8a98959bd08625a79795b643f3085a26efcb3a0741ca7ec271176592fa8680d8

Analysis

max time kernel
120s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
31-07-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/config.htm
Size

24KB
MD5

62a0a99b746b0b4d5cf9ef7f960e6f75
SHA1

20cb6bf6cdb56750dfa354105d887913754bbda0
SHA256

a54d17b3e3954fa116fb663f6520bc63118bc18333fabe480502582ffce9fa99
SHA512

48a8087621481e77e2eca6c31ba2002d53652f6e08442d9bf3c03f76849e5d5cbaf615dfba809236d157d4bb6e59bdb47c3c0185b75001f79ef79580fdcd13b1
SSDEEP

384:MRrgWTuNJE8EWvp6W96hcfDscIwELm4JYRc+6Rc9w9:c/TuNJE8EWQWiQDscnELV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000249b5356ce5de76b8cc479e4095a8b3c7ef98361e3fe649be4e06278cab6af5d000000000e80000000020000200000001b71b74107ee0ca69e339cd65021f7e526ed63611716370da05449bbf9e79c8390000000547511b5e853408d735465d1a897abeecc1c39eae8b9a4370ed035576a6fd7dd21a9e350cde1bc9ee8f77c5d151dae309f17fff78c3a5050d4d6c1dfd85e91f041bb5b3333e2139a2888af2516ec1b9b3a1507d8002a3b8a2dd04bf42e4efd8688846d62739d83460ebb28ca633558a8dae46a00bdffae07173aeacf50ecaa170b82706d42c4811d3539d8e451c9cba74000000049522ffbc0fbf1b6cd7cbdeb6f4772249ca7bf5796b16dd7fd39db834bb3ad5be744a7dc0eb41bcc9f22258870358d882f38880088bdce4ec11c25dd0539ff51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428605040"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f015f26366e3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000003bdd38e28276e412c049cc680532ea52ad99e553008ee7e568f159c656f25b84000000000e8000000002000020000000138a671bf37f358b0c2b9cb5d3e19fc4c80fc94ebbf4e1143824e11374c1a4ef20000000b4f1ae53b0e5a2c6a2f9a9566bbfd676ad3d615eb38d314fdb96df52c0829fc84000000035aa4042a9e05e1b94e8bebd36202719f213135876c74fba983ed0638354e0279b6e1b383c762fed65123c28f664184743fac4153101893505c686c4b59a0c04	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F774A11-4F59-11EF-B96D-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2124 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2124 iexplore.exe
2124 iexplore.exe
2188 IEXPLORE.EXE
2188 IEXPLORE.EXE
2188 IEXPLORE.EXE
2188 IEXPLORE.EXE

pid	process
2124	iexplore.exe

pid	process
2124	iexplore.exe
2124	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2124 wrote to memory of 2188	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2188	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2188	2124	iexplore.exe	IEXPLORE.EXE
PID 2124 wrote to memory of 2188	2124	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\UCenter_Home_1.5RC1_SC_utf8\upload\admin\tpl\config.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e3679284363bc2187f6ea589f7aa8c6c

SHA1
7df5b84d1fdff6909767ead7c859d4f63c04070e

SHA256
3aaaa68ace03b5828ad33bbb697b2bf68fa35e6381132cdf108cba422addb16c

SHA512
7feaa60c899869a9b07e08ddd3bdba72a3ef188ae4a891cfae7a2b1b75d6bcc208e680d02014fc6cf61dfd7460fe1e39acde7fd257d877dec905b56b9ab15fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
5d2cf6647bd2b8a7525816037e90fcf0

SHA1
876e8d31d390782c07edab2f34e1fee1fe4132d7

SHA256
f3b2bee6a6d3b575043eacd56c0e9ff48df5cac7d5d6a289d3c6a3e0eecb61a1

SHA512
2630b58aea9656300f40c986d727efd3a80ede70acec6d61a08cd0e88df5addcc88c033b98835ee2d06eee6d9f32d24c738f75c0a5655b97a583d7641e212b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d16d1496e7d353f661b36e461fb8ea9d

SHA1
6638bc16a5a724505450a894caf41cd5ddd7b7bf

SHA256
1b998f94da327ab54b564fa1dc77d0ba7b30a2da84ecf6aa58d35ab3f7fc1cca

SHA512
350e7e51a6ea52e47a903d803917755e9b659af3a75cbd15bde8bd6057c222044e388103ce441a0db6a7c85cd9766465f5821fda4cb57e3dfbd8dfc825a60b1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
839caac316c76da1a1e98c02080a9736

SHA1
caee43a05d77b511023b27f8c75eda6d58871b33

SHA256
cd0f7da658b540b2e69120f06975c5031ab2429ed31dc909cfa25082956f0157

SHA512
7e6298963f5e27dc3614935548b89295cc4d5998556055f746afa5a18b4cc60fcc0c988ef906329c8d38c6c9e4edcfc3385e47ce3afaec944f7d780778e804dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c9846ba4339c7cff59aa273b0f6b559a

SHA1
bcf9e23ef1c3fdf7e39e06c276815662f4f7bebb

SHA256
0d372bf7ac7f0ba865748a771677c58883f0c0e31ed889cd9869aea087582986

SHA512
49539d4f391ab052d9d3b72853765dc23e03fb9e3545f9163f2afb38bf7a327ef4f446618c786f9857588c3d4d95f566014bd4f3e1de4d4094f32b2ba5d2d3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE62D.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6FB.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit