827544e381fe4215f58f26e14f6a44615799e1b89940f34c97a486f77bb05d03

Analysis

max time kernel
140s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v4free/Ads/a_4.html
Size

36B
MD5

9a3328ee8e4a0b5d90771bd850050517
SHA1

7f2e3d452b620e7fabd58247449223b9c5f93cfc
SHA256

5023be0152e1a34b5446f8d7cee4d46d47554edb015afdc9ecd1185330bf4460
SHA512

52d25f762b914bc24af2e0ef5dd3f0976b5746d743b81fa71bd887d199fd77c43d9b016e34e7640cbc0a9406e11870cf6af036463745bbaae4b8536a5520766b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429730448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000068787e493e229d8080330cb3e951c0f948d15a76824d76ba6213ff33ef3be99e000000000e800000000200002000000053a5e99a9a7468c551cbe23484de0b894d0c315fa42736be0030983caaf12d5690000000c42380fb9a66f926ac02372c6534ff0b8393b894470d8620b639f9556ca89e69fc3affc21c2b7f01e91653676b63bcc29bd11350ed14e34a4b3fb0a85e41851b4c594c6d81aaaef21be1d041df7d08073e4d85cd7a0db3109efd34f0ea36d9b487c9d979fdc1701895c57307e4676ef5fdb9a0270a05768d704f909ee3262d1a0835efa2bb80981b56e5550536a8286540000000e9fbc485c1ed692333aca50695f50894c7886eef5346081eb38deba15a159bc9e23f5009d55258fd8719f1f4e28f10838f061df05be7505be533c4522720b4aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1C4F7E1-5995-11EF-BDF0-66D8C57E4E43} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c89754e83bad5d081722abcd0f7e8e20c8c3e17c0cf061c8b882e6f581c071cf000000000e8000000002000020000000a3f6407ad0c289cd17def1045df46dea8c558fefb9ce3b713a06d474f01101e1200000000e492fc6d257ed07f2d3d80efd03b96cde85cd4d16dc3b5839b609db57cb415e40000000f8c02055d9e38cd414b8bccaf9645159f5448734266cd5a7ff5aae2d5539f3f0d7ea608274316bd2b45843c08a6f7e8c2f32c1fc2b94b5c7dcad88985bcd0b60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10394db6a2edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2772	iexplore.exe
2772	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2800	2772	iexplore.exe	30
PID 2772 wrote to memory of 2800	2772	iexplore.exe	30
PID 2772 wrote to memory of 2800	2772	iexplore.exe	30
PID 2772 wrote to memory of 2800	2772	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\v4free\Ads\a_4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c8d2655b82d817061d119852aed0f2

SHA1
b37be0c9556d5c58f8add69f43af7a4391c1d0d2

SHA256
2b6fbaf45e664c39668ecb7849032c0d903051a3180b79fe4d65e894eea004bb

SHA512
3bf7efa7b169ae11d47a72bc2199907c89e9aa8f5206518c3306b3bf957c373abd94b3d4b729cb03467e773d0251542190454d33b1e2b017452712abbfea788d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c544f6f1b146942122f720dd35d9489b

SHA1
08618bd01718ce74163514c41ea6dd7a7221ca1d

SHA256
f09d67bb12ab4686a8e4d6d7986d040d964511351562ac6c645c175dd42fb91e

SHA512
d227a54e7c72ade44a4ea8979573ff1dfeeb8948fe641818540c6d74f290589dd408414b3fe66b1622f67ef3927747affc53a392d7ae24a51b356deb72b1a3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ee2cc475369bf6b5e18d8cfcaef3a1

SHA1
ba44d1de3025424b195e9060ab60d468c7f70c32

SHA256
cb197eba07b62aaa8846dcace587079a6c3e1ded207f3ff40ba9c24c3b01eb70

SHA512
97bdcdd61c9d3518895ea8e68a58349aa74423668ebe0a82842bc6e8c617a4667e95cd6d7dbb136e108f415e049363813073e4eb7d455f9323ec3e86ce0a6bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a2f9be4f578a6930bc89683c70ff8be

SHA1
ffad8fd94bc7367e9e6aa7200cb67d051b718514

SHA256
25c4f7dee915fa7e31bb5138a089fcaa96631f8783f06623562359ea112e5ca0

SHA512
f70ec9ef129c702631d6dd62f526b162cdcbf12ddf32b6886b963ea9186e4b32f1107e4c5d390c68b4ff571a14c693d8f2cbd910bf3699c157ae0259b69f27a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2f1001a2504a8f608642568114d014a

SHA1
6e589acb0fc8670163c8505c4be7763b9659b4d4

SHA256
74d9dd1318b481459f7ee9e05c75f51afa80c72dc6b8b701ca5957a2496e6d66

SHA512
8e4137ad7ec13aa0c28bb0ee7c31afa2ab7bcb02453e5704ba2ac2e8202b727ac5f60c2d28705534d6ee8f95bf03789bf604964faa9e96f2ea02d68fb6fbba3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f8cde2e20145a60b7a40bf5111bd132

SHA1
e712b1b7f486687411e580d64c97fba002a45bff

SHA256
2e25f6201d66d2e681ef6c90bd9db42ab084da1afd482a0d2e738cb7b82432a5

SHA512
68dbfa93eeaf9320629e4f7b967d672179d3e6dc8408ef312c15f2fad68df62b23e33ac78af59b6af828fac870c135355fd57c284cc23f0883551efc001ad62d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81eb257205cab151b68eac03753e43e1

SHA1
36e2850bc8e03a02425676c1548590d34934d6cb

SHA256
5f7ed00e314cf4e29642d419d9677aa9574d27fa8d730de24bf4642656310bb0

SHA512
94d90da43019edcb709de6ff1f979641fb76552fb3e6bd0de7cc82e69edbb9990cdf8403058ba19155071c230698348da25209f03fa478edd48d5eae357e0d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595c20b789ce508d3f7d28e7f9ce571f

SHA1
7e484a95d6b6437f36cca46c2e311099335caa77

SHA256
f846bd4dc66a5a1d832534279fc5349793817aabae99d43f2e95292e997943c0

SHA512
3777627a3a330bb5275b31bdccb59e49821c524d5a5e91dd814b2ad133ccc9cae391bfce9f8e6fdb11d4c25d21834a0e2967ded949572d496bd6cfb591a768d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f003fcb5abe68af8ad676c75a68af3f1

SHA1
38ac685f60110c4b22bb8d5b462e804b43dd1dad

SHA256
05b3aef26e86e0d7ab8070e3c034d41d26d757e5791033ff967eaec131f1ea17

SHA512
4b747dd60fa900844923fc494e453c24fb5246cb04a99e40b23c2d4ff7da2ba605444daaa37ea1e4b7d76f5ad979602425ba43df7c86447ecb7b7f877c87cb8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36eb6288717d90df342650a87582107f

SHA1
2b2f00ecbae12a72d6bac56be77888d6375c359a

SHA256
bcf68798755929087ebe25f29b516648d120535a512bd4422676df0f592281b4

SHA512
d3332a200f873167a0d84bb7ec88e2b98dc5f7eb2ed46f0323213d44d29f3010ccfd4f7551183c53d082028b1723b02bf989c34f30a226300e11dd4693339778

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d56b7179ac80d05cc918e2c0eb192bf1

SHA1
97ae3c7151cd7d1ddc75467368732b20172751e1

SHA256
71401e01ed1501f0904c7f3bf40cf3cb576ae13978737f7608e1213493812cff

SHA512
ba629ff7c05b732ee5454a24baf8c37bc58ffe44de10ca074f99dd3f14d81692ec65cd4ef723ed10a051e44093b3aa1d77f75b1dbda6c6e5049213a83f40a246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28b748f26ce7d4f94d160def7ab8ea7a

SHA1
ecc63c6498dc9f887e8afad47197f60f300b0172

SHA256
3260ec17b9263cb3a7b01e44dcdbdb952468282478cdadf57385322e8613d6b8

SHA512
90235a1376d12f52dfd6947d3fcf4842d2d719c39367662369f97b03ca68af85cc5a2e9dcc5a93e5479073603427126d9b431f40ade223262908c032bc817f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2511afcdc77f830da63105df316c6d40

SHA1
13c50a3fc4aadb4e689881cd0d676cfefb6ee443

SHA256
f635b68e834484919b099b69945a5f1d3b6d3a629154da3aca42a0b3d28cf7f8

SHA512
72f2dd7d1fbc8bfbfe0b4ab95ae153c8066bae3b29cdc2395acc82e7109bf2fd209dadd558ede1db8359ef87ae0d144129607cd2c2c6d351acd19bf6e485acd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b749ad85580cafe40b2d8d65905da32

SHA1
748ecd492f6bd014dfafef5570f9a1dc1c4fa850

SHA256
f60143bea1a6f1ce864f3a01cccac578e1cf0c03bc9e192a3e1cd4dd5392c83f

SHA512
a4e5183d551873a98fc3600271a3e825feafdf245ee59b3643dbc299049952a25740af6599a0cc0ec73a60ee32670a879a10d361dc4581035ac4ad507fa7d56b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1c4995b68677e7fe3e4592f830f16a8

SHA1
339f8aad547a547ae9d7d17d339412a6ded4fe1c

SHA256
2647e14109d2e4a536b433808eb8d2b2c494b74b60bc06bf8dad6e6570a9b1f6

SHA512
356d1b505c990910d27fca10d8eb91da6f8572854759e2b24d373d2f521e9bb6d818adbee10c995b85a64df10a491b71acc80b9b49650701cf6dac70d9d9f016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8642.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar86C3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit