578993fcf8d57252bc34536c01dc853a374e60def68f60b2826c3de0826ea00c

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www/index.html
Size

50KB
MD5

1b24d46748fdec03b31a48f859da9742
SHA1

5fadaf1195f99fe59c2cfe664027caba57103b28
SHA256

c0eeec86ba2a127f72747602f8cd8b60cd87aaf8dd7851f98d6145a98ed97ab0
SHA512

f8ab283014fc4ea5b858ee8d41898bccb05649c0cf17517ff5a36aa71f0e0668df300041636cc879c5c8c3c0ec55de7c029662596ae1247485d022317b0cd989
SSDEEP

384:nIe5xaPzFzvgy3ur4qa+MDP16NEqmXIhNroSMW/L:IQIej

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f6006f41e5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428809052"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d546067ae0b9531519711da30f7c0384c5a44ea751961758675d52bc285c3fcc000000000e800000000200002000000017ec9a9ae2538c739544c0894c67eef65d8b99b9e319e6bfeffba6036ea581c320000000e21e62c2977713dfb124498999876e5b0db7a51373881c34f8f59055a011ec2140000000905d801f4501f9003b837b452d26a33782c66391935eed7956b85daa1ffc0f4608184a9ac37be2c798d23c7d81e0a7d9493e020fdb1fd943a99632b9c9fdae7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99A30E21-5134-11EF-B8DF-E649859EC46C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000ebf57475ab1f7afac11181be11f9bbe3476fc7851eb2a66d568e6f1d1d3ca64000000000e8000000002000020000000524433ebc388488ae5c7aae2d0ee6c914a34221ff86fece485b2bf6b545b93c790000000c55068de49504ee1667bfbe630e20f6d49834cd5f166febb5a75675a936b34b078445181cf87eac92345b16f5e7bde9b31b9d6b36400b1a6536bc7822bad236d9fb03a5bb286ba43fc5aac42d322bd57f65a07d883d1326b16dba216605aba593cbcbf8ff7f111debfbc3adf0d0b3a14d40f50a8ddfee1241a2e56f7f886a3dc79e47696100a52e106932f1d46c49cae400000002cd18ea7d8568b6f15460dcc2a832b6a0c8b724f1e128ef88f844bc548e16f2ad706c0d37dcef9d3b8f8e20479f0e2ae933239f4bd09e21637ba35abb36c5edf	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2304	iexplore.exe
2304	iexplore.exe
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE
2016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2016	2304	iexplore.exe	29
PID 2304 wrote to memory of 2016	2304	iexplore.exe	29
PID 2304 wrote to memory of 2016	2304	iexplore.exe	29
PID 2304 wrote to memory of 2016	2304	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\www\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbdffeacb6ee63fb138c030f31e2bc21

SHA1
b513eaa3f6df2ea0577fcfc630d1bdb26b25960b

SHA256
df7cd4c9836abfbce81b54b18e5dae7d1d9d585f2751ae817f3af00b77a667bd

SHA512
210ff725435b99ceefa0325590cd8b5c99a2f16e7517774203e5af71d5c2b416da2905b24d6848c1a8ad2242d4897d2f544d4461fa4f49e19b69ef7f73ec3fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
274001886cf48f6a15763abb0a7ccc87

SHA1
0a38c441430e1e541d5eb1a0ffcd281faea4963e

SHA256
49d4a33fb2889fbd035516978192ff19a2990ee1610902ba4a7b1fdea40e6ac7

SHA512
fea63091b122664c5d791f9d09b26fcf093bc90fc1661c87d0b247f54255e31c56cbfaf0725d76186043c301013690982373aecb954e36c046046d424b987509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b21d3bfff97105e2f8b14da261e4b03

SHA1
5491c6690aa12a0a8820bcec3dffd4f87a38779c

SHA256
09e32bda8698d797691ff917a8f5c35225784c436af4ad0668468c1bb2a3fac0

SHA512
522b7757220def4d45b082d65d0e93164c398ff829d75d0a44060032f5edbd081919622e4a4ee700fbf1648c6d80de1deecb8cf61a75f0d86f6fc148ab4e28f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d70a2779a9c995fa59b5402d455e933

SHA1
264888ecf0589a29554e3ad6b82704671fea6d0a

SHA256
309e6eb100f94d13742c76f9212949cd54e339b876fa296f9731706db203a042

SHA512
bbd074497773562369aaa8c67ec8054e6249dfbdb942dea26bbcad0c68944f6ab27aac286f58abee3bee4280b5157589bf8a3a95c409651b133bd221ccdb745c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6dfb5f7116f23d3c33f89d2ee9359a2

SHA1
7a1b73e10af264e59405ee4b99e12c8e0eb55e7f

SHA256
f7589c3d51ac59444adb30645f5766deabd3ddeba7b21fc95f4be88c7d16f2d8

SHA512
d08a65ae5c107ed0ef67df7f0b70b42a11c80bbd238ab6888d082712e2e7f8b728b53b57617c907b58cece79108e54c169eba136ce30dafa6cbe9f37aca7934a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
921f377e7d4bf4f20a0f7ba1bd4dba5d

SHA1
153e8071fd1b63ec64c5405dfd6d7825201e66c0

SHA256
247fa1fcc8e080965db726ba2f5811cf78263a63afbafac94f79acc082b78fb2

SHA512
840ed27410cc466c75d2869cbfc58e5ed60ed0ae951be0f03c97d50cb14b004d27b258e1b4d20973a61d4e6ba4ff71b5ca6f4ff67d086848a3bf48d2998faaf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0285b59b691cad526648b9077705061

SHA1
198dc7076a0e88c213eb172c6f0e288049c027a3

SHA256
cb42c60033fa6917f7c43fda12efd1d82e3f50a8c785fdd14d915f13456d7ced

SHA512
a8086cb391241ed75491148eb714584c9599407152f229453a63a43521fc91acbc521b8d204be975759d613ef240eed737453aec1a5282b45d6571b4a255bb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
843102bcff9f88900a9fecbcb49e87f7

SHA1
c285d4852602ba136326436dcde1524c5ddfd9ed

SHA256
794d1f5e252c085868bdba7fac56125670842149c0aeccf3cfef85134f5529f4

SHA512
f73b19eaf4b886f2737437ad13465541424bf4135e039e654455fa82d880fe91b321c477c31e9995c26b8e09ee1ec4a1b3cf1f05f66281fc7631b15038b7d1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21e2ad1000206e599f7886069ea3dcda

SHA1
3216bc4858669445fe7a581e7927470951008dc0

SHA256
4a5147fd6b23cada37415a6b9dedcb13048056759eece9820c4cbcf29dcc97b4

SHA512
90f020db106a57646dfbed3d63e65afbe4848774e15303cfebfde17f0eccc4bda3ea6654ed37c260eb53b2fd98e54c5897fe1aed849b47c0a58729e5dcfef9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81bf59074c21de094c3a16d580880b3f

SHA1
7f0cfbc2807756d050fb5c9a2ec5495a780fddbb

SHA256
de5534d3a556c0728658577766a8057721c38f705873d13fc8843f7e237199bc

SHA512
a5d971cbd097e2f47ba2b5b880173eab58c0c3122a8e61070b0fdef3eb263a93b5bd1f3e0fcf9e655779917fed5b53d06754f6dc8fb76225e9a165cef65733a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e23947cf966bf86c04d925facd44400c

SHA1
2d4d2fa8bbd06217c59f8ed8a7697c79b1790e17

SHA256
d2056e19fc7d9d26be6683cdca5765eea9c75cbb16ab8d1ada7ef4bf4706e266

SHA512
cd13455dc58d38f684524c2b6ad98e604ba39434c02f23e6b2939a47e562dcb956d35b56a9e40576bb29fc320fdfe017b9adce41da7c6a74b67bdd428d2cc005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6127762f772224635644250152ba56ac

SHA1
35be37cb1fb657d2047a469332c1a888b77a983b

SHA256
b44f1475b3ff145186b8b72e18245a75c2906adaac29f7f4818af71dde8c28a6

SHA512
7af6414a21f671987895b615dc7f428265b1f411c01833685280121c970d01d2f8a8c6c255e76d0c54ddf05d4b012191fef24025bbca306f7a28cc1f059f5649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb476d074079c67f284c1adec08dc69

SHA1
f076f4973640a796c4ba0bd47722e537fba5fc42

SHA256
1681b6b7de7a5a7bca549c1ede890489b8deef77c61675c95ba95e7d4db92c61

SHA512
d3591f3b9462fa594d3cda0e27fcfed36ed42095b3bf8ac3276d1328fda90f615799d7a5326b36dd05f784802a4c69e4c1fc84941250b92d71640b93a062ee84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1575c229cae54219a075b3379a85a46c

SHA1
2e2e0060861db3e0e219b2b2bf686743718ba3ca

SHA256
216eceb09dd5487b1ed3e3c92873f613f6420632208581ee306ffc3ff13aaf1e

SHA512
c1d50aa995a832268c9bdf94e2d38299ebc6ee5b4c5e55e1593c68c21c306a4f539e10590316c7fbd1960988d7493865d65d128e71bad287b64bf6b207d27e56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c7f16919418bcd945371e21c7e3189

SHA1
868d4e060f7e90749fe933044d595515a74f4e06

SHA256
24abae8fbdf25fcfbb543c0812800a4c6d53ecf513c45c89879a0f3ef3d95b58

SHA512
0c769755ccda2d6c7e9d8d31e8d45a22a39a4c419dd9e366971b421958174edbf673bae84bd711a9791fa3589fbd09b704a19190fefb9b687c909835514b463e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbad3b3b35fdbdead008348b8281aa4c

SHA1
296e300d69b95b3ce133d4a4ddc7fcbdc897fb06

SHA256
31592fae17db47920af6f962c382842ff5c1aa6889780d98baf3feea58a2cbc1

SHA512
f3330fa4c261e496e5add7ed44575b65a247ede376bbf6c93027325fa0ec0bccd84bc01e16b8c5028f7a13fbe7b729c7fe22cbd14e06385a7124cb4adf3e4309

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6eeb9c26374a3d241f06f95e14c055a3

SHA1
25925210b7043931f345432ff2ffd426b39b3d4c

SHA256
761c007bf1c397c60a9a36c5543e8d991ac678b0523cecd3ab3a57e8353d1b37

SHA512
9f42b0d993e246e55026b395a315c1aaa7bc132e1b9a9ee1c4275764c829d9aec7838d0ab7ce46266f60ccb205f114b567f5a7979a9c19f2f65047bc84f8da39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FD1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar408F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit