4cf67ca41cc4bd7f192d54ee62db3fc035c29f22677266ee6eeef2e0941d32c1

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

monaco/vs/editor/contrib/suggest/media/String_16x.svg
Size

4KB
MD5

48e754cb54c78a85dcc9aaea9a27847e
SHA1

8d79b23037deb6586e4954305dcb4caee14afbd2
SHA256

d1aa361f33564e8f9d527a01a66c7ce35d73f23417432e80ddf51f562770ee79
SHA512

f6d902b5c73b59636cb71d4019ff45cb77532bf22aab28a8314697e24a62163a94140c97495ad5ce421c09c26e4bcbfe5a815eae27e945c51ccd80c2ba9c3a77
SSDEEP

48:CnN6wkEX+c9Vlt4AFCj93Z0hDC7hSBnukNyhDFtrJGuG2XvS+yZCahDC7hSBnhKm:zJWFCMcfkCFGE6+yZCacJImkArbbqrAm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000bb7503ca59e935848b0c67af34b7909b9e54400bbb9b1a380e91c85f92dabc8d000000000e80000000020000200000002ce6387738bb0e9435062dde52101c9259523f80449dcd64372d7bcc67bca625900000001c796fa6b71c716c2ba305e35b8907e1f96665a569d601b72efa23e82e68442aaabe18713b3ee13a0cf2f42e2fad9b055d9c12ecafa6974f151a238625f56a13c442994569e3cb9d613ebaeae77705bea6d65d882b0120b5ef36448070fc57b282de2ef943ed16820c32cf78749f8c5675393a835460276cdc6f0fd52fd436fa258879a9a429bda920718780c59b4090400000003188051690495294ef1c1eae90d0fcf66108bf0d950f1a2adf796a16738de238e6ef51ad7a2aab608d9dd8d52add003e36ab684aeb15c26ae084abfcd9e571f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80137cb67ceada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F706A1-566F-11EF-9874-7AEB201C29E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429384268"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000e0c16543016dc85e9a92f8ccdbf79aeab3fc6680cb8c39d8b648ea9de900ce54000000000e80000000020000200000000e1f72e57b4fee84c0d3203d5adee99653c4e162809c50faef7be478a136cba8200000002af389d953877af3385a0656b85507bced23c4fd19cdb1db441c859f5f9ab04e40000000cf0efc383d78d67913f930cc97e2ddbbba19fc9dc1a7253bc38cb0a9b7eaefd0b57a31d92eb9bc2118de98236cc36e241225fbaa2c4c10643760af21e93fe611	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE
868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 868	2256	iexplore.exe	29
PID 2256 wrote to memory of 868	2256	iexplore.exe	29
PID 2256 wrote to memory of 868	2256	iexplore.exe	29
PID 2256 wrote to memory of 868	2256	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\monaco\vs\editor\contrib\suggest\media\String_16x.svg
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1853cfd7eeb40997e5b1c30f03b3eb8f

SHA1
146528df7adca60a1da8696eac85541cf7dbeec3

SHA256
ec095142dcbfa214e3b5d6297628d751e3c1a98a26b7ba8483268c3620b179e5

SHA512
f6e947c5d643c2192559052c85bb543eb060fac6a04ab6b4d41eac3052e371ee992dc01ebcb07161a2202425530482b76eea7a2ac4084fb8ba0e9e4158be3d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e14ccf9bb6110e765c12ca7229de316d

SHA1
044406aa518701f2b15fa5bdc2bf0be7e50f1c9d

SHA256
b8b620878abdbf43046c46b381016752d2649153b7ca622574c035c0af76b628

SHA512
ec4a5ce5325cde5943e68e6e4b2a245f6daa246114e9bc00dde3e4359834b6e070203aae164f2a240669479555b59c6cd60c3baa92aaa25effacf662e0e6e0dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc6605b549330f0ece75f3ae812f92b

SHA1
ff419bf4abc59b0ec106b37708bfcd23fcf27d37

SHA256
7c97a2fd4d6eff4d931a7aee88b76246176a8cecb0a512f0a52ef9e7b2fc2eb3

SHA512
7f6f785ae6e1c85b5b689c453a0a68c07f839ce996a7315e5cd93d44d74a8f09cbef9d5a44bc2a8bae0149ef4f7d6b237dc8d9c1f5dec224d9000a5f035b72df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e0a5c0cf43d22d3795f58b846da477c

SHA1
3a8e6ea365661e56350f9f4d0d0e1ea58dda17b5

SHA256
35f9a2a1f32dbce2ffc96c8a5f5fb8257f922c57d65fbf4a96124427cd035d65

SHA512
5c5d258b5867e6c3ecac6e6d0f2500e72f1517b68eefd3b61e2fbcafd658922d0f22dacd2c0fe1498596aaf81fec4f27dc746e64faecc15a24dc81ee5db1b8bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73dac0fb9a61a10fe1312b557a12f845

SHA1
85d4cdfe80fe0c5f23fe9dfc2864fbde55f2de6b

SHA256
c7aa2a537852de13e6c6c23f90bc1442060e8d33ecd987e13bbf7c5486b8495a

SHA512
28252791a0f46e818dadb8758169d829cf3fcce9eb72514e6b09b7b569933d31018b0e69ef5f61e0c6d781aa268b5da92aa6125f3be6aaf5738b98df108f3074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8459faabff625c737db944e4b778918

SHA1
63b2f50e5a1221cb009d2f6aebf7026fef3ad2cc

SHA256
cd66793b8ceb348a0a9d965239d75094da8bfa03add695de9e1df33ecaf19159

SHA512
cfef52a0044239e3580954ac6180f9948297bf9b73d298c66ae8f402ec4a70512fbe24e320d35f3edcdcbfa73a38e10f1bd32a25c94e21db0ee0bf471a978e57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c594906b85295abe7ed9ad9b8f820c9b

SHA1
619d4e1b5de3f7bb5c9a1ec82b5c27ed4334cdce

SHA256
7da1642efe5bd8c93c3b0f462e41c88c1618518c57ac889232067ef1c3d96447

SHA512
30394366ed9a91f7d546cb5413ae53a400e6901dfaee751ec83aef7574563505ba20c01ecbc97c8eec1441ce219a260fa3ec2303ef660f4a81ec9812914a2897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f392093c1b54c61a47cbb65e83b08bd

SHA1
851b07e3a27d14349a1ec6c936df0b7ab401bdf5

SHA256
5d0f6484a1c0bfc2fd628daa2ae59a964293bc17edcb55eb84bdbb47bd9c6d4a

SHA512
20b8899886063d5766ce7f4aba0f22609a7308164ef9c8b1b4ede00c479f052db800e6dc4a9c3c4cf07d6b2a2bc901a0d1128b9a5348a2aa8500a9fc742768f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2112ce95271077733046dc1c2eea130f

SHA1
7ea84c778704b61c70c5286696ef485fe85e0742

SHA256
898bf4c4617a354c0d0835ab18a5b31d9d41bef7a2abc27e254245209bc80e4d

SHA512
988bb147f73c11d2d3675f1d296203edd58ebcb9f82590bf9bed5de528c22fe4ff1487bfa82be089a16cd17c4697ce5ae47f563954785b3c66bb1c562fc111ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd87bc094fab9d50096900841353a6d5

SHA1
89fd470f73fc50363911d38d3afed779b8bf6c26

SHA256
9327f5793e4ffb9f935dc9205270515e2e7e558533fc94085245970402895af4

SHA512
87ae5526c2060ee26505301ed705aa5da53e626829d467b75be4c6adcb233e8e90d184ee9ec14c4750f98656df967c409451b7db03c75266cb43dad4145c4512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d486fa2c58a8840387538d9693490cd

SHA1
7728123f425f1d6126e292233c3270c3dc9761ad

SHA256
2d4c872a700d83983ecafe8e659acc6e2f821b24eef6047b7aa68b5be64e18f0

SHA512
c543f72ed40cc2c8649977f540728c41c841d6bdb05c91cd27c517ed08e8ccd962db76c003e7e91addb824d9cc33f509d3a676ba40f92b08e4397fc4fcb10ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d42206b91df646eafeaa1af2735566c0

SHA1
624d463d0cc9d0579aff6ba36acdebb113e6fe1f

SHA256
db9b1222a761cf6adfbb2d2e1780aa481afc461b1bcaef7918ded05a50526bf0

SHA512
883d63474cbd4eb975fe9bf2332a3c2e613182f1904380b7327722a288d8bf40ed968f4909c7e12f2c03a37f7c47a1be9cc93b6614d0de743e77e5487011c736

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1567.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1635.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit