8a98959bd08625a79795b643f3085a26efcb3a0741ca7ec271176592fa8680d8

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cache.htm
Size

2KB
MD5

a7cd67d698cb19e62405702207e0b568
SHA1

ab0787d2fce5303c642b1359ada3960a243aca9a
SHA256

f9fdea7b53ccbb08eb6bcf51076a860f5d043c7439eea44afb4a2106f40c23a6
SHA512

276e153935ce1883fe1af1f7b90f363929a1d7f147014cfbc51cdbff6aecc7117cd63e48b5912e8c0820026b221e84ea8b747cffe802d3166b6defd2f48b1709

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91E53501-4F59-11EF-A248-D2C9064578DD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5078506666e3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428605044"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000965384111f84d16122fbd7ceb2b5ff27607dcee4f06ff5977c7f18d23de0f388000000000e8000000002000020000000ed90dc8997d3b67f63fae0ebe54e64ceb376df0ebad54369e7848435d3abe25990000000ff6851b52a95a0f8f0697f722c59273ed02d19dced3ae46cbe22f47cac68c3a40c6459184d5ec1cebf7ce4e791e434e4e48a0087eaa438ed256d2a98feb3bf15e7fb0ff74740e8f883a934aeadc94f407d268ccd0c0a7a563d4fddec0b64448e832f7312cbcb2070b4dba2c31f82c7662bfccf4cc49c4aebd228585b01a45aefe0cd2125f13b5a50a09327745485ef11400000000c2cc458681602a70733018988eaef02aa25417979c00d4554c49298b6e667e1befee4f2d4fbc4ec5df55537c17b4763a219d11e72320cf796c0b05d0bd848bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000142a4102cbe784e0d35148cbf706989748ffd184e26b95926a8430a49474cfc7000000000e800000000200002000000058535d289e15244f576ce631c3d5da5ccefbb8f8deb3b840854648a39140115e200000006bea833fbb9a2bf17ab697a246d57cc2bb177ef00d9f066e63248448802c27744000000016d95c09059da40533d761c0a50a729e05ec500ea8b28ccc0a261abb9c8830dd45abf2335076d6ad1ac0ea8a5feabbc0234eba4e63ff8316706fe01da8743e31	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1920 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1920 iexplore.exe
1920 iexplore.exe
480 IEXPLORE.EXE
480 IEXPLORE.EXE
480 IEXPLORE.EXE
480 IEXPLORE.EXE

pid	process
1920	iexplore.exe

pid	process
1920	iexplore.exe
1920	iexplore.exe
480	IEXPLORE.EXE
480	IEXPLORE.EXE
480	IEXPLORE.EXE
480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1920 wrote to memory of 480	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 480	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 480	1920	iexplore.exe	IEXPLORE.EXE
PID 1920 wrote to memory of 480	1920	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\UCenter_Home_1.5RC1_SC_utf8\upload\admin\tpl\cache.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9c5a894655059a294bb3a55ed03e110f

SHA1
3f54ef57a78daec8195aa561dd29f65184e6517b

SHA256
92f406d29ffa7fd5632524b4d0ac14c7232e5ea8db58dbbded29f7182db78744

SHA512
c584aa5be5f6c7af801f42ef6d69a3dc1ef9b5236040d9bde896661b0b1c75eb415e901ef05789e6de74c8fa2b61351df25350ed9ef55bc72f9054a6b776feb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
98af762fb43774c3da107a73be38efb2

SHA1
2a120cb4e6bcb13d278926d0ecaf64761236e03e

SHA256
d29c7be4db16d62e02d87bf4b9135b3656ec583be6bce67f8f14471891763e86

SHA512
58eb2593f836246099b6753a270ec44eefd9c834bf1e04a9ae385a233862a7d5098ee25d11df03a4d55eb20190bf7641aebb094946f2b3fc19facd7c439a4983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e70f32dfe7211a7c2ee0c7c20b15d3c8

SHA1
91baccf9a3c1b90caac875aaaf0913a5a15c73c7

SHA256
6467e2ea9d6ddad1693777b4851eacd79e4e9e0bf1756af6b2738533830acc47

SHA512
fad7e752b080fd48e4beb1ab4303980e350869af5a24c495a556c63ddf67e00f529d51ef33f6a1cf8d330f8c32956953e5c933980e80e681323ce67b27175734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e5739abc25831fb07933e0ba0906e28e

SHA1
8493b213c65650db9935d8ad600fabf99295f0c4

SHA256
396747b0aba3c295f61765644974f47f434d9d08d31eed14d59b07d1ca10bedf

SHA512
9267e291b8f5916f8f0aedd352e47648075ce8fca96104f03045caf3410b84ac3b98147459f596e97e34ae94d7f0c2504da2db31d324f8ed0c269c92fd7f80eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a59129c5760484f1b8289880524bdd73

SHA1
819db65657a9595eba36620f13d05f73fb3cab38

SHA256
69a6ef70010c60242b618f74eb8ed055b0779d9b284ee2e9149da8865507f93a

SHA512
7c5b9182154abb6bf9f60c36c52ed0694a863b167d08f58665a2a7bfae05eb7f6b81618e96288c8ddf877324483ced91f3cdb491a6cb2700cb78fa1320d348cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
889249010909b4bb085ed8e01209b929

SHA1
8bc2f211bd3bfb01218de2e2d6249b055a35b84f

SHA256
e3e3039a147cbfc3223cf9a9aa4d1caabfffa40c38d65b5c35554ddb7f50d996

SHA512
5e18c5b95c22b7a1d59e20fd55c83370dd1b03bc03f5ffcfa513a1069f2155da591b43d08d2e3f0614640c898987c23aee9d2eb8c85ee6aeb0e56d1be4186dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
65e0131d8a81290cc7fd0ca836e70726

SHA1
8e7dc8b7616d1c5ae0afe8519f7cf35b1c6608b9

SHA256
9fb114c4551213f76d7644c61937b2d5c631fa71359f80d08a9beeeffd246740

SHA512
51a5494b8d368b5e9331471bf957ff7d2022eeb76ff6fec9e2e6c3c6be04992fea72239fa170671221bffaef252b0701e1b4d933d68e691f7ab48f827d5eac0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d7c8ef0cde50deb41c181ac81dc1c5af

SHA1
ffa97f5184d47aa38954ffe85f982a5ca25c99f4

SHA256
0f107cb9162ae9836a265fb230cb859e838f8d3581fef078b4e075aa0acf7fc2

SHA512
27635595d4f964b2562108c013910f9d67b26bdc1b39795b5f3ca77ea9a54758b8e625fdc01bd622b45f4c64a4d5b8560c76bf6753043f538cda1bd3476dd9e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b27bcba780158f7607ff46888486eb01

SHA1
5f4ffded758c42978e7ff1876f542ea1966938d1

SHA256
9782cd641cac2ea58e8f2297fea1fb32f278db2307e0990a722a3b701897c497

SHA512
e008e48d03ce53ed6414c7962bff1f1398fc23728f5108197b150b0b72b6d3c48efe6a0706b3ba161dd826309cb0d099eaac1b91c8a66207f1de41882e0b60b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDDA.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFE23.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit