32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PaFRXh6fDu4UDCXB8RrCMW2uvSIr3RWnUfxVvUHC.html
Size

146B
MD5

9fe3cb2b7313dc79bb477bc8fde184a7
SHA1

4d7b3cb41e90618358d0ee066c45c76227a13747
SHA256

32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
SHA512

c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B0AD541-5A4B-11EF-B90E-5E92D6109A20} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c308d0b42555dedb8fa019c6ac26185233d82e7a2f33477085b2249b963c4ab5000000000e8000000002000020000000cecfdd5d916403ec19e2a61bfee8abb462a7025049e20fe2052ab7d0032e6ed7900000006aa89fea7b660d0d0332a8acff606ee83542bcdb0176d06d2f08228bfe9bf55d991cbbd1ecb2e83b891a0d2cae086010f494a2e58895cfc295c763c47a584fcaadbee94231a32be3844b760bef4edd3a155f29898b1132511b8e1f56dffcde9fc4a69236087ea3e2e55ba2d86078dc5d0e75291eb3c62240f35d429477122abe543dc98f201ca68baf378cd8747b3fde4000000056d66a5c3e5ba404c6155bc4c1e753e342de7f08d883b024ed32ab6b49c84b3256cd5b058f32040d58379409792c34810ce834d40ca9814681904105a8c4b92f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604385ff57eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000016f7f6cc8a3fbfa1fe5710556e030d66f6a0a25505de7d5f03e3fae3743c017f000000000e80000000020000200000004d73d2fb3b5d0793c7fbca4455ac9b76a3831bc3af8d59c1acf06ebfd53a19bf20000000f4abfe434728107b2d759b04b8e3cc7fcff9083151b5c7ffbb02947aa0f8eebf4000000086a7b4d499a16bf443a966ce261450824e0dbbd0a716f7c9889508a644adcdfdb59a7ffeb18f4a4a94232410e395b9493fccad02229425effbe7248ddcb19e20	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429808304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2220 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2220 iexplore.exe
2220 iexplore.exe
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE
2856 IEXPLORE.EXE

pid	process
2220	iexplore.exe

pid	process
2220	iexplore.exe
2220	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2220 wrote to memory of 2856	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2856	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2856	2220	iexplore.exe	IEXPLORE.EXE
PID 2220 wrote to memory of 2856	2220	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\PaFRXh6fDu4UDCXB8RrCMW2uvSIr3RWnUfxVvUHC.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b3bfa3214274e110fe08e918cd6ab848

SHA1
ef46a6ade0b3c5a476f4b63476b3d98367e8aff2

SHA256
fe34bdf7851ec190393dc8c82adcf3259082a3e96c665363045334ee2b8a82d3

SHA512
d36c7f9ae4e3deb41a7ddd3f585b8ae3895e8479879e6f90b8d0b523517437311a04a5b363379b8ce6ee478ab2c6de9e9c0631f2410fac863aa03b3d7f97dec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9b25e4dd80aff9bb4798f5ef6cdec298

SHA1
e704cb4a297dbd391cf7b4351c5cbc65f206fcd1

SHA256
c27da912c00a58cdef9630cc0d66cdaa497882057d2b6d0a34301f541ba1f803

SHA512
8fa09349a3ebc68dd1cd3ae90bb6cb80e993784af33eb150fa58fa2283131c409fff5f1a2ab5b57e9a6d54e25fff6b18d26887a5b5b5b01775738f07c22c65e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f107cceebbb1e09abab79f4715fc3a15

SHA1
52d8b618967183cb83cae6a4346ca75460182377

SHA256
71789e5c1e144b161e0d48723deaeeadd11a69dcbce1e6fa1652a6823b0155ad

SHA512
d8f456b6c18f2456c52aa5ee72bb415b8ec07d65daf8668c317eef1bfa3f9b52be7b3f8696db8dad19a1886ed7fff569583854d5f3ef8e8098dd16524a503ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d97601bc4f3c0a49571cb9ad27f73213

SHA1
850880a9af9131852cd006725b13c50d5dc9a2f0

SHA256
a712fa9118873b0c1521ede9f6b6fd66612ac31d7ade9b931030a9a3882b7338

SHA512
bfcdf982add552bb864105a62862a11092426c41b7af344f238f695904c6a01663ea0992773ada037345ffb6e58daeb42f7f5a3ba4facd945f35799d4c208b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d0b38afd41aab662120c0a52222871be

SHA1
de93b00b626a4050a61b74fdeced483327e155b9

SHA256
a147f4454a1730beaf6a2acd90059b92f8bfec5006645e2fe911272dd341c9cd

SHA512
745a80063292547beb6958203f17fd133ad18421fc905fe8de09e21145546ef6956115561dd440480becacdf5edb1c0db0d17821a1332a44f6047ed3675fac2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0b2b588cb8d0345380dfb9e981199884

SHA1
d8e0bdda7b65a81d61b2264a1cb8f6ed5000eced

SHA256
c548d100c81dba6a6ba632a4ade52f6df6d6b1f9f0258c014e3a1c24d36855d4

SHA512
777ef7be12fa1d33e88ac2809d035ca823c4b5a7f9c34dce449f4099ec66f0a49da7881e7d46044d3cd0bd5a35b06d5ef2554d4f2cc70b111a0a2b5a46b93bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fbf8c546da153fe170e7c5f7014f6264

SHA1
ee972101def23ddfb5acc34acd33f93c80ab449b

SHA256
9fd5de97cd63882feeee420e5497daab2339187a690232a27d0d3b61ab3af1b2

SHA512
9e6dd4d4f7074718c9ad0a18316f8aa4fb9ad265bdb832e32d7e4750b84f0d41813ff12d482564c038e2076e6e802c2a04e884b7494b79ae52dbdd5746e569e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8330aa2fe7fcfc7524393868cbac2e38

SHA1
306e6f16155a2f3be064fa9f26046f944eb3aad1

SHA256
285fd5f10d2462fe54a8658abc75041b1e42c41af3c5a74e961252564fda7a28

SHA512
76851082295071133efe7c058fe4d47535c4f80d83d462097367618034f0b38fd99e8916fa7fadd8f534109c7340c2d672b1c94687e661269302d46795b61b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
f5f44de671f5d5d22bf31eed52dc10e3

SHA1
cae245829b014c7f501a79e01fbeb2dba6fa3fe5

SHA256
2e46c1b896cb5c39eecbed12455e58876017a774bb88ab8a9a4ef0323574cf62

SHA512
e17cee5c4348cef1ab753b4bf9a5cd45fcdf3f198f3a019c6f861646de9c53c8d5c625d58ef3d07df130a0ba1128fc335debfbdd7f71de73d5fa692ae896eb24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
973ed590ca0b3f4986d7e9dd8f654b58

SHA1
7c17aa48bc374d570bd96d090db33138a66f47a3

SHA256
e7c5ea4a2e0cc5f6f094f67ae89ddfaacc020df91fbe93748615c5a5bc741e74

SHA512
119514282f3721c8da5c9108a964885a6dd6d44ca0be8f959ee73b2bc6051796c1477014b61c93d9341a8116742c8162376f8c4f7d15e8e06322436c01fad1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
c5789c391f38801f7f241a9eb9d1b748

SHA1
7a097c71b10e4228251ce9278c52ba1e355f6846

SHA256
ddcfd16f60e9a1877ba5207bc1dee46a56a4c6535622ce6dc6bcc6aeb3c646e6

SHA512
a30a3844e896a63daf7e791ad81efaf47525ea4d38266d8dc191ef2db56ccbe24a661ec6728ae2cb46bbd56fccdbf45f51f4000c497de86027bb21bef9940fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
6ece8267803516e6ac73637af83bce23

SHA1
5af32f71024fd36006a1b8deb5188792b8c52b7b

SHA256
0368a0978032b789b88c1d9a35c6c47e2a6ad98c36bc17659c221e56a4c3f521

SHA512
2261178b59d923f50b633af2c26a8882004654e60cce2a7274bccf86855e717e71a0936c15e07fcde8f1de45007bd47ea6e9dc2d20e9a06ab8c6825c86936144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
387a0f2303d82adc92b3251aba2754f2

SHA1
6305a43916ac85e485ce3ce2179b6f5b1443f0cd

SHA256
4059a18aadd19913cc266cc70f00b3ac30738d136e4c6257f4f614e7a5cc2307

SHA512
b077a7b700ce4e82ddbf01193c8527fc8a4430e6350139312dc0afc02113f34ec7901e4eb14cd6540b64801926cda581259d77f1e7f1ff2a78515437a1a03675

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1ECA.tmp
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2034.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit