933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

exe/non crypted/index.html
Size

360B
MD5

6eb00be1c3f69a79915a5099511e7eee
SHA1

5d8e5a97d6273ae32eb12d10c35fc0f1da668c90
SHA256

67b9aee949ea0c9afd1e408a78bda767ac38fe2386626abe844dca4c754425f1
SHA512

7a3d896307440ddebfb04cfd5f8d09ad0b75a936ba6a7db3440f7ba049564e7380f26cad55a747cad111060302d907c1559e99335f948c9fba2d5b4a3c9a8a3f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003d96ea315cae2615f623ce2c75f0a226ca4aa78f2eff6b3b52548f196b0104b4000000000e80000000020000200000000c6768bf817ebd76276050d21c50cb62267701b10706285a76db3bd4c68ace302000000091524830d10b6afe31a923b3ae181bf13c6bc6aca0f3da1239b55cc173bcfe2c40000000fa0461af80194b689cdf923fe3aeb94ab9938c35d5320aad1431011a56c72353aa7c4294dc4cefaf7c030d03f3d1e606242ea6155d7afaa921ceb4d0dad6c440	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6067b566daf1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{922F7FC1-5DCD-11EF-AB8C-CE9644F3BBBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000913b5b754003fc640835a93d84948ea8e73abbbf954e05e27e39c9af59add4bb000000000e8000000002000020000000465e9346e84e5e4bff7cfac3fbe646cd0e7d125bf3ebc3b91ec963229116aeed900000002d3d01900afe849b57b7349cf63f3605e1c0af0a31a99ac055cec031760411db83715ac3f024c4e6bbfda0fae0eaed090a734e58dcd9b9925611aea654196e0799f7385b632b1f94b8433f812639051f101534cb67e0d2c7b1220044a96cbd2d871b3289f9b5f9ce7543198e30838be1561f8152a37f4eb35b63422ead55358986254e60a4057d892fc4287b98e6315640000000020c83f565ba0fbbefd21ed785391c5e0e4649dfad0c8482ef159136f5e89212f510bcca32bb548f4073bb2abcdeb7396b6fdff57b576072c0cf08880f12c416	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430194165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2580	1948	iexplore.exe	30
PID 1948 wrote to memory of 2580	1948	iexplore.exe	30
PID 1948 wrote to memory of 2580	1948	iexplore.exe	30
PID 1948 wrote to memory of 2580	1948	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\exe\non crypted\index.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0e880375871201136032c66ea65d9a8

SHA1
0d4ad1878de0d64448ee0071be6be74360e7cbbb

SHA256
a897bf76035dfdfa18fc6537e6a31742dc10801bfb3bdbf1aba8a1da8d56e54a

SHA512
7bcf246fa22fd3f4bf2a2d7e975cdc225b520a0dcc1dcb0698b3a6b02860adcd1cf45a1193a2892b2e92297aeb5e7c71ad64aeae8df5ed9306684b7417c54073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8a3ed58bb59fb66a83a4b76cddc342

SHA1
d87e4026e5d634a6900e5d90aa75106bd20abd6e

SHA256
1dc6ca99bdb139c68e06cf8afc4bd8f5ba77c281442dcaa29c3868438a41871f

SHA512
882e79c882eff7840f82bc8e6e70a15330fe50989938a1220f29718f323e875c258280ea1e42a1cc3036a841f91da0146dcba1e38f6c931c9e972a11ebe731b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd30df7df2acfacf886af2b192b9d1fe

SHA1
b97100de62ec68b219d2bf0cccaa9bedbd0fe0ee

SHA256
0a1836bc84316eb4a8f8e3f7bb50dcbc3e685264e70a49ff6154f5fa6b6a9133

SHA512
d3ae3e970d8198ce5d2fcde7fb99c6d0372fc6a93c410afddb266f29dfe91c13726e263521e2bc9437c79ac6e3a07dbbda4f8552d54f629ee25df6244dca5fa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
868f1de51cafe0af6f31d66a444c4927

SHA1
f059a3383fa004807dc20b66a26cbdd8d3e75403

SHA256
2f485042fde8ff7ea20b4991054e88048a76b98344b35fecc1de8e0571490dbf

SHA512
bed04d07271fe3c0015d69b094fab2d4940b1a1c6ea0a8fc848c7d2c85330772adda1d6dd38e5bd21d89d129ce47f36e7361af02d4ddf175af98b73091a5486b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dee622911d4bcd2ee1e69fd1d30bf74

SHA1
c424cfe05af9a6ed3baf7d5cd83523825624f11b

SHA256
90c6b69fda6f3fcc5472a7ddb5b05d454a7eacdbdab7bd508ffb42ea2e4af959

SHA512
89489e4a5246b94faf777e4b6ff79dd4774f649d89e6a23b5d61626d3ad8f5163b597fa283689eac1dcb61fb3ff9b3bb51b2057371e105302f92c9a563bfc7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb9633e83c700c4650458470ec5b155b

SHA1
ec517aecbb8313c7f88d43b505ac197813a9db39

SHA256
48c8e98b591dbb86c18099b756425d6a7152f3479850274ad4a7bf724ec2010e

SHA512
3e281d48c44683d9b08b793c6bee505e7a2cfc24002e86a8c930dc10769bd9349752c37b09e4498f3c5ccd58a60c64d94d871f8fc1cb61d825f929242cc1778e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c7d7fb129ca73102eee4c5f2f613f74

SHA1
24515ff304fc62e9944d47bc3cb16caf55e9f43b

SHA256
18174550481b5446b0ccf6182fead0c6d091401ba11f3f9395967ad1333486c7

SHA512
32af385f42a49698d965fc6555c61bb04c55502c4891ff0e547f53f69b2501a453d9c592f8645f7642db02293afe2b4cebe1204feeab685da7e8620e88d06b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07226d8ff51d53d660120d478fdd144f

SHA1
5659ba62996a4f8651b7d46a1f0e7c8e23ee17be

SHA256
8620a117ffd241a8263192cda39a3925d9913d1c625183624a06590d47c048e8

SHA512
b844043a5749d9402c4b9b97f5b10360ad59dcd3a33723407827d5680da893338b62e0b68647e26ed3493bb5451d960ca2d9f5d591143355a5d59ac884b224e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a879fbffd9f2708448b005a45eb8abf

SHA1
6ea86eda00903db5c87802b4971e475d40ddf727

SHA256
c80c1ffda3ab43c626fb5103b3f2fa4c04995fd8e6cb61cd480c35bc5ab8a42b

SHA512
e3563325c282f740bac7ff7ba60578b8e92e29f54ddcd51dc255bf4430145ef21e3dc217a9bffe2fd7cffb35988cb5bd9e7710aeb7d857cf7765d7b209c4f451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85e326eaf857fb71693ae0f3b18a8af0

SHA1
a9bc32db6b6f1858db369c589ec18f1a99409695

SHA256
32459c8707351b0852d0135b7cbfbe63143e84bd3bdce68b142f15f4823975e8

SHA512
cc084a7cc0b55e8e3e8e7b2bf4590f24b973044d0efacfe5e4c6be21e0dc182692f0491ccb99f23d7f9dbb8557419540a19a7e37e45dcf760786a7b672148ea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c06b93dada784416103536285eed7665

SHA1
ea112f4e566e02e8cb21536a99981c0e80ece4dc

SHA256
829b4f3d9ead5cb75df39b8a27e23b178badeee7866f0dacb3ce5ed4dbfa87eb

SHA512
005ffa6e0faf1a0598c21e44bce43c32cf6072df8330e9960d9504a21eb0c987784bafd2b04d6ca3b47ab7190198727417b90b3b5725ce9fe0a9b8cbb248a000

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC66.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACF8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit