23ef4926e0d3e77b38fd3cdc0e7c24d95ae29b1bb296d24e18d5650fc0e27386

Analysis

max time kernel
139s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$SMPROGRAMS/Internat Exp1orer.lnk
Size

1KB
MD5

9ffaab5f197ee38cf1fe65e19d4bb217
SHA1

39ee57d785cb31b75fe79879ab5dfed14eb1a28e
SHA256

6a1bfc7b4d0b3c749f9a5737f7f0253c634bdd62fe812948807c6beae039ecca
SHA512

eaa04c6437eac713912a81b2e11f97cfdc38d5d5bb459d7f4ae94d140b2bd4d74685cda43697f00b6803b1b58da3bef78ca3d9d6a4b9f5e4278ff2451aee512b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4054cd163aeeda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429795456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e8d3d7f33d275c44ff239929d60f96fca89adafcf251387ee3bd74c8434d7377000000000e80000000020000200000005d18c35b9543d7a850e4f85e45e88045b04a9109a37b343ce8faaa68fcbc027d90000000d9a3ebdde47fd2d551f94fcb891ef67da1bb7a791ccc4093f71ddd4da090021fdf16ca05421705e1d215c0c0691fc3c8872c656cf8e9fb3fbf288767d84cda0c3a9f9943d612760b51520e20f5b30f2e30437e87c99db7829af343e379cfc652f9edbf9a765aebb93ac23d3014557ac4ca9cd61ca990f51d422b4020fc6c67362f20601d75dc16d6abd868cbc806fb7e400000003112b0308f7c716a97a432a24106407356d4e59e432c881ebbdaa41bc7c80cf7453b7a7f45514d22f0383f56dec3fb7c199cecfe580dab013a0d36300600a562	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c03fb6bd84075f31a9277703bf4ec1273d29fd0605bb8af8b6b35ae8d196f520000000000e8000000002000020000000a34e3148e3735fc1c82c0f59bfa097df27b60745c0aed48335447a0129f5fa25200000002ac10b86fa7521a8af225aeec80ae1c26be71e9963ad816afa7f7052d6b706cf4000000065b16c09fe20fc7de065ab985c2a34cab8b82bb7f4eb1ecd7deabfbeee1d37725b18bb2fb3d5f9eca41937aa7241e65b3d09b748c68c28690896e194a23c9ba5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3ECAF011-5A2D-11EF-B8DF-E649859EC46C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3040	1944	cmd.exe	30
PID 1944 wrote to memory of 3040	1944	cmd.exe	30
PID 1944 wrote to memory of 3040	1944	cmd.exe	30
PID 3040 wrote to memory of 2104	3040	iexplore.exe	31
PID 3040 wrote to memory of 2104	3040	iexplore.exe	31
PID 3040 wrote to memory of 2104	3040	iexplore.exe	31
PID 3040 wrote to memory of 2104	3040	iexplore.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\$SMPROGRAMS\Internat Exp1orer.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.113w.com/?waga
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50d03f5339f7f33a2f8730cec73bc2b6

SHA1
ef7b56b2e8ba169ac0af76b17bee1686105b9607

SHA256
e74fa2f7728ee8721733ef1323b90772dea40efd395231263953bdaf9e9d57d6

SHA512
43d0616e635aca8668094f56188c469c79eded029eedf19e4a3086ca64cd772d31ba4c8ea3a545dc4a4e621768de334c776f7c6c35593a61faf3aabf24269550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59acca5262f0fb17c5fdc73c33b4a143

SHA1
a1e315d7f7dc50949a9a5cce40a7bdcac2cbd567

SHA256
71fa87b184c677a94beea02ae50f7cb11ca99d60b55561e02cca0057d1279b6c

SHA512
0dd994840252cd5b4eeea68c300418ad429fcf763fd85a2315ca82328b71d6c48a698d7dde0c3eb3b87707d1286c73896cddfe369f69ecefde2c2e399646ef47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
126fea2ab5ad25f2787bdb3568b75b91

SHA1
3aa23a014d1361f3b538c6e547ceb97e80bfc1bc

SHA256
34045a797a84c9b1415545844aaaaf377ccb97ace8cad388aa3faa70659b0a73

SHA512
180ed209bf41d4478d2f03a4141152581466ff9eea5cd5e8eceec95c3c7cf3c5fbf2872833aee2eff43fb4f8026785263e3bbd141fb0682453940cd4c60be918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e38e30ef0298a8424f1027e8acc1f4c6

SHA1
a48beb8428f86234ebdc4940865d8303926904ee

SHA256
f5a26bdea9bb93a65a152061b99d27685e6dc22c59d45e8d5a85527afaad8cbb

SHA512
d1c2be1d6177b969d5d42dadbb6d77b4da48515059c018a523facfa59f1c0121c2c292243b24d8af736dedc33f3beb06e6c09860d185f94bf8e6d5149d18a7f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1e4f2e232d25f7e1f1803dd71529cd

SHA1
e8effb6f881930a7b9caf1eea4d3e9cd41c54df5

SHA256
579ac594952e8e3892761b84401693fca73f7c017c8f9b336d5e7c652aa3e10b

SHA512
d03dfb0564f0ce7d9e364315cc2a1998599317309b3fea9d425f8aa1bf6a3f5712c2621a562895469ea44f2b03438f49753ebeef51bb3de837e6611136297fa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34eb1df3dd85ea95a6caab51650872b5

SHA1
0b74a486b6d98653dc8e619a6641fe96da59175c

SHA256
ab9a66411ac6dce3f9bbba8afa94c344a425f73ea1090ed061f524255e847b21

SHA512
42e3c69e1e37589ae23d69d8e3a88ffe2f94dc8b83457e5946334bfa7eacdbd0b72c800761c58a1749d9b2cf7411b33596e71809308be1e9fc6378938ca79604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfdf7420c625fa4483adf183be7e757b

SHA1
761921078d504b342ebe4c96fa99796e6d9a51f5

SHA256
ebf3a8c8d2ec59ea25d20e879e225041f5001fc182d2c918f2dad010a795941d

SHA512
03745957e32293d5382da9bd38d42b6f01ee4172ba5bd432cecd172f21610661d47e374f00d0f2976eaf238f5745772cfedcb986c0b0d8960c297f948faa2261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
763dd35db41159acffffee805f291eff

SHA1
e9f3949f34bfb514d3323ad3e090a292181f3393

SHA256
23c9561df86215430c352695f58933d5c179638e2b69b5ae25d9bb2020f06077

SHA512
b2af02b8fa459acbfbb8bdf1447871b1447fab954e76cd0aa602a560cf244f1ca930eaec9979518229f765b2fba16d8fe31293c38aff6477b4557c0530ed8481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0ada066705c96dbf1e17e61090181e

SHA1
b1babf4b6b9ec3c77300a489a519fd4054dbe6cf

SHA256
5c1802e64373472b5e0b072b1dffd2206091313d421ba1d33da4ffe7e666b1c1

SHA512
17bd0b508280859974a1cf2313d5ca5dbb02d76ad05fd48478bbb089e29716c2ec5e4417a9a4134a9f2be678dd3b91aea0c0ac69cd025e59525b6ca02ddd33e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6cf83e31fbe4081aac38598c21f4e82

SHA1
6ce4a74c4bba29424f2c8d92414eeb8872a2d728

SHA256
5d97b2ed93eceb42d4aaef737221281e6f7a19bcfaf4bb0c7209ae0b3e0c0945

SHA512
a746cffd44a0ac5348f6da1715ae676c297f4008e29bc8d115c3ca2d3c94e24442befc1c64e6b880cb9e52536c464ba1037d7345ac36b5cf57f89805c974b849

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56BB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit