Analysis
-
max time kernel
74s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
be0eabd72e90807739cb0e441bcce500N.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be0eabd72e90807739cb0e441bcce500N.html
Resource
win10v2004-20240802-en
General
-
Target
be0eabd72e90807739cb0e441bcce500N.html
-
Size
25KB
-
MD5
be0eabd72e90807739cb0e441bcce500
-
SHA1
4dc28c5992e3cb08af45606333d4b44322513d8f
-
SHA256
1723d99a51ad87e849cf26a4e3f0addb7bc0b95a2a6787657cc7dbefb96d3a84
-
SHA512
0eb01af890ae7926faba0243a1de5949d86da330da031f39c59e6e883e88809cccb81ea76cf4c6ed39d621659acc25343ae2fdcceaef13ce80c733630a7a9cbc
-
SSDEEP
768:vOoKIRIOITIwIgIWKZgNDzIwIGI5I9J7SzIRIOITIwIgIoKZgNDfIwIGI5ITJ7Sf:AIRIOITIwIgIWKZgNDzIwIGI5I9J7Szk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{033D9E31-5C58-11EF-A4F3-F6314D1D8E10} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000c5393343150de8eb1f8d476ecf75c3eeabbc0fc31ed1c863941c2ca0f89eb607000000000e8000000002000020000000092a5f4fe2a0dacda1db9126f2be40b3e6586fbdd5719978f75cf3d607ef3b289000000074dfc7864346cbde340d75d367e09fa4232761644c13d51cd424ba68e0f01605854390b6b64033f210278bf1ec30797c27415c995c8b8125bce3c4e468691db8de7f50d2d8f2905b02e2369125b9512d2fac2a617ffd1e484bb3ac70fc71ef013b96559ecce94673a122ba6dc4cfcc3a504417d5a151e10d712199c0a3a8a291e203bd5422711939f73e94ed2fc4e91740000000bb5142a2893405563e99ed8c9e6fad03963dccede42cf9fd2e3b778df0f1f7e35f8be5f22f1ead11a37e9bb0e21290965de0fe285decdd73ca614f4a3a223058 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c735d864f0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430033730" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001e276a46260707ffe40f08eace61c5c27fefebadbb6edaebff9d3ace810d6512000000000e800000000200002000000069611a0e6b4cabb2799cdd83dd7de100f4c7dc38eb537de7b77b4466420fb346200000005f74f0aded7cf254e59d97f6c2a8fd41a0cd1ba23e295a7cd570eba7e26076e7400000006186482b176a0c9bfd1b5da9e0d43bcc1203811c8dc9551a14309e8f0a0e95a990a753c044a727d1b56066600f7935de82ca52ed0786405b7955b2ad3d47090d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1872 iexplore.exe 1872 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2472 1872 iexplore.exe 30 PID 1872 wrote to memory of 2472 1872 iexplore.exe 30 PID 1872 wrote to memory of 2472 1872 iexplore.exe 30 PID 1872 wrote to memory of 2472 1872 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be0eabd72e90807739cb0e441bcce500N.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5059c587de05accf334d1a5c4ec39d375
SHA174ea71182a609ef4d39729c816b3b4f477938eb9
SHA2568423f806c9b06ad75b5e18422a564a82c6259e31d3747e0256df79a218d09fa1
SHA5126aa4da840979cdd73ecdbd103610a5bc9c85923190092b6f1c4577f2a32d9114650eba66602985f9873b39aa38fce88e63d26d65f6a1bdead9a38f9af98c8aa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b74e7616872885ee3d77666337d94004
SHA17e0847b8293bac4f12e53d0f5e5da0536de7cab7
SHA256797d1abb93396387f324089e3fa499dde9dae729d1da3d69d8d5209c5b2b2a73
SHA5122eb994a39b26d1166fa5df2e2ab414ee071c4611f8caefbdab00fa3d6513c22a72c51d7fc50045aca8c696322ce342b534db054aad808c5cac3e966c4e623697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f9156fb639033fc96cca618fad0896ca
SHA11607e58396c93e4b032b72e724aa6d9f477b2858
SHA256e7dec35a32fd52b4a83d33ab6761273c5bd92c1c133969e4176b0e94ed2c0ed7
SHA5122a0785af624e5676714277b2e8faf8d9444321a37093010d67c8bf20ce89f0b05d583371407fcccc35a2094d02fe044cb4496cd8a48bc7506a25cf496805c590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b9ad67520a5e4b15ce4ce28266ad078f
SHA1b7812a41f7cecd89000a5b521429a167228d07b2
SHA256507a4ed032e725200778fc19fb8ebcc470159b7dd8555198a1d73b20e6db7f41
SHA51261241d0be3960625263c12c51c8c94df8aa2a6e24cc73f7adc7e2ccc125e5b1d82d3e0b5d5d51bead889beea473c1b3f683338ea7f003ab9e2185573e29f0336
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6c530cf0425f98392fb289348b050e6
SHA125422b505a70f53dfcc86f8fd1eb8f53d9d20224
SHA256907f3266dbbe10b3cd1fe5f99840aaf617a17dd2f6798b5cf55da1db14cf54bd
SHA512c925c3346d5a9519e29f5fdd7326eb956b726306e07f4509bdc7148ad769a102f168a6badc441e28294dcc248a89e85ab825787fc39ab4e9fbcc3d978c34763a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58da2d2fc2f5c05f4b00746eabb43e0c8
SHA14d35da4329c4a109a55c9d00419f884276f2c266
SHA2560942f63f227ead6b2866b92b5c5362104e9a070dffefc4c0800e2157a2d170b8
SHA512698592b2e3e49e994562f7c2c4915cfa196e8df780fe13b0b79e44d2d982f68eb23b7d9394e66a5679a5ac4d4abed4b814e5780dca47e85f0bfddff6312ec7d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD585cf5830f1785b967d6b6e641e2cb9b0
SHA1647121b03ff69d9495b4aca6da599d100391b20c
SHA2564f87e30bcb4da94b7e903b4fcee280b7d057e9e7d393b28ae23c7146bb058ddc
SHA512375e8d4c7fc1a54b95a18d0dc66fd17ec0c29256586651c3200ce6f233b3579d31aa376e224950dabe1253d81a783b7cce46b9d6801b25f4b7223e1bbf9f6a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb231651af81ba435be452e09a018baa
SHA1bb5d9beb56d35dbf8d486abe20110c8df34318ff
SHA256ac4b249b1c4e35f2abbddae0d933ef2c2e5a196e887de3f0438858deaed9925a
SHA512de26c0f8a011f37c20f05f27a39626e4c4208df52c8bcbfc67191ff85b93eee078e14c5d243a849eda95fb4a8cf7b12d1ef075a35aacc4a78ffe889bebd32871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5651f9a188acc4470bfdb22d0a99dec5c
SHA1ea6dfdc965e268f5980a4b6ce3a695a73951d0b5
SHA2566a4c1bbd347c60f42913658d85412bd8fb09c7985b1634e93ea090edbf949831
SHA51274dc995f00ca94dd2c80b5b5fb9fd11cfdeb75ea17ce239d95301a6422c2ccdc1b3815dfefc40bd9e67826b00d12bb91c44f53ae420849fce87d4c9a228c083f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2f957da06e1f1470c410ad7c7cca5cc
SHA1ac6fd8a439b5f2687bd35871252f9a3fe5e68112
SHA2561ce2a1a72488223ac35fc77942bad25aceb88401f327603ff38c472132f5666c
SHA51265eca3e35d759cf995269b2b0d2b62d66f346ffd3eacd491959f1c039ed30853f6fb5cd47e329075aaec5d4f8e0915afc9c3b16294f9c29e1b6149733e66e3bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5057c5a4b7645e2d1927957b4fc4d3c9c
SHA1c0aa2cefa05ca1672b71182f15c3f359dceed951
SHA2565ddec1f139c36173c02bf6d2a373b4f83ae733a67a9bcdf9688fc85750fe2ac2
SHA512b564fdd3ee74007324af65467058db80c5b7250b1a36315f33eabe1e1bb7b5df9f7b69fc90beb59a9063c60592aecd417fcd2e03ddd4bbe4b9bf20ff891f1e30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c933d0ae9372533502daa8e71e93d0b5
SHA113814edf29506b20cd55c1cd1bcef9e22cec01b9
SHA25603a4b97f31c5209ed8c27532d5028c092d3fabdaaa1970982386e54de4104176
SHA512674e6835ca098d0e1501837c967f6106d28c19c31f6bc93acb0fe643537320da6c32834c556d3dee269e1255f78b3bd84fc986a605b60f5fa22b967b19074732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e0ea648a5f244524075edc7a71d0e075
SHA15824a014633444f55bf174d082ca6650479efb8e
SHA256513a04152a7f723568e2714c8cbcb907c7630e5e50002ff30688d7a95843faea
SHA51217989598daf1c3712888e92265d1b29122ca5b6fa4f1d2549f431d1a66c0c9c48d68937aee7bd0b6e775f8a37fd42c8d64dc10fd80d87051df255dabbc78b8e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5c3035f97505160587f9631c169376564
SHA1c6c8a326daf74c87304d2d0283ffa8561f4f3676
SHA256ed663873c3d93290ea580dc5323ddf710a2d8f20ec3b2f7945c2235b3c5c386f
SHA512143702b9b8c9a68b13f087f7682bfbc750b3d46c537a861dcad583f807aae8d61b9fa97ab4ed5104e29157f49957480f4d3d07bdc1caec30145235e0f52a7e93
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b