46a8ce6edaccc04c1c1123ad08eb7168a931b8b161dacdd8e7a7faa3c0ad6c24

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/08/2024, 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/Ace/ace.html
Size

2KB
MD5

9ea3feaaed24c94916fc81753150e654
SHA1

40c05dc617784b9e05a51fc63febc9bf684b650f
SHA256

d9fa6f0596b11057cff5d08d0df2e83ba6e3b0a4d83ba1bc73235f6b4b9d8b86
SHA512

3424a19da7f40874f80ea357dcb553189568409b587ae2b60c4a2cabed2feded92b9dfaef751e0b4705bb15593522fd6c60e97b6438a0f75e33ee91d0849a3df

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000724da0222cb879d10904e0637dcec4fc2662285becfc93ce01bd0d6eada3ee75000000000e8000000002000020000000a991c1a5f9d85a0ec6a0c45499da23fea9b2d6fc7a200ccee6940af68a925d56900000000e4e650f55059994c5a0071f511aac1d37246b1f293cac62f47cdeba2077c0bd0e7f1b853aa512cdda5be4254a26465082b5dfe615c4558524da6d349e19cb7d23b9a7cbbf87297b80f94b7c23bdea51dd710bbdda09b0fe0d3e192a3f780539a0e161166167a9ee00ae3edabffa964a61f3470b5c7b4b299628c69799299bcc90ba9a76455861c9640b815a6320293740000000194880e1a4642b4fec302cf05fa1b06f2b6a0aabfbbac333981ff25c2cb0ec52c1e12694d74ee14d5b86a8d9cbe8bbe4e6900aa652b4b55ef74a50a5d7ca27c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5273501-53FF-11EF-83D9-4E15D54E5731} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429116295"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000007f5614aa28a420f94e382c39c9a26011acb7b8f20e837d15b12594ae38b1f0c6000000000e8000000002000020000000d6ec2a2009896d44cf548b02d0f9ff8cdef4a54c6d2ab8a2274f3dedb0e7c45e200000006d027a9eb084a5b84654e5565fddde479363915a8fd363e99b4ed3e9b2ceea5d400000004a86425863309ffd9df4d1467c7a5ff1bd3fc94e44e71d0015a04578271b1bba835bbdca5c5a79b98ccacce145a3473fa02509ff52143c1f4bbf9710b37ff7f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07490c90ce8da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3008	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3008	iexplore.exe
3008	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2696	3008	iexplore.exe	30
PID 3008 wrote to memory of 2696	3008	iexplore.exe	30
PID 3008 wrote to memory of 2696	3008	iexplore.exe	30
PID 3008 wrote to memory of 2696	3008	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bin\Ace\ace.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6184c292278d66d977b9d46e62bc55c

SHA1
882ac7d770db731c4a980b06cd8c9ec76d6f53a5

SHA256
b7cd40df27c2350c41a17bef5e21d069dd64f400ae5f0be8fbfa1206f47252fc

SHA512
b996107fc143a45c0937af4db18f2654a9b3ca37a2dd8c72df3ef172bddcf6ceeacee8bdf11b7cd010d1a9f2d6b28d401c8ddc1af83a7b6c8de1b9a3efdb3a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d2ad030e9a7fe03907a7ee1dd7de1c

SHA1
cd8dbd3441933115653d588752167debdb2ac7f1

SHA256
f7f443f603d8f7ee77c12673801cd436709585a6d587c723f27eebd2351ea054

SHA512
e975375a79e8d6891a63fe39ac53ce1c996e20e2e8d745a88bcd8defb99ec111db8c272b38c50221f82b55c7290446b16919bcfb173f8ece7ae1874b459f319d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b07ffa514dd677343fa088711d4efab3

SHA1
5406adf5161d5cd0af6b09c886ef65b7b56fb734

SHA256
08240907ccd061c4a4cc70528a72a1c30f0129aa75824b8090120d2a450b4d46

SHA512
8748d38b5d029a8ab1603edc589e611c4e1feccd2188b375caf6fa2d847d73551ff31c861becfb7f7a3737a74f8dce056dc27c934b4e10ffc98b2c29b69e3a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e043a373ed131359d8b2f5e9db0e29c3

SHA1
fce21d93d2e5e1b9d5453ab15808e5f90f8b7216

SHA256
08138add3bb11b20adbae20a50b1f54dc8093a20b8122694c02188fe33545cde

SHA512
bc00beb71fb090761118b35441347ba8e426931a7b374bf2c8e6843872620afda73596ff67f625bba69480aa4a62e2d9bf3b53d640d78a24a3e525b09cc1bc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5142278e166d596ae285bad98a46d0c3

SHA1
2bd97b11634c063c4ee458fc020cd791242ffba3

SHA256
06eeefc620ec5c555fda856076c5255677b2d795ab8e36a84dbe9d897e3c771b

SHA512
9a16e44a3249e778b1cc7e534803804c67a4e02eaba6d45ec774622831000e822c9b2f81ea4dbc93fda49950aaab8170c60ff9951e3d0a2b63ecd36cfc7246a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46d6e14d39894220c2b843a3a38a42e0

SHA1
97aab49fd8de12ae1122017a48018096dc1d68fe

SHA256
5a108dea9a0b0612525744ef8a5db9b39d7b274e34cb78c2e239146783d589c7

SHA512
f6b33a0f5609fe0bb79ddf3bfca0b31ab80bb7b0c00741b6828a4682fa9fbbaec75301821b1c80ef5623e51c47acf5a5de4a8d05df7fc498c53ac0fb047e80be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3ef894d7c583fbc3640a002d5905d2d

SHA1
dddd18912588ad3f94a2c242736ece102ba16e36

SHA256
28147da31a78bf21dc69899b5b9a37e64ecb21dd7cca89402368e64b24b264f7

SHA512
c5a9502b911108debe36d17da915dc0a98763c6e3f9d477161beddf5edde3d0ec119f344f13e221da54ba0b0cb15de5f3bf2e885144ddc7dab113ebf9ea3e8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65719d1f6e19ceb53f45232eb69b739c

SHA1
a6cef492d631f1342b47516b6c89b9e10b095998

SHA256
13aba79107b34e18262d5baa2ce54203a402cd5ecd51d06f8482050caeddb107

SHA512
abb32eb444ed4abdadb98f0da0a942fa42b53035a9d7120b75884bb3d487467608aa5467b920a0fb7c48c8e79691ced9d1eb93f1123af338e3d85a13c8bd210c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b57323b1f85b620c5f4198e40d76188

SHA1
3b392c1b9c45217b290d8db7d308af26871fb5f5

SHA256
477eb70c0967ef70b2c701f0b4b7304fa3cd85fe554588d07a8a71c1607b7204

SHA512
5e83697d6a3b73cadbda9276834554f785c066cb620ebf89dc39ea7fa7017bd87ced91c5795eefeb759329c9e07982720fb0dd14824ad07a6857ffb6c3d6fdf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840bf2dffbe1a6b2c5f6c2e9f70b1348

SHA1
510a086852472910b0a9689b56f2101310b73293

SHA256
3b4295b0f4daa8df18b1bc1ca67f10925addc9d43ccb628ed461d833afeefc8d

SHA512
1b674aad03d19caad2edb80c1661f2ab37d6b2298e0a0131a9dd531c3b181ae66dd803894d8da045389bffa334814b84f4ee6d44e0f21c4c9716011275c40a4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a39710b752344448cd595742a112a77c

SHA1
189226434ef0fe6c4102ed0b6a36e90315add305

SHA256
266404249e3798e309df84f92475df45196a3e67f40e3213e6a4c272726ef315

SHA512
b27274bee76708c835c38914de8216740686e45b36d5db01ed0c31a3a6e61013e6bc8e8bf5071ddb6e7505ebe0f542d680301da60b98927b3d7956634f12af32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1e99aafe9a1eff1ffbdbe81dceb2ca2

SHA1
55dee28f2c0ca0d203279d56b47c75d19922b179

SHA256
e5baa6aa0fc8bb3f2164b94b564d5b0f7dff34069e0478138ded6ba254fad825

SHA512
18c7d26b4688c02d116eb325b288781ff6f1156e2ce3f8d26c811bca3b5d3b4c51085281e20cabd2d2d93f6d4d62821aac298d7965a4a3e85b13e94b5032fa1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa5706dbe0b942ef751c40f9a3fc7010

SHA1
14ca0e5bf12e71694807736284718153fe202cef

SHA256
5620c292e2cef7e767316ba9ae540bb9c799d5700e74bb432ab70ba7558b8976

SHA512
9376fbdaaa10a50188bbed33b51e81236602cf2477c55b6df88c31ea3fb80c11c16b79be09f6bb7e3409c3b693f9fd926c58e80d0b0f05130405d02bb77e0266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c6844ff09876402c9aa127708242a3

SHA1
cf6a23da6af1fbba9a94f38358a385be2c6ed3da

SHA256
935aadefcd9e8fc6a8adaf004ba9b7e2b7aaa640356154b36e757ae99821fe10

SHA512
7ec57ef9cdee689c524672207a3aabf5e9c3cfe9321a39af0e4083044b9a80d9fd8fa98026d14753b219f89208acde8a7ce3b41db14c80d872d265b04c50677d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0da181bbd4359b75dde331303811b4a

SHA1
9b4f9bf64e8bb7398b99ab9767a69ebb59841833

SHA256
c2be59628248bf599aa8159665bb0437c2400a5a83aaa933cd47bed598ae80d5

SHA512
ab9aa5f08ce544c168c9d1fc7a0d20130c57cd65b07deebfd423933e2e0d8193e8bd1e17117b06707c8ed7a96730e8bd751e6f8ca00fb5f2ab85bd3a66a7d984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a72370f7e67ce8386f32a6d61be939ea

SHA1
e9c050479b85a773e675b739e24ae067ac0a42f9

SHA256
6d9af502e038549106187de70fca1b921ea011033c46b1c5e402c37da48a8257

SHA512
2aef4a3e6cb31bca36470a65cdb43347778a761447f98d85030f2656021a3a4805ee8b39f858ad739488267931a75f69afbb5529df90207c6567655f3be0e455

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DB4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit