2e21994ec7fec8e719a8b1ce12a16940eaf7a818a560167ca97a8920a641a0fd

Analysis

max time kernel
79s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sT4nyj.html
Size

492B
MD5

df9086c5bba893d46ab471126e574cb7
SHA1

bf88e87a0425d18afe24194240ebb2e68a3a0701
SHA256

2e21994ec7fec8e719a8b1ce12a16940eaf7a818a560167ca97a8920a641a0fd
SHA512

387c3cb277d6c62a2795888de85ac69fc48e2becfb80bd02df659aa8ea7b07bb55cb9a9eb64f4256590de44b5a492cdd6ee9e9a85491ac70acf2f2dd86d951de

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AC03EC1-5C20-11EF-A4F3-F6314D1D8E10} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002fb95dc463b35271390574cb63ff69130c6174e77fd7afec92d442ea9d896324000000000e80000000020000200000005993834d85a9ea336b9d6a2de06c02af49a65a41fc0ae8f5d53b8f6f0276bcc820000000f7985b5756cf8468cb35f4bc92fe8d57e372c6e626ea608b41dee7702582c18440000000e761a57e54e1633c807390700ccccbd970166d5af5c0b0ac7309276a372de3b9f20944b3c8e9bd4e398bd5110bdd5e8b875d2240fe5b147547d0940232a89792	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501f172f2df0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000044002fd1f86ed3cba1650bdacef15c78aee81e0d2031b2a64d0a8a572d77a24000000000e8000000002000020000000c59e9ee8d2bfe2ac4169b1346d527371a989ffe79b83f8b2dde92fc5cb1bd751900000005c7bf887b79b49fd33503429f6b95da841625791826ceba6df4458ed87a6e0a6b726c27a02e44cb44c5cc7b45ac9392328f3f1e1e8a842584cb3667334644095b66f532411436e0329465a654232ae6eba2f4d90094a0ad3686a008b93e8c379dc0185c932836a5425336a7356110b1d5d6aadcfd845cf0d180a2db40408f6737ae0c4e820b73a0c2b21a8b4a17b4e44400000001a008ba73799724f0dd1cea84b54b000ca6938549216a1075db0b23f6c685f953e14d98d21ee44aa854b05507437d7b4f4732dbcfec4e6696c0cdcd87c5be02c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430009823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sT4nyj.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e06ab73efe69db08bd8df563f42df59

SHA1
25ba1217df1984317319dde8273dc177e9a59e04

SHA256
d22464d26ab1e9908811d3f5ea36dacbd0e135640fcb6f1be878807bf1e367ba

SHA512
a0c54031c73df063847433d37ac41a0f3ba8cd10cc103640a7a5e38e234661186136f0f447ecb3014b1678836e63d0b32319846ab09478ff074e2e4d757b5194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9933def04679610cba2cbf1ead7c2b3

SHA1
430a4de1b723be7f095a6d65bc2d47979a5ce9c1

SHA256
e16a2b0f71cf8c49acf679f87f7bacb1c596a1f7883e43644412590cb9320231

SHA512
1c429aef50c8589535675b7be01363c33926174658a24db448ee457ca79f89ef27ed1264df366d77037cb037be60b8996edecdc90ba2614943e6a4635a2b51f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f76e6c3d77d91a576dcb67126ff5d59

SHA1
6931d8d153e821a313ea8a06df71cad48568b8e3

SHA256
a432ca931e93af4ad343473b52f079c69645f6a5f477cec1471cbadd74aaa673

SHA512
fbb7b4227d85df0b7f80dc0a4dcee2cd64e90cfd97f0ab1dd62a69bdd4514498be15bdab3a6703c3b79c20ac8cfcc1781b18cf29f68cdb6db32aedbd20f717ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7dca91042b6bb7c9fc1606353cc39c5

SHA1
000c82505736803fc2a4fbbab0af63039a147bfe

SHA256
d4fda8d1ea8a50253e649484703e2d04667232791a3623f93632570af5ed3ff3

SHA512
a222a339a22dae336988070380d530a24fd0ae9b04e7e50a863f25f5c2d675bf1ac90b3e511d52eeceda6617b0d2aafe3c2c6e17ab89ea3641d36fc28c6fdfc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5388e1c145d4aff42d61144e152e3641

SHA1
869882d282e9e4fb21eb8f1b96ac3b4af95efab0

SHA256
8b93f3ac1e986ea1ad7fb96a7081baa11a94dfa50b91907efd737db06e715db3

SHA512
e24fc9ae0be0e5d9ed154c0eb7f17125ad311b89fe8b99e84241ebea8bab101792f0e8abfbf01982e286b142d24cfcb179688e199007629e2706f7d7358c12ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0696b265c79906d7f21862c29b03a31

SHA1
bc0b311354543851e7033bc4d0487f05c4baedee

SHA256
58131c53be4d7c8494f23d459d392316164d1eaa3da9c9790a901778e28f59f5

SHA512
9308e3df2d0539e838a84ac7d5a5920db576e2b37c5d23abd7e0d798fbe675d9a497f716e98134ebf75dab3a32f468328fba011ab40ee3141e07c7b198df860f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29b63493f4c9d26d54999b46dc2748fe

SHA1
1ee880bb25fa04f38b77b0baac8b35d5e2637df4

SHA256
1ba9b93dfdf923deb54e7f64c1c7b54352dba22fbb452b216ac37c5964b70408

SHA512
a93e53fe37a04abc74a96604d7059cb2bc1e7b80af1850373b6a1ae0cc35fa9ada402ad8dad9850ca191f79cfc764b8a7b9578870f51000103ca08954115ade6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2988f415437d4fd2af3010bacb95a93a

SHA1
44ead7708b06fffaff2cbf3efe1364aeffd6a0b8

SHA256
ab475e347d4d31651a92b85ef1c1333f54a6ab3cf3a7982addfa173b6eaecb14

SHA512
912999aeaa83cd8dce09bf1929a6ea0f269a8052a0aa8924faefeceb9fe6bd0b693b40f43995c798484cc9026ae8d62dcd548439e7ee412ecdd00665cda24336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7099b7c3f7b74771e3b5c0a24ea92700

SHA1
bb19dc784df7dba13d8cd657e16fce5aee12b0d7

SHA256
74a53dd026b2e7136e3c0ddb828e65c2b70f78db2f842d7df75c4fad8b97cae4

SHA512
6a89091cf45fe0bf425138da3d445e1af37e04ca856c23a1f8f3f0fff8af6414b20ccaac5c74fc689cb236945cb83abb7ec7015773d0c4b1266bfd1dfe3feaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA557.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit