933fbda1ca7c4a52adbb48d038c8ba5ed5ee411d1096b2222ca383ca6d96a6bc

Analysis

max time kernel
136s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

apk/cyberRat/Port 7262 sample build/index.html
Size

331B
MD5

a1b267742dd8aa08e549c632bd4f26fd
SHA1

4d3b8c2b16554bb002dd825cf40d24429e82c08b
SHA256

76ddc2872947ba922fb13e95c4122710431c0476f09479a282ca6a3a0e60bf4e
SHA512

df1af12e0511edb7b9567fb0230fe5fd19acb3c0571e153285f340c5a3b897d9c981c2fc2460422c55e5a430177a6deb8f54db115258f2f2c2a19076bf7efa3d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430222565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B02463F1-5E0F-11EF-880F-D61F2295B977} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000168371d43ca5b119a233618f055596ad1310c08a40e4647e1a299f37ca78cc48000000000e8000000002000020000000a245954ae1237b18667ce96070a7b8a734254fc030b30784124b0819ca71a298900000003568f0294d33b4e55200a9b3911fde42703de3225ffb44db884d0ec1045cc38872e5beb2a1b6c40cfe77b7d2600620edb953bae1dec1eb08d32b73741fa601c91c97a136fda13d450e7b51196c1a598e26dcc957e921ce11558fca505814619e3b2c73af8e8631c81987d61976822adc1fdc013273641c367dadcda1be89335dfa756c1a92f769b4766e22d349e4461e40000000da9865e4430dbf82357b6161d2002a383c474509b3d9f6eb528a03f5be5c62825811dd2a05db5c06cd360abe6bdadc8eb38756f84a4d28960878e4eea96291b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006405ba8a1d161ad738c126bea8443163aa19efd248a4da558ac65b84853c8791000000000e80000000020000200000001ed739775f936307208eee41b768caf8b01eca0c0690481e73a358f02f200e642000000051a8a7e421a03417ca34febc2536a4480f8e50b93755fee7fb410e6c789040894000000003bce3cbd78c62a4b5be02c27236b2e48ac236963c37682cddf9cb54d3584c15dea1d1f10f4e8f52f0a3bb843c20535e951bb9a4d759073d623d21f517be897b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d436851cf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1836	1924	iexplore.exe	30
PID 1924 wrote to memory of 1836	1924	iexplore.exe	30
PID 1924 wrote to memory of 1836	1924	iexplore.exe	30
PID 1924 wrote to memory of 1836	1924	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\apk\cyberRat\Port 7262 sample build\index.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3214f15d4e459634b3c2a5c8514266

SHA1
188cd4dcde7414b6dfe5e0e4b8bf0a969de26516

SHA256
7b0ba5296d3b9c26010cb376d12df1b2de8f1e7df5cddbd41124baf5ba7054a4

SHA512
e3470f6a77cbe74bb9d2f01a27838159d27fcbc9b155bc903a8ceea2def961cf5a5ad7de4cf8cd76c14376a111550115574abf1244cf51485239536f735990ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb3a0e1fcd2241c90887eff7870a3cf1

SHA1
91b308493d3786f319581431011f61a919d301a2

SHA256
4026708498351a3610022bd52c459959b2c0f7256eb72be3ba7fce37d50febd6

SHA512
870adbc2ff28721e3c09e442c3fff32bfe297521392b3f621452ad6f6c8a42ca1f68343588cc9db70bea86a0d9e74e1aab314a8f702770b359cd79ebd12827b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2159037992038d022138d7ff2d1f71

SHA1
88d6f2d12ddb950d33f834528ef563f2ff79dce4

SHA256
0d3f6f437666f30220077ba3d7236c87bd57ac4f06a93f6e97e6caee2febc701

SHA512
a306776b3ddbe707e91d2ee4c3c285673cac4194d3057d2f57caef4ec7ea60536ebe921e9afcd4ceb5d3c110bb9e1f1beeab4d40211e6ce0620da3afc4e910cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890f78a3dd1ca5b1f32fa260c0ffd9e8

SHA1
eb3ac1fac5efe64e422471b817773305284568ae

SHA256
8e2507ee6e9d966fe71c0fc1643c5b55e0fc29540e3b0222fe9a9dd78ca53285

SHA512
bb9ad702b0be033891b88257c56ed148501f431a8b85e81b5a9d07206859e54750025c76210cb018ad447dd94c985171fe86463db47dd3f8040968a3ba68ed59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68a568fd2268ed14ca89291b6af4171b

SHA1
aa87a3ca37990d6a275c39a9f13b5deab1ae7c88

SHA256
b80e3854effc305316e1d3929d43d19aacdfd9321d54ba3daa02ebb48f38fd80

SHA512
7526cc68389021c77e41551f9e23d4c9441557d7c30957a760164b1415c25ebd8624b82b878bb48954a3444da8d968be579e0430fc9737f3f6c1646e39a7873f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf6944a94f896e030c352e96b85892f4

SHA1
71fad55ba28829a517259d22e18f07273c36dab6

SHA256
0e27ef6925a4feb65c2e34b6973217cfcd0166bb1567c9aba0f075d76719552f

SHA512
63d2bbf38b11953bbcfd1b097d7b5815e8e77134612a65a6fb717fb287600043aa98ab975d15a54c558e50c698306ee92ab82cc475ef3d33e44f63dacda1680f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb83096dde30ea34684423980030d542

SHA1
133cac43639d7dea3aa0263ba8c094e5f2c64fe4

SHA256
f3abf062cecde966e532eff7cb46e9c4c514ee265de236800075c09a1cd754f0

SHA512
3e94e7bb7ac0c8d73a78c469cae6da34637599d7c29b3bee4a7ed6e41cb918cca63611788f3d9010be9cbe2b49be19098f71ac22c32e236e2da457b7dc0f3248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5133d307a167ddbaeb241884e9e7df90

SHA1
b8e72340c160bccb3c8d4906897a9f638ca9a973

SHA256
19f097148616d3436b598e6001e4144a317d65f53221337c96421340f199de2e

SHA512
4fb7a8e5a71def643a15aa826ca5fa5b16c2bbcc28861cd2bf79e181769e314afcc72a6552bb0d212ac9b8f1997a127a69991ca5b151df3d492b98902a0880de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c567791c42ddc3ef5cf9e2afcc13212a

SHA1
90641fd8a5d3d32d31122679e8ab1f19795cda62

SHA256
701eb45728833ef3edba5eaff7566dbf42883574c239fd79e74334fe946ffa2a

SHA512
66a373555bdb5fa13b25adf8268f4320f1deb73fb04ff65cf09a032f3be85333d2f2a33bd195cd8cbeb760e62d8488821155a3f94b65a0572673bb4249352553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711ab47453085f848b4db8e9584f0018

SHA1
bfbf1eab1fb2e570bb03b09f78ad81333cf13fda

SHA256
34488400d59beb85deb09ed5106dfbaf9f06ce40505f3acffe03e4a2f45c13e1

SHA512
f6dd57860dce1e135d1eb1a0a87088bb4b0d5e5ecb50f87d5c6624e177546531335eba3d6fccefca2550f6d8e5de8cc110c53ffb2154e35ca5a2cc2c42be9935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1024e196de5c28d1c5b034568ba634bf

SHA1
1707b7502ad59ade00544429316e73ed47527763

SHA256
aaa3b00fbb03a5a4153830d5865d35a2a2657b36dd5fc8500393c051e8c1a216

SHA512
51f61b201bcc049e84b61e8c717e7cba07a253434725c5a85f803c33c6c5a5226942f6f30b14321c1e8e8c32b91b35eda1f5e589b37e80e3f12e50d31bbd4a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
160108d8c472f59ac7ab97bddc36dcbd

SHA1
3339b56214b948a00a6c4961aa30158b3d95418e

SHA256
cc513f2f0ad5f7ab70f0464e151d13fa75a8cd2f35ebb87aebe104c30acbdb5e

SHA512
0ad1a7bb1753c12d537dc7eb315ddce0fb97ad2496ec9e61fcf6ad2d0bc816d6b2629fa541f15b59b819224535407f10b11eb65b774c5eb59f76e96d97aa3a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99f911c8d7260e01d02aa1eba044c31d

SHA1
cac7b55c87b8ceb20bcf84bfc8a8adf4bf55c0cf

SHA256
f89a489ca3dad1eadd29bc591a2439500d97ea1468304b53803772c383e97d26

SHA512
406e41d8a9e7147be968232dcc341dab034ba3cde897d3b60e27b923b55211b64f7b3a4fbacd451dbc46b791544bb399979cd56b5bf107bc8761ab5a3f407ecf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be538e6e037a79a48b48211a10ddd22c

SHA1
18d66807f51c7929a885c84d391b8f4c23a63eb7

SHA256
7624192b1d460293f78ff41eedd133f66792c60d0b8149481facd8bb414ac5e1

SHA512
1f172d271acdde8ae58ffb0559545edd3e972169edb05d6acddca9e9ddcb77da10bc2fa4441d01b8fed63f6a8ef4936132ec8b547c3caba9ef3dbbd281ae8364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebfe4d4828ddd2371ccd61ec9f2a67c

SHA1
ba461d3196199656200ae2c568de7330566c4ac5

SHA256
83ed2e384d67113c33ac81996035175e89848fa422a62c1acdf94c2c46d98eab

SHA512
8fc8779dacfae6ed736c3bd4d1e641ac074c5cc41792218bfcbc7a7f30e19428abcec293c4b8650f6e954202aa0ae50b657d125026e0d6abda29148fc572f889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64d19eae2af57ba578e9ba6fc03aef4d

SHA1
e50f6b437fdc0edec890ead43ff6634999de0fe7

SHA256
e35bf577d60bd1c5d819a3d0750b34924cc1af02b20e8749d6dc2e93c6b3836c

SHA512
cb0a4c3a3349b7fc34e9606d8657b916a5ea4c163633fec83d5edbecfffe0342f2c34127a65ce6b7b41548e9e516d7a0baff0843c70fa1ef52ef617d49fd19a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
536a5352d743cf2224dad68a67a14e00

SHA1
ce1cc807a8585312cf7184ded29288753da14242

SHA256
8ad5dd7d8ae6d9fd91f12ba6e88ef19169c7521f7f5eb8713b7bfdd6e8b04701

SHA512
5325d4150f26f3ebb24bbe7ebdf550fd6fe852620d0812c3d4a65cc1625221bee1a9ffa0600743901c118c6fe4bd5fb6b4d7f57d6e938b66a97cb7b22de3e499

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB168.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB264.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit