1723d99a51ad87e849cf26a4e3f0addb7bc0b95a2a6787657cc7dbefb96d3a84

Analysis

max time kernel
74s
max time network
75s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0eabd72e90807739cb0e441bcce500N.html
Size

25KB
MD5

be0eabd72e90807739cb0e441bcce500
SHA1

4dc28c5992e3cb08af45606333d4b44322513d8f
SHA256

1723d99a51ad87e849cf26a4e3f0addb7bc0b95a2a6787657cc7dbefb96d3a84
SHA512

0eb01af890ae7926faba0243a1de5949d86da330da031f39c59e6e883e88809cccb81ea76cf4c6ed39d621659acc25343ae2fdcceaef13ce80c733630a7a9cbc
SSDEEP

768:vOoKIRIOITIwIgIWKZgNDzIwIGI5I9J7SzIRIOITIwIgIoKZgNDfIwIGI5ITJ7Sf:AIRIOITIwIgIWKZgNDzIwIGI5I9J7Szk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{033D9E31-5C58-11EF-A4F3-F6314D1D8E10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c5393343150de8eb1f8d476ecf75c3eeabbc0fc31ed1c863941c2ca0f89eb607000000000e8000000002000020000000092a5f4fe2a0dacda1db9126f2be40b3e6586fbdd5719978f75cf3d607ef3b289000000074dfc7864346cbde340d75d367e09fa4232761644c13d51cd424ba68e0f01605854390b6b64033f210278bf1ec30797c27415c995c8b8125bce3c4e468691db8de7f50d2d8f2905b02e2369125b9512d2fac2a617ffd1e484bb3ac70fc71ef013b96559ecce94673a122ba6dc4cfcc3a504417d5a151e10d712199c0a3a8a291e203bd5422711939f73e94ed2fc4e91740000000bb5142a2893405563e99ed8c9e6fad03963dccede42cf9fd2e3b778df0f1f7e35f8be5f22f1ead11a37e9bb0e21290965de0fe285decdd73ca614f4a3a223058	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c735d864f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430033730"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001e276a46260707ffe40f08eace61c5c27fefebadbb6edaebff9d3ace810d6512000000000e800000000200002000000069611a0e6b4cabb2799cdd83dd7de100f4c7dc38eb537de7b77b4466420fb346200000005f74f0aded7cf254e59d97f6c2a8fd41a0cd1ba23e295a7cd570eba7e26076e7400000006186482b176a0c9bfd1b5da9e0d43bcc1203811c8dc9551a14309e8f0a0e95a990a753c044a727d1b56066600f7935de82ca52ed0786405b7955b2ad3d47090d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2472	1872	iexplore.exe	30
PID 1872 wrote to memory of 2472	1872	iexplore.exe	30
PID 1872 wrote to memory of 2472	1872	iexplore.exe	30
PID 1872 wrote to memory of 2472	1872	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be0eabd72e90807739cb0e441bcce500N.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
059c587de05accf334d1a5c4ec39d375

SHA1
74ea71182a609ef4d39729c816b3b4f477938eb9

SHA256
8423f806c9b06ad75b5e18422a564a82c6259e31d3747e0256df79a218d09fa1

SHA512
6aa4da840979cdd73ecdbd103610a5bc9c85923190092b6f1c4577f2a32d9114650eba66602985f9873b39aa38fce88e63d26d65f6a1bdead9a38f9af98c8aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b74e7616872885ee3d77666337d94004

SHA1
7e0847b8293bac4f12e53d0f5e5da0536de7cab7

SHA256
797d1abb93396387f324089e3fa499dde9dae729d1da3d69d8d5209c5b2b2a73

SHA512
2eb994a39b26d1166fa5df2e2ab414ee071c4611f8caefbdab00fa3d6513c22a72c51d7fc50045aca8c696322ce342b534db054aad808c5cac3e966c4e623697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9156fb639033fc96cca618fad0896ca

SHA1
1607e58396c93e4b032b72e724aa6d9f477b2858

SHA256
e7dec35a32fd52b4a83d33ab6761273c5bd92c1c133969e4176b0e94ed2c0ed7

SHA512
2a0785af624e5676714277b2e8faf8d9444321a37093010d67c8bf20ce89f0b05d583371407fcccc35a2094d02fe044cb4496cd8a48bc7506a25cf496805c590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9ad67520a5e4b15ce4ce28266ad078f

SHA1
b7812a41f7cecd89000a5b521429a167228d07b2

SHA256
507a4ed032e725200778fc19fb8ebcc470159b7dd8555198a1d73b20e6db7f41

SHA512
61241d0be3960625263c12c51c8c94df8aa2a6e24cc73f7adc7e2ccc125e5b1d82d3e0b5d5d51bead889beea473c1b3f683338ea7f003ab9e2185573e29f0336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6c530cf0425f98392fb289348b050e6

SHA1
25422b505a70f53dfcc86f8fd1eb8f53d9d20224

SHA256
907f3266dbbe10b3cd1fe5f99840aaf617a17dd2f6798b5cf55da1db14cf54bd

SHA512
c925c3346d5a9519e29f5fdd7326eb956b726306e07f4509bdc7148ad769a102f168a6badc441e28294dcc248a89e85ab825787fc39ab4e9fbcc3d978c34763a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8da2d2fc2f5c05f4b00746eabb43e0c8

SHA1
4d35da4329c4a109a55c9d00419f884276f2c266

SHA256
0942f63f227ead6b2866b92b5c5362104e9a070dffefc4c0800e2157a2d170b8

SHA512
698592b2e3e49e994562f7c2c4915cfa196e8df780fe13b0b79e44d2d982f68eb23b7d9394e66a5679a5ac4d4abed4b814e5780dca47e85f0bfddff6312ec7d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85cf5830f1785b967d6b6e641e2cb9b0

SHA1
647121b03ff69d9495b4aca6da599d100391b20c

SHA256
4f87e30bcb4da94b7e903b4fcee280b7d057e9e7d393b28ae23c7146bb058ddc

SHA512
375e8d4c7fc1a54b95a18d0dc66fd17ec0c29256586651c3200ce6f233b3579d31aa376e224950dabe1253d81a783b7cce46b9d6801b25f4b7223e1bbf9f6a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb231651af81ba435be452e09a018baa

SHA1
bb5d9beb56d35dbf8d486abe20110c8df34318ff

SHA256
ac4b249b1c4e35f2abbddae0d933ef2c2e5a196e887de3f0438858deaed9925a

SHA512
de26c0f8a011f37c20f05f27a39626e4c4208df52c8bcbfc67191ff85b93eee078e14c5d243a849eda95fb4a8cf7b12d1ef075a35aacc4a78ffe889bebd32871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
651f9a188acc4470bfdb22d0a99dec5c

SHA1
ea6dfdc965e268f5980a4b6ce3a695a73951d0b5

SHA256
6a4c1bbd347c60f42913658d85412bd8fb09c7985b1634e93ea090edbf949831

SHA512
74dc995f00ca94dd2c80b5b5fb9fd11cfdeb75ea17ce239d95301a6422c2ccdc1b3815dfefc40bd9e67826b00d12bb91c44f53ae420849fce87d4c9a228c083f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2f957da06e1f1470c410ad7c7cca5cc

SHA1
ac6fd8a439b5f2687bd35871252f9a3fe5e68112

SHA256
1ce2a1a72488223ac35fc77942bad25aceb88401f327603ff38c472132f5666c

SHA512
65eca3e35d759cf995269b2b0d2b62d66f346ffd3eacd491959f1c039ed30853f6fb5cd47e329075aaec5d4f8e0915afc9c3b16294f9c29e1b6149733e66e3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
057c5a4b7645e2d1927957b4fc4d3c9c

SHA1
c0aa2cefa05ca1672b71182f15c3f359dceed951

SHA256
5ddec1f139c36173c02bf6d2a373b4f83ae733a67a9bcdf9688fc85750fe2ac2

SHA512
b564fdd3ee74007324af65467058db80c5b7250b1a36315f33eabe1e1bb7b5df9f7b69fc90beb59a9063c60592aecd417fcd2e03ddd4bbe4b9bf20ff891f1e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c933d0ae9372533502daa8e71e93d0b5

SHA1
13814edf29506b20cd55c1cd1bcef9e22cec01b9

SHA256
03a4b97f31c5209ed8c27532d5028c092d3fabdaaa1970982386e54de4104176

SHA512
674e6835ca098d0e1501837c967f6106d28c19c31f6bc93acb0fe643537320da6c32834c556d3dee269e1255f78b3bd84fc986a605b60f5fa22b967b19074732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e0ea648a5f244524075edc7a71d0e075

SHA1
5824a014633444f55bf174d082ca6650479efb8e

SHA256
513a04152a7f723568e2714c8cbcb907c7630e5e50002ff30688d7a95843faea

SHA512
17989598daf1c3712888e92265d1b29122ca5b6fa4f1d2549f431d1a66c0c9c48d68937aee7bd0b6e775f8a37fd42c8d64dc10fd80d87051df255dabbc78b8e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c3035f97505160587f9631c169376564

SHA1
c6c8a326daf74c87304d2d0283ffa8561f4f3676

SHA256
ed663873c3d93290ea580dc5323ddf710a2d8f20ec3b2f7945c2235b3c5c386f

SHA512
143702b9b8c9a68b13f087f7682bfbc750b3d46c537a861dcad583f807aae8d61b9fa97ab4ed5104e29157f49957480f4d3d07bdc1caec30145235e0f52a7e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA833.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA834.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit