8a98959bd08625a79795b643f3085a26efcb3a0741ca7ec271176592fa8680d8

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/backup.htm
Size

11KB
MD5

4177b4e313d985e5fd7ae251c928a483
SHA1

f279ece84b5144dec4a02168c245db9d0c56a897
SHA256

2449cd3ad71b59263c1caa5680e01ee8e6c59a88fd6f7b17a3b3b121a73fe121
SHA512

828f41eb1818799fc661c452329eb7ad8b10f73ee19dbfa60b313c30e44da115dd8fc9c54e8e2207f882a57ee6b42b5a8d4800ccbb20aac78168ab7f4e101c94
SSDEEP

96:/qY7FcA/Q4QUlG7jKXUFmMffMcfCWyqR6cVlZuO9twbOwgrX+cxtB5G/BWqvBfns:iAFcMQ4QUlijOt/FgrY/+Ipi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007e0993f79b9e9436262f70ff47fab4ee786f71f3ff461995e77dcaa38bf21ca3000000000e8000000002000020000000215ed2f63bf167dd58cec9f28397a579a6dd39e50fd4b4c1cd4e054d85af93cb20000000c09b1b7bdc2d9dbcba84dd7078420e02c428dc26e91b07b82f8e2873668e9dcb4000000027980fa1ba5f9643f26d670cfa2a18d46938d17503b5e526cb94f37498e116188ccd11fbb7e5cbb2eba42808b41cb69d5414ac1092fffafdfb2e916353a7c347	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428605039"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01c146466e3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F8D0C61-4F59-11EF-9AD1-5A77BF4D32F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000bff2355bb930ad9464f3da00ee7369e1ff77ae551bd4f420136996fa94c82d91000000000e80000000020000200000006c2002e90e617ef93ed31b6515dae72319687a0dd9b22ac104e2bf03faf9364a900000004a36c4c43de83dd3ca80941f4300aeb94f575784dc8fbae713a9694d2c214f93207a1a30fa16e5593c114950f61a1bc2b6b1565f8a47880ba01d3b45d1242fcd8472511cddff82c8dd7a5af0803f21f766331726fe99c0bd28031c0f7e222b27172ee8b3a3be772cafc96324c11bcd3f73ffcb3e8a00cd8fd9904ca303d5b8dcdbb95e47bcad393e117d154b67a8094940000000eafc5fe805434cf4eec987422f7e7226a044b5db885c26ebe77b518388da2d523d9584fa58f58f962f33049c2f3381434f41f5ff5393aa6c190e40c25caff263	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2724 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2724 iexplore.exe
2724 iexplore.exe
2736 IEXPLORE.EXE
2736 IEXPLORE.EXE
2736 IEXPLORE.EXE
2736 IEXPLORE.EXE

pid	process
2724	iexplore.exe

pid	process
2724	iexplore.exe
2724	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2724 wrote to memory of 2736	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2736	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2736	2724	iexplore.exe	IEXPLORE.EXE
PID 2724 wrote to memory of 2736	2724	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\UCenter_Home_1.5RC1_SC_utf8\upload\admin\tpl\backup.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
db2c25e5aa88a719c22a3c9c2511ecda

SHA1
7dc4f1d7a03d557d8e3c2a0bb462020605ccc066

SHA256
4e4fe484a1811a9e82e36d93d0c30d396d72c5f8b2264d006776c99c005948b1

SHA512
850984cb2204365580cc02dc1a04e8c451eefc294b30b26f61703dfbaf843e60bde7279afa8ec17bc31b194f23acec60b8e597ec9c8f3a100df77c7574e6d2c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3d575b2bc5ec6d261403d04d8c5c69ce

SHA1
e135362a77ab9f6743ef9bdd23984b56f5e6321d

SHA256
ae6102c41b6b37299df892ae9ba3935fb5faadec65f88fb4d7822d84beb3e13f

SHA512
05dde035d1ded7bcddffc420486f449fc288819a8100faf4a1d6de3b512cef62a701683dbc92ca0c2dd3ded6bbdd65fe373afaa1b0463620114f90feee30a2f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8f0af0751574218c32951140490be7a2

SHA1
4d016c6c133f73e88abed1ba3a249526d143856b

SHA256
9e24be6f5cccee60d413a13ac5673f8f44bc4855b58c29922fa973b3ad3f630b

SHA512
e631bde03d10d09277f5bf81d000f772943c046796b59b9f08d27b5cfe06ee596fed1b872fbf28973201a83553081541cf84512f54df92a43fa072d50d628aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8232ad729ae81b5b66a650e1b1a9c801

SHA1
65a1f5dac4cbff2c36ff6de5723829a035db67fd

SHA256
73538cd48382eed100be715a30a06acee4a6484114f2e1550aa34d28ce49eb2d

SHA512
5cc46cddd4a07de23669d6e756f8b731a4a00e4e42fe3cab584d1910245fc406b92c9ff63b84518e4d10d14c4026923868615afe5480ff81e7ab7edf0b7c4e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fcc892ccc8b4dfecf483d6ac44661b0d

SHA1
43b31b5f55e116a2cf1869cce5f9515438fa488c

SHA256
ed2fcc61c8ee879637adf2699ef9155a9601a6630721596c1f7e5fc0618f2df7

SHA512
9313e7966100eef401686d7c472e39d8e1fc5586dc5f681b261a450534879832e910f6f9840dc53887e70698e5e5ad2c4d6cdc2c5dad1a848c5aeb0cd0814e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
af2392cd19c741686dfccdb4aa31bf2e

SHA1
7928ab2373642ee3f94c3bfd4ee217ecade0a6ce

SHA256
9297d1589ad0a2496d37f144c8cb7c9239276ad0448d4752e1bef3829e3daf6f

SHA512
9b8bcdde62ce5ccd2f1a0a54c3eb71e5fdfe1695722b263eeaf8b8672ef6e95f6d1c2cee8cc0a63e11685d4c16b17f1ddfca7195febeaca68560ac3abe14f70b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2e5d65dcae00574e65f009d37da6a69a

SHA1
c2e53da32d61baa49a8e8e8120cd224a34508f6b

SHA256
f0147506d8289b867d99839fdf7634950ab18553a05b0d6638162b2b4400c4f0

SHA512
a0a5af72e864305c1ad4bc15669ea2172ffa679cd6bfaadb1c01decb7d344df7901243aa27db7f4dd650a75185422555069683c17c94522ace39ad5748ce21f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
17428f18362acc256f69da53079307fc

SHA1
59f52d3cd6f20877f1ecacdf2c6fb6ca269d12a5

SHA256
85525034b39bb195040dca1d3f703c3353a2b0f20aa5cd913fd72c040d55dc05

SHA512
18c3924d4d4272871339bb7c14b25911bd8ab1fc9be06b36f41790cec685f7720fa875bf75e77b419090457d3c8830bb69940eac38e19a7c54888328e8f55858

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3902fe9bc11b9351e0c000fcce0a2103

SHA1
b4c20b88a434e4a32bf38dc506b33082bae9aca9

SHA256
4363454eb4ce96a328079cd9d68bf1dd3a6db376b67288ce0992b34d48b9a69d

SHA512
d1eea3cb4d969868618fc1e12f203088038ae2e239763e3a8e7d6a949b51089211b4f077f580b3f7b8183077b24c2a3b0561ff80fbf29ab0f95b7f7619619933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fa0da35d6b8093e9872a11ef47c3b125

SHA1
06fa19289ab34fd100a2342b4c8b95493209438d

SHA256
3cac70f7ea00da4f4cc4d2b6eb901d1e43f89f10ae3e6cb20bb45260b7ed76ee

SHA512
8f297e384b9124bae7bcda8bc7328a03a69ccdbe997113604920decd4255bc80702a657d5bc60f241f5c65ac589f666ab7ddad7ed2371922963667f82290365c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
beb88747e157e8fafe72da948efa3cc7

SHA1
51303c1cdf9e97def89314650287db077694c77e

SHA256
e46be4e57f2733164c09abba1eb57c452b58b8880b1c3719907dbdda79c7579b

SHA512
a49305b14a32099c1e62a0daaf53aa10475c283c75b535508da7489880db38d99588e03b3be89cbdd124a50174c9e18fe746f474d638d51d6b52740a9a75bebe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3F0.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA4CE.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit