4957dc0cdf9217daf2e40d025ac5ef23055fa0bd18b7b37de56c1274e708c958

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

readme.html
Size

171B
MD5

851247217a3f9c88e2b020c984433f78
SHA1

638a2284761463dc77b4f2db6a84951017da4119
SHA256

bb2825a65d5f45a1feaea10c37c3ab9e32762ec71cb54ce8949179c3afec749d
SHA512

8e689e80889c22c55aed2c4367bfdd7c85575c2bd7e25171a9964aa6dc979eb871f6e2f6d92f302b0fd3d62b611dd6e4c8444a96f4e49fc319f2fbcfadc2c239

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000bc8ac9147526d6b91b09863416c63dcfc4d4b899fd00a2f36d60002a83589127000000000e8000000002000020000000f19bade1d7d51a32e1584a5f7ad38e484d386eedc6e5aa5eb0ccb5417068ef0090000000822997368c5e20ce868c97b72ce211338c2b0fa904fc0b2c0bff19dbd8db4c8475017fd29ef8089aba7de20e6da10f23290c402362c341e16a511f9f4983790e2a4a85643fbe96d2f67debf49a3366e0c2bf7e618ef96a8cf841b1dd27e3353883f55f094990d142aa44d879de6ed11557186241eb1a273f398694ebd22c92b0982388e453d3d6c1f7e1d6236f4dfbb54000000094fdc07506d32c3b57a1f2fae607fd59e658303c490e80ef138059b9243474df87dfb934758942415e387577c3375c10bd46376683136c19b68ad16a3cbf7f71	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BC3F281-59B6-11EF-BFD1-6A8D92A4B8D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01a3e06c3edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000581ce35f727f462eccf2777babd46d1f13fe73f8ca18f49215a548cbf1f67856000000000e8000000002000020000000a9d7d4fc7dbde31d9204583969b1201c93426bc672beea37fb866b0d9357797a20000000f3267b70b6a68187b930177da7af77aca62bddd6eaf194abcb0da158d2e6b3b7400000004a1f4f3c420fd270bf0556cbf108b2dbe4ff04852902b7d76119dbcb51b82e552fdb703cf705a90d4cd73f5e2ebe0e554e027e9bcc23ca9ffab6545beafadf82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429744337"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2748	1872	iexplore.exe	31
PID 1872 wrote to memory of 2748	1872	iexplore.exe	31
PID 1872 wrote to memory of 2748	1872	iexplore.exe	31
PID 1872 wrote to memory of 2748	1872	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\readme.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a407a8d541166187a7e6fe634184bc18

SHA1
ae983f740db8ae53cdcab58dbab3f3317fd12245

SHA256
83e5af704a9d19dbe8867ee73666aed480a5086a1ec52bc449164b387b2b396d

SHA512
e7214d755c0fa83bfdc3a7864b5877e7cd6578d08fb8bd715373d11a2af9e427c3fce8d1fb93d2f721ddab7c5cbfd39d0c810c89b812bc9125d7d856cd5f47cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
15e578abccf6a65cfd745e30a6696a11

SHA1
925e3c18060e636c481945ed7c0117f6a18e28a3

SHA256
48f337bb375ba7a1d1efe62e7bb758bd6533dd2cf59eb70a69506021749b5145

SHA512
71dfba6d8b15382b1f99a9a6f25cff1507a24291b8f50ac0d6c7e193dbca52aa0f07e7098ea7579c0b05803fd606eedf0dc0fa53ff4bbe8d9666058eab4b547a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
36fffff0ab69b932cb2f8fb4f2219136

SHA1
7df58a97df014d6ce061c03bf7aca277f29588ab

SHA256
9e861173cf7d1b503d153d6db97e00304eef928c1b86338e39e6b521cfa8f3f0

SHA512
f785c9c36c901df4eb0ac559fba94de9917fa52f83f080e30ac40ed2e4cbd530728df5b4abd505cf43773aa9102c4d7fce537792d349e52c2772d2cc9199c09a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
48ce34c4f7f03ffc507e25fba7333146

SHA1
95520908fd6451091ca7d64eff8b8f4437c6eca2

SHA256
eed806b3e412d79041de00d883ca0f8d56b2486470e65c637004bee8660c4580

SHA512
cadcce35544fd9a00280f674c1c72351da2f06e0c7e697553748cbeeee0b854357454bc84585e84e98fd5c005242e897fafe0bf2dc5bc68b74749ad9bacb45e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aa09d3ba619368d53e1f084e2b38526d

SHA1
61c0fcd6447fcb9bc318ef2bcc9e702060dd24bb

SHA256
5de611cb94717e916dd06b3d456b1a8a56b3418ec9745ccc20dc632ca27b85f0

SHA512
155122ea0255e04778db6c67cf246ab7ff10158f917b69b101d3d1054ce6b643331f9c867a6bf85a27e6f28d924a6fd99460e5f1560369f0b7e4f70081a40d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1acbe214c84484b69eadaae0bcd2afab

SHA1
7c2a5b0d4db90ba55ae6202073caf2704053a5d3

SHA256
35dab3adb2d730c7ea286924e5feb3c611e73f3998bb410560277aa330bb10ee

SHA512
2e9b186b8714247b22a2b891c2c661964d2692aa93bcdd17e4cf037446b9839236db6b3ff6f4453d0cb8e54f487f2e95bad26e0dfd45dc0b8ce5e7dc559a2b64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a1144b3fab064f91bb7413a8b447fae

SHA1
46105df62a72cd9aa637e1336fec12ada8584981

SHA256
036a59cb31f61cddbaba9e154ac338ecb340481ff265d969481755f2262713cc

SHA512
448c49df296c946fa27ef62331a52553466f10d26f1ba65511a1b4d695c7c13e08b61511d55df097e79ac55b5b4d62a754acccc6e1e6e70ded9a040ce4372f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a67c583dd833e27d7d01a2d3d29f9629

SHA1
1f44cb646662f04a293adb8eb065b05496aec392

SHA256
5bfd07ccd619d6c7d7022e6e9050fff5445dfe9ea09bf51f7c0360978c67088c

SHA512
48aa31a92c08a26ca8b2dbef97450f978d5c042d4803d554739019ada8bc498bb7d6f1a522b39d983b85f91078d2e0a2fa7757bfe58d5ad5fa2b67f8c20d6f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
07bab0ea55f030e3f36564b45411e638

SHA1
e51ebe9278a027d948a7c1715ff12ac8d2dee6e7

SHA256
826058acaec47e70e1d2875e562ae003fe0e9a74087a8e5bdf33ef3ebe568643

SHA512
fcb073b4bfbe3f8962c97c216d2531c4b1aebc928168f169061a2e043902196ff5c4ad937b1dec3ce2e78bb5afc12434672f1b57ee60a6003b48dcb09e4d867d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
610eb790e8a3c0cb703904f19f28c172

SHA1
589a2c3cf0295056032088fdf5dd66a05c1551e7

SHA256
63135278b731e59f92277d82c624c62cda467fe3f30a411eaa5dac8554f00a5e

SHA512
bad953436e1758df8b73c71dbfb34868cf6a66da65d1723969f80c6c255501400adea30caf86fa2f520780126a323a8a185f486cb91bf6580896ba2f38d2baa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
45743f1554fc7d8883e48f1baf0402ce

SHA1
afd3bf1f38630dd092cfe4d4b8c776fcd9e5378d

SHA256
0a5b318e0a7e660c7a26ac91335ba77c181e8ab85298ae4596a10e71de3f33b8

SHA512
754f549ba9c666d7d53c2a70e72810c4dbe861a54d9bf286a4c717b5748f28c3c95545537be1f603acf41bbc5ecfc5ba9ec2edaac137073887e0856570e8e92d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1f3d222daee06ac42a36f5741ca1edc9

SHA1
9ca668417aea6d4757a4ee03e9a3dabf0505ad21

SHA256
caa2405f8c8045749ccba2192b302d25af189edd59a4ec1311d41f06116b9803

SHA512
298c6d5a305f24ba0f00d65810789624a2f52fd9f902884ac22ba82b1742c799b2528052900f02c90683cdb1c2d1b79099244895d0b70490d2de1ddab14a2572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b114d1fc1a8ad6d5a939173c339d0df0

SHA1
4ddd2b0a4b8df51a2929dc2f9deab4b2592fedb2

SHA256
2f8ef7223f1b86af159d3deeca316e3d9cb9d60545e5db06c51d705d56acedfa

SHA512
94c663889616959c111cfc621026a112342c203acd1385478ac7a98ca7ad1b5b80a5f5282f66ed4be70178ef4d60282676dfb5485d946e820dd46a3ae9172f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7bee9cc097ee2c72a00d2b86feb8830d

SHA1
be548dce212a09bc4954cf652af4dabf5ad7931f

SHA256
038e4a9224766adb9c70a1b3addaf9dfb809c3b8a83e8a66564423075c030f58

SHA512
6617687de2bf6aecf1104f1b2683671bc9084537e54cc043d51b0e2cca55f7910a00d4549986d6f029cecb922b5317b3c43b0466da65ca45a80d99c9c64067a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a5247fd475be25546920ccf9d62e01e

SHA1
00be784272f321a3e532cef9653e2c65f165ae50

SHA256
9b8ffef47603f6979347dbbbb8cbaee0953ac4ca809377986c5549db10044fb3

SHA512
b66fc73367f0c20611895a9e5376e54757ee759ac2fd787abc2d9f942970371c2547bfcfaae75e236a1ca3e424030f11e2b9036fff4b5a84a755d0a80c4a1a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC4C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit