da34c0e5af2501aa8af31f821149e31a0d6deaa7cc4101a0489b2abdd0d07f11

Analysis

max time kernel
136s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2IUAJLa.html
Size

2KB
MD5

0c30cd548d12196e11a27c915a57e815
SHA1

58417845640ae81346d28e04e94110ebd656c882
SHA256

da34c0e5af2501aa8af31f821149e31a0d6deaa7cc4101a0489b2abdd0d07f11
SHA512

784fa2faa2c3e1f72e692066e95980ad9d4c06ae7e003f433e51e06e2252030c1eace7344c83b6950dd5d6bacbd8292c2969fb77f6745081ab661453045fa216

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E220A1-5CCE-11EF-A251-667598992E52} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b084e9fcdaf0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430084466"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000cd39f5b88e690b48b81e32f58665e5aff08caee7767f519e7b2d3ab2c557d6b7000000000e800000000200002000000053f5a70997d27248f8e312c1e308fd786ddb1853e6fac98b65b213d77e3c8b2b90000000a081322c6d60adcb3b9eddde329921a2d19f43395251115dfbcb88db94f48c7f7938962416e4dc94cf54b0e8aeafedb33418e0fa43157df73615d827630862e86276d3938e070cc7472fc6b0f76260056666e1e431f0b1c35de4e4759f9ce526a4a13ec807e5bf06b2b3698c9a3879c80d3f31e8bc8c7aace6020b008612f84c90edee23f84b0c5afc2c6b83f24f214140000000600695d1ac31e1e587083e8a1e8c29bcee81febca81be4f92260e4e3dfae329d9bb731791ec4bae0a2a4b17f5f10efa7a38c67c7c3e12af658f9877ce26a3b73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008f8ca3076889992b44b4a961aa9f6e00a44f7b40f2a687b01f7549bbd0c1d9b1000000000e80000000020000200000001756c6322c30332eb9278f2be64bb27ae111d1b6d9c7bdb98c62b2fceac866c420000000cacb8ac12fbd468856f77f65b2a7c65208f9aa010cdbd8feecdfa9e7c8d1e94d40000000008ca63888cc01be65a7807b6a5f6865e8c63e94d5e550666ce1447bda092a34ebbc146e9b6ddac2b89b99cfe4a07ad9643ec4a645399d081864851db63e4877	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE
2248	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2248	2780	iexplore.exe	30
PID 2780 wrote to memory of 2248	2780	iexplore.exe	30
PID 2780 wrote to memory of 2248	2780	iexplore.exe	30
PID 2780 wrote to memory of 2248	2780	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2IUAJLa.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1a3491ce5d73d959ddf61bd1995217c

SHA1
0d606197f6d9ce484b0a221b682e21ffe81dfa3e

SHA256
382f2779e1b3bc4db3d477b7a457dff6d0450856b0028fe39835411260d67e42

SHA512
557de55e618879ce5ca1986c09f7dc4c4fe5cccacda701f38eebfedc3088aa09fac63c050ee2635c3d5018f2b7349980f31b4e33e86af1427bf4e58efb6f4be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
741e9688fe289c837ad1ee4a74c0aa00

SHA1
a91701cc61cc223142c7b766b6e53f385afa5344

SHA256
5e3ce56e365d1d98f6fadd82a4478ff65ad78a2ab050e9f171cf99d440b50ecb

SHA512
69efe80bba287dd2016bc9ff93168767e271a457ed62c3039d0bfcba6b6e25b89c122a18f6d3b92a214ccf4ff1d0490b4cbcc0fe2ab1bfd657bb54124a08b025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd075262821bf60351503043e953f692

SHA1
ca5fd6d99d95c3d65e9662dcd91127cebf668a44

SHA256
6a31c0a7ad32c4888afad698b57ee344ad1a6735f02f51ad7c640b66ccf70a54

SHA512
8d3335c5aff3e7054b57dd9412a312e5216c581316009dd119e07d7e09c90f0804759bf21812e034f391fa48aad56e781f3a0cfbd6330e8e233fbe2506499a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fec6672f5a06efb7f397f4d0a0681e5

SHA1
eacd9e638da71db6175ae3b6b9d9f51ed25460b5

SHA256
783afd9d0c029713935f0a80740199f46ab667734885e6263dbbcc7a032dbfc5

SHA512
b851965b4303ed1bca0430f8a53ad0b0cd6b241ae5547a124ed17a49055d3ee24cace48925c556de1ca377c4fbbd5f480283f044d591bd597b5f0e9dc72770af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d30b2b933084ac5192cf3a9ebd6c43

SHA1
97ee41a8c0cd7947e347a045f64ebdd13ccf6fd8

SHA256
ff8fd31798474ff8eab5b5cc18b8da7e8c37c00045cbeca7c6d4089169c750db

SHA512
58cbf6c415ff8c93891625300cd88a7b1f04af95a87021f8fb8aa7f50bc7a17ececae55e4ba250063402406a9746a2f5b93006931d79c1cc56a4da8e7534c3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39d765509cd7d1af13e82c30ed6407f3

SHA1
98f20eb7fbfc764982c3923138e9cb577c423384

SHA256
7f3ce4b59e287b38868516873d7ca169a568ff543dbef97690ebcc5f33e887d6

SHA512
01d116d116f27e47242061ad01fa31b92aa08a036208b026ee16fb9ad146ed00361bde09c480cd11765a5ea37226e704e273296bc920ad99c3648fcc24cf38dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe6f1a3a2a56757f2a6e1395ca92904b

SHA1
b98ea793cf1311ce25381c404666ca111cb7baa6

SHA256
28035faff299e3429ba68c8b6ec141a6ce24ce2f6213104cdc852532e93ebb9b

SHA512
34a743304788da86f09a7c910d6f17b25647e4f63457e7ff04692455dc7a8a764d9d47565f00514f7e057b5cb0fbf521686003af9830cfb39134a51d92296bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d18c76007614b3f22e1440fd47e0f03

SHA1
ae8ed00fae7d792761ad432ab798b21ca4a1d1e7

SHA256
5544c1f4d7cc42c3dc2e2627fa1b6f5643648219ade66f2258bf07db00a99378

SHA512
a076963be0348fc1d10bf16216affcf3ba2a5d0f58fd2966c0c889f8e1170b74d224f2622903cf836745d1136e91f34a16a6c453055d1c06dd8943a1710e6ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc8f53ad51ddad4597dfd80e0904ed8e

SHA1
c038c3b74c4801ceb93062e856c88e528d25a27f

SHA256
2126d4751ec4abd593f5fa9d0f71a5ffa124ba89513e07c460bc2e66b690bd0f

SHA512
7999f1b7f687a0ceab841e42609f5751d28d41d8ff2794b47ef7a958477424b989dea052833e4614132db0e72bafff2bb6f5a2455c5a1538e5b9fd337256b38a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8593421a40c2ef544ff4d20fe9f59b1

SHA1
26dfea98bcb5d6c6a3aa7f9c9ce4d90b45b77680

SHA256
127f3a66494ee55eff8c7f162f6753f17070a3689b3b4bd047a1a9aab1eb6751

SHA512
bba2b16440c863f68f75ffa4b65eaaa0715ce378310daed9d9f3a3e5783387f0e3cb2787bde4aaa35f0083708414aa0ad1b6fda5010d315eb2a03d86a1296245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41d26db7628c350a4fded88afdc552af

SHA1
a470a675322df1af198fdfaf01638c269e74a9e2

SHA256
ebcd146e15ac7a381187b6c323ec4dd5e5f1506f279ecf7fadc34f0df4fb4526

SHA512
3c95ebf0031822929de91568016f9a81b2d6a59dc95a97d60087e9c6336cc57f9c4fdc80901616384573a8a7729a2fef7335b107c313a058425e74fd6bdd539f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
474ec240238ad63d141381d7a3200856

SHA1
629d3bc8f4b56d7ecf4003a0bcef0bc9c91533fa

SHA256
c30dece4f7685698158b5ffafbfefb6283e1a7dd8c9edd5053a9bfb774daa57f

SHA512
e2ec767814e9e08e12183f4a41a16924cb31bafb2c4148f2e14c147c1deb948777d3d72061f49aaf2b12c77bcf941e8b697333b5af941020e164dcb7a12c3982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7c9806f8a105d13cf427f284f91215f

SHA1
d4a4468178cbd7495af0902da028d1e0fce11cb3

SHA256
685ec39243e69964ab286a16fa2fbaedef65119ffbbcf6f4a0c8a39888d65bdd

SHA512
d76a6a4a5e2d37ec653a377e4c09141c214e3f636cc9c8169e36a4bd9ad2d56f35690d96d8865f1520bbd4314b3975754e5869938df369116cf243b8e2493103

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD4BF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD5AD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit