41f8177b4b441a17e91bdcb6f4d95cc0673cf8e71ee522f30cf5e4a44e28b0fe

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

page.html
Size

2KB
MD5

f64f7923bd43c2a7343f057f3a85ca3e
SHA1

c62d8851e180dd29edc101b6b0c37bd80112de1f
SHA256

f5af2c0e423d24b091a14aa774189f9a710de1f486d405190d668a968f99b66d
SHA512

8ac06148996d7da59e3a950e20f83fa17ff0e4ce288d4f742b781deb9ce5ea3fc5dd9d71e58e826d9afa2bd2cc4cd7556a8cbcd31b7840ed2c44377af767a1b3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429480941"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d4bfce012f0c0ec27d22abf23be2232f42da0eba8614fb72ce8eca32dc3833b2000000000e80000000020000200000005c78a8f37ead1afac4a532f57876d1008b7428eef2444d84ea209e85ed4c3ac59000000077f16a2f1cae354674fe6ebb81ae8d29e35d4833a2749cfc9d78675688248b5d70634e303be8bf12fbdc3d60682045eb2b6929ad61a631647bc1a4a87243c3dc98fff498786a742c27d9b766f0953cf2382e63177c929402b410ad7ce30faf10c91c73808f421e343ebe155fb80e060fcbe10b756ed47cc6ac5fa86bc3189f4d4bc52895f02846634418d8ba91134eff40000000c85fd586788d3de74e5bc05cde364bf183fa1804055c804f8b4c88564c1cee50a96efe27cddd7461ad41b2723c13c02e40ef96a9fbbddaaf26f2e44baceecee4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6F4F6C1-5750-11EF-A207-6A2ECC9B5790} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000037dee56c3c374318e56a42fa05c6538db9e000a30417e75549d7c7a4c1cadfb1000000000e800000000200002000000068585d4eea4cc0d1ada066766032ff325430654483faffd1518e99ef2168d879200000003b17fd73c68bb3558877973abb53a8ea15894f340fe26e6e0e4b8b7d5f5c543f400000009b4c060ffa6acc64284f1935bf60df707a4413f3eba466f230cf1fa8ccf70a00ced9ce5b0ba97a5b79fe35619b136a488dad8fce22a2be912b3074a7fdfaf3be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0807acb5debda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2428	2384	iexplore.exe	30
PID 2384 wrote to memory of 2428	2384	iexplore.exe	30
PID 2384 wrote to memory of 2428	2384	iexplore.exe	30
PID 2384 wrote to memory of 2428	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\page.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ceafab7113a1c8e0659d57f2b70c60a

SHA1
30b8a6303454f77b942b81ab416a584ea33c1335

SHA256
867d015e40978ed6870c79d0ac06b9f970355711843766992d880a051028f057

SHA512
c531379c7e12f697674f533445ef29364989cd1efef9e66a455660abd95177e83e0779ef5196c51363386c7c10cb159408431aa92aedc0fc8b06a9881dbc652e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2098cc7a2617ccfb6173feb15ed11d0

SHA1
1833c63d911f239017a1d1beba4da0f3285be1cd

SHA256
e663a6117c8c02ef281af189f5278828fed2eb8fea937387927cf1c082fb0203

SHA512
bdf6de7666b28ad4c265733d03aaca3e782ca816b46e410c55b4bbb1f5f7eb00f3440b9590dd4e90642836b33bdf0439f05dbb6f79c1f0a68e7dc3e809468d40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa44836cf54698f031567d4ca2be301

SHA1
157905e8e80273082e9917aeb1628681029ac2b7

SHA256
5e9f94c5e16269fd0604c208b35b942cfe500ac8e7023cea1b752beeff172cf2

SHA512
d611f921baece4dabd41ed3b7b5bf261767f1f3673c37709396a5414923b40ee195b97c8506d616cb0866923ada52b9622c1595b158573840c599c0916d46bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea1d1eef98d36b7481789286ab5e3bd2

SHA1
39679be3a3468c36c7ca5e27347ae0e7aeccf881

SHA256
0ba24013a31fcdc993f476360326114fcf07c0d3898648f688596c1b686b4708

SHA512
c2366f94388bcb5c0a1b9f468be9c475b6a3c704e8c2f6bb20cb8f952d685e70f8d68859b30e275bede375655b56672d4536085981fcba253f867f5187d91b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
046a632bd5e595f5d3d4f3fa7b787344

SHA1
9944f8c3fae90d50a3a96410271907a1c41a9be3

SHA256
82770a634ba94414a6860869ca5042cc43ae846b616865c24340664e247d2825

SHA512
4eeac9e9e0aebc0c0f5665a6945f34b029eec69b34b016cebe5b1bc57afdd139d47c1a5973d7b731a81a07293a0ae6a7395e07cdddc94815d59473d855a748d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55f44cd318b189e1a447d5238745004

SHA1
a29518cc335bcaf47872aa99ed10a3dc22648ada

SHA256
b7464ecfd7090beac5b43e3742734c2335e74a10878488021a891caf993f8434

SHA512
593b140eb3c52d7df8652b8eecb728241556d92400a92f8080d738c41b75b991b2de482c6631c951edb88ad80c39378f0c067719f36a475b5581ccfda6ae6088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94b76565c827db634b35e49759f2f164

SHA1
2281c7e9cd6ece78e335400701bedb8bde6c6fed

SHA256
d47a86da3db6dc00ae5d918798fb18bd7c015ae85d8fa8c0ad5ad15f60a32fed

SHA512
b373e623807ea8cfbbcf31f7be3fc2d242e12b9d5d4d64fa3f2649139ac31a0da5546863995780d28221c11e7d749b57973efa4af7e488f5feb701cb7a2a76e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f8513e589ba1d0b1271187cf89ff5be

SHA1
a2991f339e80cd78a8905bb749bed6042f90a310

SHA256
b80085a4770f81f9bb5ccab11df15508714e5c6efa7d396d5b7412d30c4e81a5

SHA512
1e7730a3cfc1462f4c59386cef89af31b268b77d9a7a55845104c5668231549d01b187586d70ea012b43001295bc87e0d407267ba3a68dbb0647e0fc3aebe524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b312a6865933f37fa9f806ab57e1e46

SHA1
5f771d5f9b786ce1a44677816668d1dd0d94e6ae

SHA256
1b6621ce6f4c4cb065155ce5aafdaf6828a995aeb27e57e5e472bbca461c98ef

SHA512
84a6ce83716564287e3f19becf7dcbec364000fe342b6cc0125327b45ed6d988572352b584e7a6d261eb4e2d50a7684372d2fa531248a0d207acd8bcf90a6d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60ff135264bd114cbf452a0dc1e8eea2

SHA1
bd0d44e84eebca894ee5d42cd14a8ba4a7d47ab7

SHA256
5b9847d9d63fffdbfff0f48fd239d2e9a16366068b7400969a777189e2809a64

SHA512
44b144871674358f4cc120f17a45f318289279de1d66f5ea3e4a23c018572bfbccbd4f787613eae4ebad3dd187bb2c24f9a165f18171197513e642b7ed71586d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2176ff33bac282a2f7c2861aef065c76

SHA1
0ba9223f07f10effbcdd5479c6b65b4df09608cc

SHA256
359eca9cc831e907ad326307cebca672c4a8cbb8adae5bc32ff0ac8f0fc7607d

SHA512
b938b80c06039e16e669718a78d493e5e989931ee0b12c1fb7e71e9b36151ae83f52f36663c6734d59dcaa0cb2cfd05522d4b2c16e01dd21833dbf5dd9f3fe95

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC4C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE102.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit