a5fad076f4f2cc8f2bd03ed561f0ec7afb00e78870ad45b4cdda8a547e24ab1e

Analysis

max time kernel
8s
max time network
7s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apk.html
Size

14KB
MD5

24774b0e1ea8fddcba48753da0b6ab4b
SHA1

7aa6fc9030ddc15f90346f68305af6165e45e4a5
SHA256

a5fad076f4f2cc8f2bd03ed561f0ec7afb00e78870ad45b4cdda8a547e24ab1e
SHA512

0b015fdeba4990293a044ea515909e1b03d45f0cb3c175927509f1219bc8208cee72f8ccf5fce2d29615301fabb95da1c891667fc133c5986fa8e8aa78df0d21
SSDEEP

192:PNxyShvK9moqTJkNrv23mawhNCFhUvckR+iWsmHHH3rq7wvDV1y9N:yShi9boJkNz9awbCD9Ti5mHHH7q7QAN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{39342ED1-537C-11EF-9AE5-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2896	1736	iexplore.exe	30
PID 1736 wrote to memory of 2896	1736	iexplore.exe	30
PID 1736 wrote to memory of 2896	1736	iexplore.exe	30
PID 1736 wrote to memory of 2896	1736	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\apk.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6704a61be9cedc383a430323dfd26dc

SHA1
8692f2e15d1baa786c68c35354414407f60ecfcd

SHA256
bb7e18de7e59c2944c44ddc4196b59efe76613f53c04439734dd9cc2e5f803e6

SHA512
171b425fc03b3e7e0fc754242722582bed5676ed85cdd38db2eff533f0036a25f9cf7757a7a9d7f193de7f85c767095d3788445a1267f564286caf4bc2e09860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325a4d451febb87603e01a414d25d6ae

SHA1
bf5e96047a64ec6d75a3b138e17cdaf7e72bafcc

SHA256
afe6c91232ca0e9fa96bb7c25ab4c7e5fccb6e46c5004752c1dede595b39ba9f

SHA512
7e9807c6803da0f40e7b85ccdf1f7252865a71ef99cdc9cb85522f95322d0a5d32b96f694579c4967067bdea649877e3480614fd8937bc48f80137c62e90a3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
216d41f8160579970eabf6d43e43017c

SHA1
31938e5a89996ccf8f1f44b01796b0d9d49aed53

SHA256
16191271a7c051c68fa6ed00489973415cf9c2a1f9f1fc50c84f67282019640e

SHA512
c9e492f49be26a0e5eee7e86d5d679caffb2dcb2401271afa4df1bb74e417f662bd1b670db69156075f8183c8ce40fdf8f455b79edd0086384f8275d585d8133

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d1d5fcdf01f95124234fc1115c5d08

SHA1
d26386ade75306b65c81c280fe34c4d53545db64

SHA256
7f82d4049c6765a66cd978379b4a60e4f3428d98ff20906cdd251d892dc766e1

SHA512
47f2f19552970c376c937f0b641b4161cdfbe67209746a8797c1b17bb098d7254d87ce94c663724e7462342a0338a6c591e536a735a395d49101d5ce5fc4f0f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7955fa2fa9f50a5c2b0d30a958b7d3e

SHA1
5b608693c04bf81273a5d1eef8456fa722da58a9

SHA256
5ad72741db839fe490964cfab2a894b464fe30b4b0305381d974d5f242320d4c

SHA512
5fc02c46294aa8016123714ba5f697c2c8edb88cc47d06cc66dcfdff14607785cc615d668e53b8692ab97e398cbb2c136ef881c3b3131c5aac302682e39149e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d3ec879114799914bf022ad32c7d91

SHA1
097b9d2b6e098080362fb7d4695767d70aabc792

SHA256
b13f924863c4981bea67c3f5e35031e17a8a4c31af4056a3d8c3141464227cff

SHA512
b7f9aae8d8874a001552043a4554a501696d9e8b082a25855286de33bb02f1db0b9ae702ab76e7f0eee3c67ef4b3198eeea2583e406682648716064e9abfe7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd5e1d3a637bf8ed9402bb0ceaed145f

SHA1
6dbb13664be8f4b474d01efe4140efe8512c2d69

SHA256
c4f088caf7c68e32a880a443593a9fcd72505a128559286668c8141291b2c3ad

SHA512
e1d885eabde297f73a1723287cc2b6b7887072941d68f75f598b5df2340e4e9bff0828fb66a6a5be1102caff467dba8d917737ee64cf5cf152bd536393ccef5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e44d8a00ab8939aad08cd8f3b16911f1

SHA1
3687350e102b665a5dc06d715bd8804df82bfb30

SHA256
697458e8858d488bbe431b2bfc18b29ca2e3444b30b96d85dad147956bde388b

SHA512
ee5ca61535d9afcbcd5b613af996e66d8afd18b22fdac4645c34e3f4990b2d4f40bd19bd0a9b0d0e09e0ef88ac0eb96fbe473d57c9452f8c2a76fc08284e1fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f84b7a6581a96b4f57fb9f85b6e7fc3f

SHA1
b15ac0b5ae3b9bd09c8787424e2706b1d2917888

SHA256
af359a0825e93c9317e32dfe6e743ade4de8eb0b49af5d63534c5bd3cc0bf9c4

SHA512
4bd78d2b1953e73ac9542a54d74867b744480ae84f63ae7967aa0943898977253ed8c24886e613035a1e815fb664d579cac6fc5ac6cd2541e63877a1b3f5a410

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDEA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE9B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit