hxxps://grabify[.]link/VBKSOM

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://grabify.link/VBKSOM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a0b202b7edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000080042f5bf334e9194153d661345896268df26daac3a5933513a9362926ade975000000000e8000000002000020000000c3db8ec371e5b52610a737d96498a2165c903d94af47b1bd20d71a49aeeaacaf900000001d0446a4c28fef6b853bd03186e5ce76415493b84d2a0edeb103973b38d78515a9d4f483339f08a22e97dc7b4f140a100befd616f0a06f36830e98a141c4c4cd1cdb300c74422cd86d1ae89f0cbdbb593ae36f31cd4bfa6f3757b0c7fda8b7324db862c782dab86f29fbd5ad3be3d801414f0f3bbbfb5bf6ccd490e96f5386ff138f2990243f1d1907fc77674f4bda2f400000000b951355094f91d9551a0ef787334155803e5265c59004421be3cc8c027a039610e1a8943bc042aa512bd19be2dbd5094fad6fe1a9b1759d556d61250b59a2d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005c16798b9f5b67f586df58e804a980253b63db728ee27b51d3cc4820d6bb8c7d000000000e8000000002000020000000b293069516e2f53581f29304176c63c2ea5e53386427c57904c69fb9a3e89fc220000000365a29b96c1ddf619f13e7e80d5c379e11348cc939e2846936defba926a6e04540000000330b3a609bd73ee052756448bf130f39e755e2989f4a7bba81371f5f3c2c5f79354b4fac64d8e6e57f8776ed119f8b34c94686e0785daa8fbaa66f86e0f39c16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429739142"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{217DC651-59AA-11EF-A205-6AA0EDE5A32F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1724	iexplore.exe
1724	iexplore.exe
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE
1856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1856	1724	iexplore.exe	30
PID 1724 wrote to memory of 1856	1724	iexplore.exe	30
PID 1724 wrote to memory of 1856	1724	iexplore.exe	30
PID 1724 wrote to memory of 1856	1724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://grabify.link/VBKSOM
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
5b389996f481da58d9628adb4894b6b7

SHA1
a2b8c2b1e2c123d536f56e044c2994a53b2eae31

SHA256
afb0100bdd73e4112d5715b9fbca31ddb8ee3953d35a1bb73d833f52da3b9142

SHA512
bf7e285a4a8eba97eb0725ad24884cbf73fe46f5b55e084414d3c34e69f178b5f4e824cb1a4c0311fba16d8af797279a73ef030ce6af82d35bb9d29121154386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eb75a4e7a19b0b854f328fc1cd306db

SHA1
04663d16fb921bf74b2ffd27aeb55ad51cd922a6

SHA256
1eb1bb031b9102c8f2fcc80e08060a49c1d9d79e02eb13f96692d2ce154cd320

SHA512
b8ab7b0b97a27542f20a2f64dadfbe2f61f2a2f7011ccc4c459f412878bb1ed47fcf314c5ea972fb9e25e92fef65ee32e1f188793f76d34dde3d1db04a803084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb379dfc4ca0ddfb7e10a9f59f72dc1a

SHA1
3d14e526526ecdf8e5a97342a59d367b01fe9cc5

SHA256
49ed67fcd7597167189c122ec2bf8f928b0640b9d6c165d76bd1880eaf602243

SHA512
9107d7eeb80adde8f875526f04900413f832c5e63da80fff8a8939601690779273fa2487e4da2791c63cabe30f41bdbf46afdc3e5ed4d7c3175b0da0102f7500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dd511c52eb9df7d6bbf7b5bd52b4a20

SHA1
dce9622153f7a9222cc4614fcc203fa7d50e9b12

SHA256
92610449c82693f139d621615a66bcd61961863f2235357607c961bcc30565be

SHA512
cfb60f4d5ff3d6a9316e92596c686854827920e9eadec7e652bf7b49ea9b1f192b8bce858a2f038123aab60c25636fca18ad29a8add2023deec8a5a7f66e497f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a699d0acd4857bc3291c928339fe564

SHA1
aeb50b24de60f69a92019d764cf65404f1932bb9

SHA256
3b063bfb75fd13aec1b7e493d0aaba45f00c294a4f9b154d0adc24729e2b4ac5

SHA512
84e33f126ffe7d75849fd3b3425abd7ffb5df95f355197502d705944b7b49ad11138542b538fdc7c4b1946b3570f0ee012b923a1e78e5bbc7f3dee5658f2a13f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce4bf677c07f769199cbd97780b92af6

SHA1
459abe0fc79a8b0e5c15894fd902ce65f850e3a4

SHA256
8e63c4a7c1f367891d38d45dd3c133dc8664cc4d23392f31d2ed3099d835bfdd

SHA512
8e9f5d37b80169945946e689207f27e26f5485a94b0572deef17760e3d26ea997403481eb48b5dc50db71fbd10ea4d5dc164eff3f99d47725abc6d44ff2759dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1881f4c1eb9b6751950540b3f7101396

SHA1
b37b93f05ea411f8f32d830d76d54ba43b22480e

SHA256
72a5331c3b5371eef26ae9682b61b00f57cfbc9c314255f1f696c27852552234

SHA512
65d03cf814e8ffd469fe9d5e522331839aa92e068b6d92e571e857bb86d1cbd913e612b5e9e0351c237e501d50b3b36d8f296db63ae0567180e1948525d7f076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad2170626ebebf13a99f17bd0bba95e7

SHA1
d5b09f6c5f983b0ae40df442fd7a2466332f11a8

SHA256
73460a07ab107fb8edb7ee4f95787b74b789bc96f16f2f75dc7a5078c5077ead

SHA512
b366cde4ee229aad97dba1bb1eae56eeb7b13129d5e60f5f118e93071eb8ed2945ce38ea19de2c3c6b2888a542acf8a10034a1c2e83c8fa20540fd51c6e50f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9f2d2b968cd653a822eeeeebf73759c

SHA1
8b1a0d480bf79ef28d11a043b1592750b9606441

SHA256
be41222d538d98b14a37ce282a1f76f79017d60ebdde775e179ebb99497fad44

SHA512
9ffb54f28e90050df626090c7792850a8a43ef4858f4251b612b6e83090b0756b140572b9b85828ebdd822567502392c47944b890d85c76127359172353570d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab63ec11edb302bd220a747bb79330d

SHA1
29a61ef460c15153dd4a2151034bc50fa8d9e6bd

SHA256
0f4b9199d299fbba87f546c3ba0ad51de5f3a0666ef75401852925282bd9637a

SHA512
357e9a8c26310bd19cfae8f0615709663cc207572d269a47c1d265a7c8b8a549336e7596d1d3c6475feb53d6a98a4f6cbbdaeab06fba34a0b37cf65b546375a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dee560702f3c5e7a1a28ffd7d483dc5

SHA1
c161f69d627895c22d8ecb14ce7dc18cd69ef7ac

SHA256
9c249a499ccf5ab2b3d9568cd0aaeba7fdbe18b433346f4c910e8f5ad7c19eaa

SHA512
631c1977574ca9632be158098f7e109cc227af4ecbe6c461243a6344a4ac974273b5d4956896c738e60a58ba7de2cb052a54d563c3aa7adb3f66408c8ee0509b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
85e82cfd586b2b53e6b7930aac36a02c

SHA1
cdfafc0d0b1c2320cad8c0181bb9047cb28fbc65

SHA256
cfc8aaab80e3ebad560bc905e99a8bd3e5fa82bfd6658c95a68cb5a85b94a757

SHA512
98bc7d6313144d79f68c44932118dfe4d3fde5a3082bd9453a9c50908337f9c5a39411b1fd4f8ef31c4911ea1a366011b9bf60e4f449dc0a327c8d805b328cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0qn8gcy\imagestore.dat

Filesize
22KB

MD5
a072022f29857b567e3579ab8e962612

SHA1
cc171193ad4ad216db48897711c24a8960ca7214

SHA256
1fb271232069bbb51c9738ce18bd9daa6c4b5e0497f3ead1a5834946281b905d

SHA512
508c12721a067ecda3f1961f72a50c17c6f0e2cf5d70de03f857a1a49cff7b8ea72d09b72f953819e77d4455ef7c8d39266f996e2adee469a11e96deb55e1194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\favicon[1].ico

Filesize
21KB

MD5
2e3ddf160b20974e2bb405b8f6422342

SHA1
9ec93050ac2b80092dacc65d8b882d7f920e2b16

SHA256
b00b8cd633d0a635c5840a2ae401724999d670fad974758220521143263b8d21

SHA512
9471576f8b283e5689cde21bf1542b1be7fb90ea28a6d762f481ce0739dde46d2289728386b91ac0c14aefecd6e2e974e36e5c19a360e9aab73098020489feab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0F8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit