296852253623b4ae5f22dd74f05d9100a615138ec7862dc02114c2441885fc37

Analysis

max time kernel
117s
max time network
155s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wwwroot/crm/1.html
Size

18KB
MD5

825946fd46cfdc5eea7ee923f0753500
SHA1

1ff8b01892bfb43a13e8f7efb2392052e0020dd2
SHA256

f4dcd1e0ee7a7d2fff5627d12cebe9e55fc2e31189dce8e49cb9a1c2f8e380e6
SHA512

5f5575c2402ddb9031724184c63941867b9a50abf72e54e52c8af64d5e8a404883bb5592cf825337e4b179423230975e07bae1b27c0320c27746c6e6299e77f3
SSDEEP

192:XztjMBI7BOHyaNbAs8s9UsVORJO5lVBD81QGEm6X5BScEwFClf8YCDZMIH8LoX8t:jt86OHtNBDRGE7BScE2Z7ZMs8UX89dpb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{102F9B11-59B6-11EF-A0AD-C26A93CEF43F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429744285"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000097f876459603805a202424dc7704b15c6bc85e16160c4a6a067131a14b5ea29d000000000e800000000200002000000047a27c2a75fb4927321ae0b5063aab93d1a841147e27126747f30ad8f533603720000000a91c8f637c215450fef6db1fd998d979a806dc3db1c8d76b288d085ab3ea709a4000000043c559db88e388503514995017ac4c8fe9c55b565468dd81fc450f139027a53d870b013766c3a8499ddab1d3e17784a58f01f42ae6ba3014f5beac81286a7f13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000d0f492849fc007d2dea774100c2d9d6da567cbbaf34f8580273e7a2e24120d62000000000e8000000002000020000000d2fdefb61ba29c3ceb22532300204c612b3831d94565f2d87472165652eb79789000000041e7f1f11c156343eedc5452b2c217b8fcca9f850de3f231275cd49cd025ad59d5b7b0e54414c5cdfa3740fbb54a08ce3ed1534f2603cac29f0f1ca2b2e8b6c91f10d0af0c7dee257024816dc054dfc5ead345251a3018f90349b40aec9c4d795613118f305914237505b91e09bd2bc03a2414f603bb8dbb2ad11ff9df6a0fa4f26ffcc48611f848b6f2fbac914d09c1400000005071206f3e09efd2f742f2f6a762e1160cfdf25012bf3086565fce0fb0ca316a1cf00fff1d29fc7d347610111a32749a1a5131dd510acad851196aae28646938	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40dbcce4c2edda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE
2880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2880	2252	iexplore.exe	30
PID 2252 wrote to memory of 2880	2252	iexplore.exe	30
PID 2252 wrote to memory of 2880	2252	iexplore.exe	30
PID 2252 wrote to memory of 2880	2252	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wwwroot\crm\1.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51dc903cad0c46c94a4da49ff407d80d

SHA1
168cb88658ff3ffb9d8e8f78e7592b22234e1ce7

SHA256
f19207e339d2a76cefab4a80eb05f75196687c58d0c6f7cd3f2b2095855fae8a

SHA512
92a0055a03137a304567c13e33f1ff46bd11a1a19f4d7a4fc1f8135215c9017bc223c3e8405c9e32273ebea7d6f2d5be55dde020cd450e147c2227c6af8f580e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5aa65b304b7402e3bcbbe6f2f74dae7

SHA1
b1042f307e1bfcc0261f74b9675c741c115899f5

SHA256
df719f962e33b15b510d69e8ba87091c117ec41580f43d56236c669e8b64fe75

SHA512
54253d7a5a297f81d304d348096c81bcbdb2633d0a017e9b99580f8374ee963a9a7880b0adcd786b594d3e383a27b6bb213306ed46338c1f8bd667881cb2b95a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3707901e9cbd40cdc9a295dced07eac8

SHA1
e3a916b7d2f37aa57329f97eead3f8500ebe4964

SHA256
da1461325dd340996dbe45ef94392203ba66f9954fa88a3b8a596441ba403a7b

SHA512
22648646750eca52fab65af07a8bf16992742ea807852d8fb0022aefa841a64ca59bbce65e2a9a735926113f88ad06544c716ce322eed5dab69d15cd883034c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5826ddafaa86a53673541768d927d139

SHA1
6f750845df03078c9cd592cb0e3a7e5425dbf893

SHA256
f898dd27ee756f2c999a573e2e480b29c9a032a519819e8e9ef1acaeb252eb49

SHA512
8b5a0e1f8adeeaee30a8dc2aa2da5fe81ad47009c707bececa9105392e5ab6591253b4b9a034da53f58a01dfef12207388af7dec0784161b5feff30e578e7149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbea9924145ad338a768ea71f40e2823

SHA1
a78363fe7b79d891cd821984f00445e773fc6e16

SHA256
76fbd32ef44439db56f588753e799c7682ae4342313b018c53d893fa0f279be9

SHA512
242c539ec3d7413257ddcd97ca14b126428acd763a08924710297e874ef98c457979efac87de0f7d91230dc1e3cad2122dabb113b56da525e601157852f2bffc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c1bc0ba0be64af299c71e6bacf09529

SHA1
3c69cfaf385e8c37ead44c7c9762ad8c45725299

SHA256
5c0bcb472ff9a848a55c2dd71147ec4597659aa5dc3c25538026d1c2a9809290

SHA512
2da6d7159f4fedabe77d898953b485b6627473c0124faac148b998a71c88e980bf3c58a7e1b5189546c7cdf5cab6e051a8ed41a76e98892eb8f4f3a86e6d8707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
972a949acaa705f2b97058a31452c213

SHA1
88b4114993240b24c0ff34b7a2efb52708a76c4c

SHA256
1eea875742ff37eca95903d0c7db5b835c3309ac7baee02175b887cf9d133c3d

SHA512
b174e188fceba0eee6cea9eb36ab22b94e6856fb800b622c6fe21ea478ce35b148c3d30ba572f946ba9cd2ca383fe703f5ad896b9f4647fa0b8f137d7b51e03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ec21e75555b95f3a0e3d4c526462c8

SHA1
0b7c84660f77fa3eee400c99369dcea9fb9417f9

SHA256
961a6f188c61d4f25e0c181339ff15e65b3033bc095868bfab392c87e907f1ac

SHA512
154a0c72075f2c2a1eb2bafdbe50fc922e1299036f88b14b70a393220f652432350b5e34364e1379d907529ff658262ac5741cbf11fb89afb61e0b8a94c866e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab75B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7787.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit