c3610c738cf7cc72ca7e2312750c94bcd6097bb130405e43474d44c3b4100d5d

Analysis

max time kernel
69s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7UFbpi.html
Size

520B
MD5

2073b21f48def9cb51281c4e35896263
SHA1

16f1090195c1be67dd960ba4649b404846250321
SHA256

c3610c738cf7cc72ca7e2312750c94bcd6097bb130405e43474d44c3b4100d5d
SHA512

4fecb3414899556435e6a85a4bd8f013d347e055ac142e0878eda0945a19282c1cefe80b12c7992eea1d9b56ac981a6e864ded569014352fc7f29d4018e49485

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70804c96aff0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C16F87C1-5CA2-11EF-B39C-C278C12D1CB0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430065826"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000db310c42fecbfc106238f0c1ef845bbac042c801696802260669ab2cf13fa2c7000000000e80000000020000200000001438c576d0145d8f67e20c3dc32f2e50e685eeb993620feb8529b75c8eaf85ec900000006559652323a1a3f887e85a8fe27b1cb7369c73686505d2096139b3df8bd113749d5d7c441b523379c56e4f4f441478096bcee4391d46dd8b9a5a9c7fc9ef5e106ae6b0d7eb04310a1e95f695e054396f2113ed36da6742a6ea7fbc8468f3469e62ec13b154a54898e6947de9fda678d462919360a9fbc2050499e2c67640f54950159a0893448923e4aac889f5a3554540000000fc31ddd5c789ec4c459bc71bf9bff00e6c36d9008000bf507e57590537dc756261f063439572aa62500cc4b5ec77021947389cb7358a8e19e59b6b8aa19c7ef7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003b221b9c9ff851e54d78575495984f6b8fb5f3b8641e8142cf77337ca333e9cd000000000e800000000200002000000030a295ef7143535f5e0d7785bd891ef025c37af2da4c24c8e6138c8424f7d05720000000912d91be1ee2297b9c8b89b16281ead7923ca3be365eb611299a5ea9d66d0030400000003d9392819cebcc295861f7315ebbaa535af5782bd6b6a7ce4caef60a599a2521b3e1b487b6d4f2a82818d6d3dfb5f347dd0ef992aace4f3bfd1cefd9342dff7d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7UFbpi.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b255b32b1a86e32b0c1a8309eedb520f

SHA1
b908a5d4ed6440b2b1409ffcc86b825c646fc771

SHA256
742d33132b258f7875213a0278b8ed6fe8e8b121f23604816f8aeb2ff9abf5d9

SHA512
d5f4fc8302c9970625014333ced6bb0545cf63207af923746f10adac6514aab89ef80ace4bc13751d5c66c80de24e9f1dfd69f55fd7487f774ae14f066f85f5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8bf901f5487dc7e807961ce6d3ab5ed

SHA1
8053293561b7f4538c22de87bf94f31a5c372772

SHA256
0c27a420655fd00970e232f8dd9e4e824cb73dbdc81cddcbc17b2288d9f0bdb1

SHA512
76c2c170d2025a9254e49ef51717f289dc21703892a9183cc9f3fce539301d29f6a2e1f0ffacf33b0d2ca73bd1a71e4db6d41f2b224f93f84b05ceb3b4ea7c83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ed6d0991bd8417fba46c0ec53cb580b

SHA1
0c0530a6f61bfbe29f23be6a068a2aa880a194d2

SHA256
9559978fe0fdeabb58de8f9c269375bfd48977773de86f742ccd0d2e7dbedb47

SHA512
2549c8cbe133eeb2ab4891c68169a7eb4f37dbb647789be201cd6890696376577c4a9d65c3b26c01b668f197901eea4587f6f2eb4d3177df5062b09639affc29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
226a8151188a528a52ead7007d9120fc

SHA1
d105da27774e088de5c545b22456ca42f869111c

SHA256
f3746958a48f348ee0a1b46b560802d9a822ca4c98e96070d5a797ada37dd839

SHA512
be34b7e78aab3fc09f8cbd046156f02d5fae403b66cd40c49cc46be4c81c23f02714f38a6dcf63f5b4e40a83493199f430651ec077d43751b705bf7b2a64e1c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0da3d8663e434653336a1248a9d611b5

SHA1
0949f8b7d9096159431bded6048b3a79c8bd9a1e

SHA256
dbc7a119c11476301c38bfd1c27f701c640fad85821e2535aead44c9b3325d4f

SHA512
b4c694559b548f8942292b63df36ab95bad40a23c73e4c9a70f16e274f78037a0c67da0bd5e5dc975f661b6d0cd3a1f7fa9875a9eb557c2bf65795e5e154b4c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64fcf603101247d400e45efe76178547

SHA1
5f0b24345300cad5b3078f232039c9cf23b8eaa2

SHA256
1cb3fd560349c094340911638d38bdfc0df27079e2b35777a3a0ef033ff062c2

SHA512
65ed77bfecffc6913a7e61751f1df459e504c054cdafb8357645ec8a758ccce42d2b6e7c50fa8a3cd9cf01a271a0d1950e8e35ae872327c5171565baac9e2d36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e77c83c0aedcfedea64b10813ff1eb

SHA1
5898fb4b52e899713b6cc09d9f39ef2a1b6538cb

SHA256
18cdb473de2dc08f9a0b7a8876e2794a2d9002f5640f1765390f5bae7c97b13a

SHA512
0af94acbd3006609762dd43eb6a5ae0a070f0909412226d493096fc8e72bd2e86c43eed8631370210a80ce6a7feacceb4f1b9935ca76ae27462f47923928ce28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d52fc567eecc935b476ba47833d6fb66

SHA1
7f57a3816d89a9fcfa64a8b2d9bbb7574a39b419

SHA256
fceead8770ac9d9e245cb98a15c0c5ff3f8269a62f90965fad4886816de9656b

SHA512
677b45845423bc34f9170d17cd2b1f3b4feb78aba7646cae6ba04349e0512d21ff1eebb3055ab9902497c818aefa4b833189e4a363b9c6af5108544f75eeb953

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f64db1c49303688feb3ac7c027a431d

SHA1
dceda46d04b33b74775f1c559edc0980f493a399

SHA256
81f3b3fcaa6e2ff352e8fbc8e2b64f519e242efb6e1b83a2e23a272f347317cf

SHA512
bb5be06891f2f4e071f935f5cf37d2fb8809741b210263ed9274aec8fa454d67f347e7a67b01adeaa989f77731bea2c3a24dd1ecc920a156350de91feb13cfe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9717654c6e469795b686ac0132ed1f76

SHA1
4895d77258fd5dff58f959c83393dfef8ee23cc1

SHA256
bc4aaf9f00a74861e661e070847c78feb28d572941ec506682a2f1707fadfd23

SHA512
77594320bb3df213e4abc4ef828f20c26a25f4f7b40bc68d79055776957bedf7bbd72fbc6bd380272c57882fe18704109a4e18297066513e9dfadc9ecb915e9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb1e9a125b119b9de0e56a8e9895026a

SHA1
f98486466a79795fa7e8d827ea6b2bfa1f48580a

SHA256
77d770ce4cd3676f479f21feab0b76e5a574009bf801d7c200a6c5755f041e1a

SHA512
f1f4b62291b9f87607ff04b509f153c0d81a070192da066e156b190aa71d08e5e1653adcb5b2befe76a5b00f03cf94728719a78702f4815a757d61fca17ea62e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711322a050b9b3a2c9960fcb9e8bb19c

SHA1
f6c36744802b19d43f973103425797bff5f9f610

SHA256
6e2f309338487ccba3a2da7e9283d85c05abaecb9f8a2b80f4e80790b5a9f130

SHA512
ad3e274c170b45b105a5e4eb04aa6a877f19a08d9716501fb0496ab1100c0e1f39029c2e39cab4826902189baf1d5c2fb3b650582061747973e83f37021ad685

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c1d1a8f53d4d5e2fda4ff1622c6cf8

SHA1
7cb5d3e49aa8c2a5fc0570ce79d8e435e48922cd

SHA256
6098cefcbcafdf60a1e71f02ee583b1998bca39c63afd9cbbc8325b3b163bbb7

SHA512
93da99c00c70c3a77456bdc6f9cc68b09d6bff09cf76f9254e95135ae40af9c72a765bb777bc75c70a9035d3b43a611ca376aec7b553c3b31d48f8f739de97da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42792c51d03f65b203b548a537d0629d

SHA1
71bf10033375af1b1461e8d56275bdc5de252543

SHA256
d6c93e447db219f5243f8b4915cfdb26dfca86d0037370ffef1298bea7051025

SHA512
66be030ed869517c1c88f6f6801b10b0a935de79595c4cde52de2a1f7a4aa84029d83241bb8d0e3d8d2951930ac8c39f481ee523062e94d7d3f946e40d86f899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b297ea1ccc8858375630e90fc47fedf3

SHA1
add09e34a9aa910b44b1edd53d73a8a2b9f3b86a

SHA256
d2d8b9ed01f020dd6c043707d2a6c6df0ccb5ae15c6edaa6c19d014286024972

SHA512
fd885c1f20a5e1425395c21321e32c86cbe52baf455eee7a12c40567585e45b574bff17c2a359691bf6ac18cfe6a74cc06d89a47d1b1565f53ef773e637a0067

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar969.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit