827544e381fe4215f58f26e14f6a44615799e1b89940f34c97a486f77bb05d03

Analysis

max time kernel
122s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4free/Ads/b_2.html
Size

31B
MD5

c71108d64a400831ec79b21968e72d67
SHA1

ceea64109835a5d8a86dd1b8eda2b902b2defb8b
SHA256

4253053d7cf05ce8f54cf68f5e788d14f884c4fe5b5ea6557c8f55e7fa575ae5
SHA512

09d8e5f9d10022a7a5943121fe133d4c905d4a207e1f8affd3a73858d5a4cdd3353638c2bd45eb411aa799697a3586a2692aaa13d26cc0b9ee359a5d3aa780fb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000819cb3c2506fa7ef2ff8c383e284301b38b40ac1a60df2a1e63d5ca107798ad1000000000e800000000200002000000072067fc13e705db8a2ab32b88b068b951a0398afb8e818e64343e7fcea81f56120000000c3bcebdc5baa16728f5bbcf82d28bda2248beba33bfbb2839f09158d95475ca640000000f13f6d7d6e5c2901516972e603a11c06d50275d5705602021bd0abf2af0fb23d9817c3821221eb16d3fccc0b8c258e64a5d3f8c1d1b42a970c7092f1ef74c6ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508fb8b4a2edda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000000e611592f0ecd31dedceb39e9fe9bc1c006117d24d83a3b36e466401a935bb74000000000e8000000002000020000000652747c3f285074bb34dfa21526937d5fb1248e9714206ab216b315ec7dba98f90000000a74dab5e2815fbb671bc91f7df93b26590f0250af0a2c3ae67c7b7a28067d2dae4d21849aadb7d4e8d3ad2b2f6705ae5832779d40a5a5e23ca1ac07b62b532f37af012e802499d2a84f3fc080b603983644e5d4e79b3325c00fdf2627846ed4841fbc8b43cc6032d18fe190731f9b816032af310d0e498f70c59e39071f89b8916fe7a4ca1a270b7d7470c7d0df3819240000000be8e18f2686c3f042444661589609e08607d81626d23280560fbd0473d3c4aaf120d1a05676cc9d50905d46f0132cb59dc408754c1067e0792acf5bf4d23de96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429730453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0478F41-5995-11EF-BCCD-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2416	2256	iexplore.exe	30
PID 2256 wrote to memory of 2416	2256	iexplore.exe	30
PID 2256 wrote to memory of 2416	2256	iexplore.exe	30
PID 2256 wrote to memory of 2416	2256	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\v4free\Ads\b_2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff811023158bca890c437ac2c6aa2b14

SHA1
43f1f63a208183cfb250e3a7202cdc6e5253de64

SHA256
7578b5439ba550a404906248d456cae6ec7ed9e211e0869a0bd7bbd025062aff

SHA512
7ed4d6fd5a881d258ec27a1e7a315dac56247bc27665df959becfa1cc6a6668d7e33170b08731935b9de14166723565d84e9aece795e2e0adbaecb36dc2a803f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d457334538b0cdc464fba14b430a0434

SHA1
9c2c5e23ceac3f03a3a1ede682185e3b127a3b10

SHA256
8bf4dd0aae3c678b23c2780c0e45c96061bafe20dfe873f77fa21967b3eb7056

SHA512
7fd950c0f6856b95b4a114573f00f873354bd8c1714d99214972407f93874045ccaf93c761574875d89ff1234d87525fee26f729c5f1eec133449b269209fb09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26918a5203454e025dd149fa0863f570

SHA1
ec74ae3f1e93f2ccadd6ae47705c27e1b1b82ab2

SHA256
017d04e56d92c5dd522ada673100c241ac8238cbfdb06e22b06515b25ef03208

SHA512
ddeae2c4efbfc81243fc5536143e0febc36319c3d7157e3942694499b13d2bd09e27530efea9e423433a7d1929ff6915f2701a9d8c2f2359d1a193be13c697c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d15a6ccb084bb6626e307a598213a1dc

SHA1
b0e7d19b739c51ca37882b10cf4f0d89502a40a9

SHA256
1a7afbabdd66d8e854885f7c3e5a7babcf6df715146274eab3d2aff5edf59959

SHA512
55328337ba56ea2330a45f9b090992c5fed73f4aca0dc7bd77b215fca49beeb934b467f998cb0394416c910a793dbea28eb66c7f462a9f38ac6cbea717a15574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50a1f3909772293b27b40d7a635614f1

SHA1
1a039bc940d0f3e4c5525904a30f722142a82437

SHA256
e089a107600d0f0eba8d6a881d5974f3727937e974b48c7b83da144a162d4eb3

SHA512
c4c03c0946011b074b1e51f506fef8a974dfd5c7b9e4c89729ae4ba2ef79ec3f853dc1305c9138e2f49e8c6ecba4b6297b9b81965f6c4c6ee981c7b1e2fdcdb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4261d9ef44e6f35ca0e498183aca131

SHA1
1fedd21b70451b1b7b24349fced5cb1fcaa92641

SHA256
8329e7707250952102a286c368fe22debcaddbd8131e774460431c4a3d588fc5

SHA512
de976eff32fb22f2b7445b8091b6fdc3d3590b2b5e8ffadf908df82f8bbd4bd7f708b2bc39baa45878bd9f5066740e59959117cc2f59dcc5318bb59c521c22cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa59395a31dcc50ac95049f9e7618fc1

SHA1
315df28c4e76652fc87d5117df80c6fc17800748

SHA256
76c5fab0a56c322fe9401492544181f9d0406d078efa2b9b76d093e416ef9686

SHA512
ae40802cd7803d2b07b2d17795074b3af458f194493d893c615d409d4d0ee2a5969315565386a3124bdb61a66758f203a9046242a13a4a3a55cfabdae3f082ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b1108f7ee68e17f5cb263b85a1f90fd

SHA1
c1b11ee0d56384a5d56b2125434338930a1b439e

SHA256
26277a9ec6b9e395a6e15fff0a881d77d67b2ffd6283903f5ce7f6392b013e3e

SHA512
b04ffdf157335f8d2adaa5c20d564573bb5bf43f985cc94013ea95ca993d449d0b13b6eb4172845cbdf9a62bcc615ea8e865ca23b91b03cd1bd8d91e2bed9907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62ed3b3c04135f47f1f740dd8d7c3d46

SHA1
d11c1b0981aa9a80eafc9c7e1ecc1f5ed89b656a

SHA256
64849a50f961165514b3da65df4758e4af6ea11cad5cc398d944216c4c4b7f12

SHA512
2d31a2eea5fabedc107a70436ff4096d555a56743bc731cd3d95be0f90d9c92cd5f56286c7175d0c77e5a7d1453cd59e503821fa43c606493579cf1ab68b638a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD56E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit