09e344bf3a483a16e1a6282a39fb74f19e6fbe348cead3adab0f9e46d16591b82610057d0eda67b7a1365450675579eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e3ad703982905a950408149c17bc150a

SHA1
cdb053fc1b24a0d5a6b3ffacde362afce7592610

SHA256
ab2f59a43ad9528454670615b5b0911ad62fe5d1165a57fd293f2939b30439cb

SHA512
621c2de1def85bf03ea4c5bfff726e2a1cf6e853d97db8e7906023f310d5ba7c8c13c2626456afb4ec19f32eda6aca9fff66049232262f7dbe1bc50f981917f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
6b2025de69d6748bad6f926ce23b8c3a

SHA1
fa732c5060c702e8a70dd0ed1cad3e99cd4e1257

SHA256
ce8c9524759a8bf55e50606edd955db831bd5c6cbcae8ae14e368415be376fc5

SHA512
b640c584c2f4326b6232592debc9ee9c7196cdea9e48909a5d2b4e3c5b8b2a71eccb388075a39756768ff9b78ae4e756e2022dbaa908153e4cfb33150627ccb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBEDF.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF4F.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit