827544e381fe4215f58f26e14f6a44615799e1b89940f34c97a486f77bb05d03

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4free/Ads/l_1.html
Size

31B
MD5

61d50d9ea3a9b0f697db0cca98674821
SHA1

c0a0206447e88c3613afc70ecca60be1a9376d9c
SHA256

a1e40f9df6732878d74fbe30b1fa1fade12b1b98dc81cd294b23e388079de639
SHA512

c6940051b2595878006b39c4432862cd687423773e9d411945041c515518e9d8d7f1cf8f4f07e6540a6153d23b5e495801268958cbdfa85e14cee2f39c865c7d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1F65881-5995-11EF-913A-D61F2295B977} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429730457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000d72c13cd38f90d10055d3dd5b3d18da4f5b4c38bcb94435de345e893072d7ba8000000000e8000000002000020000000f0f84cb886ac472c741d139615e51eeb1db1317b36ac9bce041fff367c6c602720000000313db17cf2a31206f3adb6ac070d97b6d594493b71b5313753e91c46ce559e0a40000000956d0e58523927d2a128131bc3a90ccf90b7e2b01a83efd5e8beece0ea7d37230a6cd29abfe712035e50db85b4c4edf22a3116f9cb811e035b4dc72b2bc4f349	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000479b6a2edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000a6e57f1dd0e8d80262d86decf83f143f381c7dc40ce91b9336e0956d79facc66000000000e80000000020000200000000c04567969cdf0ce3cdeb4c0bc4a5ed9ef14d75519b1b4e5d7da63b2acbee18390000000ca30035bf44a6ac43cd31b603f771743f45e714d92993b24fca55c01f868b614273640c01fedb73595a618a09d512a4a6c89302959fc1a47d3ab277591d105dce7c0c629403b7f8d9f8cbf57f636c0be160e49dc9957dbc370d5f94f9c99a57de3008761e3d98631acdf69053e305e94b1aa682a8e90a3f1d479318e37f6f5a74a9f9c8cb7498f7d1b3d668de6dce2d6400000008547b93096433eb1b0dcf4961b66b4463c262c6d666fc3b7890f97dda78f6645a5aba70c7bc4cfba5bc82ab851e741c322a438b2bccd491d63e9a114640cd682	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2704	2824	iexplore.exe	30
PID 2824 wrote to memory of 2704	2824	iexplore.exe	30
PID 2824 wrote to memory of 2704	2824	iexplore.exe	30
PID 2824 wrote to memory of 2704	2824	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\v4free\Ads\l_1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b56629393c8ea1e06a4314806e9be7b

SHA1
4c319729aa0f1118ff983ad1e813fe9b2ad8db1c

SHA256
9ee01b1405aeb0b7423114ef898d47b827a85e8c2e4025d30586626a262e1dd2

SHA512
cfe01148bc4d49eae49c6d0c9100d43695f0189783451dcab7afa0ecba6d6519f507e54872944cfeaf5dcd8c16f793e339cf56353d9b4138a952afb7daa96733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02042cc9fcabde9c4b0e1df45aca04b8

SHA1
bfc71effe7018f0060b1fa98619c34a280814af5

SHA256
29b71ae30ade63083129a852f6d53b99e68591fbc807bbae60e9c22cbaa9738f

SHA512
42dd5aa025e16a38ae5613e413583d49444f9bd063afeb97fea92f7091cce1370c3fdfbd0eb319ec63d7d3ad3d4d3c16337e053533d265ac814193fc97cdfecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8ffb7692c3d66e7300e5a6664c8e783

SHA1
23f70385444d1ceaf36f7df2bde237560401d770

SHA256
f37e46a861f89e7d4132337fe4c616eabec311c7525e9d8ebd2b544565f537eb

SHA512
2cb01681089773cdf544b8fde1773de4ee20933062f2fa21918fe21b6504c23c3239e9139d86f891b2e2259171378646074f1f9de275be97d9a963c486e00cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe8c501c1abd2de124ba38fea2302a9

SHA1
6af46ecc6e005c56cec11c161c3012c9ce91a139

SHA256
f955f8968ecb0f7463371898b41fba3c2efec135e76a7378457228f46e8709de

SHA512
aba46af432fc44cc9f564f048e0c3d52e1c083dc9ee815527e2782819ea693d6085beaaef46e873102c55bc2c14afa21b8adfbbd83817c15e8bca70b89963e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c74c1169a14c079d6ffcdbd9314d4cf

SHA1
10dedf5d9e95af8f050765c7dec5eddd8d466bc6

SHA256
0cfcdb824316e1b95b1c683816af4ac635c054d0e51712f9de69ec0dfb45830a

SHA512
efbff161d15dd9adb634f7a455e98907ed6193d24dfc11a567af788d82760fe79525faec7bc5132dbd47c0c7fec488738a7531a648aa3d753c3dc46cfc17210f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc4d24b214d0ce9c252708fb5e74b050

SHA1
269177aa512b07323da798cf631ea76ee0e8a5ce

SHA256
390a677802e03a661cd3c283343f1a6b4138539bd4fc5ef810190a922f64a719

SHA512
327591300ae64a32a826af9a2c0825d915b68e187f4b236ad26dab46745c1ee8a4b96356cef1b1a0b89e67639404c0cbdb4ed3a64ee139fb66d0cb1212fdc12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0282811c3b555af94ec7bf4baf4ceb33

SHA1
a79f840fff413f70c91957259098f6741bb3ccec

SHA256
3cc132cdcedee407b671483a56dec9e0abbf17eb9a08f689749fca0c0d62e0c4

SHA512
0fe2377d468b63597aebe2aee7f20580a89b6f3b9164fd358d75bdc5a15960e95f7b471fccfcbb2025d43e2d21168c6d08148158c48429e20a466a9f1503118a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
660a72900253a3ebfe6685a7be862fa3

SHA1
edbea00535be996823cc073a3f53369831f2651a

SHA256
3e27c3895e900a17867adbb126e68775a9931d81f8918e45a092526cca505315

SHA512
0d4a8f796b109605fe31e77f4195f7d842bccb75d06977e36d42553aea6e07851d7300a4953ae1a17301d60c8f569eeb71cbd6bf0822b80dbc884e4c5ce48146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561b80de4235f7fa4a1a33b5f9b6de0e

SHA1
2722da4a345b107328dfdb3e45a36afeaf3f6eb2

SHA256
ea4595fa9413b1162f7c07608fdf771ee255eed2465a5195528dc9e3c18e8702

SHA512
f3d4d63a1e2b0cd2d79271395fa6925c80cb7b8b06afae02faaf5c7df028be725e0e987df9f1834977427b547cd2699546131462d92f7082aa84e4e1730c38c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33a1c19010cc6308b3157e11bdf54320

SHA1
1e8157d02df4200101825734fe0227ee82681995

SHA256
6e03393bcb2163094d8aa5787944837818b335f0c03f8246f665fcee954b5059

SHA512
f84f7e90b9644b17e4de1fda001755831c7ea13d0e559bcd186e89b17d03959833fca919fa6e7e00bddcd14e33895c519320100b9d2c628645f85ccadc5c44b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1235d69c66603f7132f65050b3d389f

SHA1
549c347d0c5b1d0c1ed9f6c7285a1daf6c72cdb4

SHA256
b5b4fe806549abeb3fefc55db939ced3289650d1d999ba07538970de2a941c01

SHA512
2c57e2975599ab972f0037cca5029d01c2d83335ca004086ca6cdfb37befd0496a46d8c293c4dce91f6ae8b575545ba251cda93d2903c05ab8b82b8cafb79bcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8884.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8933.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit