5f270bde61bda98c881522139e5a051120bfbd987d4d891688dfe8ab816f0935

Analysis

max time kernel
140s
max time network
137s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

download.html
Size

2KB
MD5

0ff92da363760dc25a07b28cf9532d22
SHA1

18ef1afeccf83e424e10623526f8156211d3aec4
SHA256

5f270bde61bda98c881522139e5a051120bfbd987d4d891688dfe8ab816f0935
SHA512

0ca528857c4c3966c2a1cb6eba9ad75d91624f408f1e982613d949052fbc26ecba6fe8004533eb52ce6de664afefac4ed64dc6b7b40b9beed6f32ea1851ee50f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000f2d319dfc2beb740d5e95a6dbbf8d4fb235f193e5d57d919227cda5078db7683000000000e8000000002000020000000521c3ef7477f2efd21ef7bd6c06e3832da10d4b635373a49183a9409d5f7132620000000f640eb48abafdd03223997889de1ea6c27e85e357019124e2fa9d50d216628a6400000004fa3ce25abe672831d76b13c0f083d00c2d24506bc50b8f8daf6dc3f360a85ffc5e071058014ee1eb2912958a5080cef48040be7dc1d1df687177012f4907dff	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2012f06364f2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430253438"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F7361E1-5E57-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004605dc55c887bcee3d93ff39107cc9cf77cd8fbd46e45d0a617826d69c03499d000000000e8000000002000020000000fcd6e873eb0b306e7355ac802412a513e992f36e45fa56d8df8f3ccd7aa83fbc900000002ffe8dbe0efb96e1631ff66a9f3f0de9bf0d4647b6f61edacbb6a490e7ca89d06ec4a1b75080be93f9ffaf4bea6069feb85e003c8d483c9d19d9f7885348fd7311fbbbbb7f7cccb4c4df7e6c14a9a7ee99f2a2aa5b59ae16c8834d9c93cde66e7d695158b3c6c68a5da312d70fa6734ed91adaaf133312c51d5c0bb8e5260b7082b8df7bd84c2084324d75931df4410a40000000dc7d3efec2e15946300c18f0528e60e2c399444c2e7060dd0d39b3a7a55388e67e70982e4ce1c4296b26537658f2326a2920a1ef3776ac4e13880a478822ed31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2748	2488	iexplore.exe	30
PID 2488 wrote to memory of 2748	2488	iexplore.exe	30
PID 2488 wrote to memory of 2748	2488	iexplore.exe	30
PID 2488 wrote to memory of 2748	2488	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
334655f508135f77c3f85e7b99ab0127

SHA1
ef1e94cdc31552f3b0c133701cbad5466308f574

SHA256
234b5595a28aee6a328944fcf978f451bf60b3b1c79a9359603fb9c23ab4c8d5

SHA512
f00331139c3d8e354fa612eebb9ffe75275a73140881ba4854a3578924b18cc3c8613b5719cb3f6319ec570ab8d2464723362fca58896b230c5f14fa8f2f331b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
740eaf6a227f1ae105139b09b4bfac3c

SHA1
38b4d217d83b7e54403fc86b0e43ddd6046b7837

SHA256
1418528604fce76225fe8dcd86b90243142e5a0998dcc19f855fb7028eacc61e

SHA512
216744dfbc2c58b1b3d5054f215f3c1192f18722b729007f128c6d775e6080851e616bee000c27d47ce84ed2e82a0b5af6bb7e80840439e262f2f55d9d312009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0150fd4882e79d98234fb12046b457a

SHA1
f91b31306a452fedcbe0283e5059a4cf694355be

SHA256
c90bdd554b68837daa110a532fc0cec425cddf550d29b1d54d2a773a7eb54196

SHA512
c9f46b9ef2712bc9f0f57d53165be1a791b8794030f11b1e99ebbc17fe68f83a13345d1dc23dc963f9829b166ae9c9c76565e388e7c9cba88d52a7fcbb74588f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e66d5dd26ca78eea9628101e022a24a

SHA1
fac03ca3ff07498769e6f246bb6067e42ed78761

SHA256
1249c4445dbedf52666b451b344cd0ce1984d63f7b9a0261ab2311748a8b89ca

SHA512
760fe7d8bd9976d58dc07b43fb1a639aab9968ad8e8dd7c9eb5e2dbb86e51c0f9e216a0e01961c72ca74ade07470de9f999aa5227038795a31de911e400ff11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99ebbf5ec59c8b052b8a3c21c6a586ad

SHA1
7701958eaf33de6878d2cb082fb6c610c3914f6a

SHA256
4ade4f60158d9766810a54f4dc3c0e176d205b63d202122f13d207d803dad51b

SHA512
71fa0e5efdc1cdc9d361d87966890c87ce72a977a60094c0e64bdead3e5061e533ec0e492959af3f9fb24e6891a2a3b7d1e3c1e5d6073f71a9ba4a86163b0a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e2aa30b8cd88945a8b7c4b9cb7a9416

SHA1
1a584ef85febdf4c5bec952388ffafc57488550d

SHA256
b7fb693a7f39804899b95ab4faf308996828e8583d5bb2d2e9ae1311ba2fa82f

SHA512
b8a34bdc0cb8d7fbfaab0049197b45c2cab4dbef2e6eb10a8ac950e7c995a3a1b986d26ae936e74a7a1f5c2c822665c4318f12d9ecfae0df06653218b0f5f21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
749cdb9a2355dd44ba1831b1f6acd9ec

SHA1
84c151e44be40aaba874701b372754a8d341284a

SHA256
f4ea76e78e9e45c4396230ca6cef1fc18aa772e2b460f1cb97a5dadb73540ac0

SHA512
d8c178d65aa1c0d9a189f16c6a559f37be61490d0fed511aa836d945ba3ecb6a969fca4eafd08b39a1ed5da83923e7c2d608d9e823cc88c1e7bd15e550e4978b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3071696cc5af5c49f3f527eded02c1f2

SHA1
722fea4b392ad545cc84325a424f2bfd80a94572

SHA256
3b16295242ce179b16d91862557edfca48603c6d203d298e6f104548a9da161d

SHA512
02210432f0c094d2206d8944ab3d13f8769b024ffee8b6f50ef7ebb87cab34f67b3f81e907c519355cca232d5d5ea184152eb12d0e9558a65b5bad755ad8c046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bebf45d525cda9d7ab611d2398d72eb

SHA1
e93bea2721a23dc7f1a970409d879dcca6866024

SHA256
121562e7e4d9598ca6724689b91a68f51f66f5748a92045d24be93e6661bba65

SHA512
e81f498f2bfee692ac391637de71bdd9dad161a3b5990056857f4c42a572f64af827c8dccadfd7642b853ea1acb2685429a2cffe698958cb8dcbab7f13214b43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37b916addf624ada6b82364f7cdd140f

SHA1
4351023c07bdfff396852ee45f0e863cd43b17c7

SHA256
163b39554cc4e7fdd3418999c202fe8d2b0f7933ad71b0c5c2f8743c1214fa2b

SHA512
c0de5dc43eac83da54447905c4a3d97812c25a09e20b1059bd35c3e5cb956ccbe8b15512104d00da911149b9eff5681b1bd44c9703aad4b7e73a25a4e663dca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4d3b1f4ec5c77fa9187014540654e31

SHA1
9ca0e5cb9b4848504b50c7dc3d5ceed49d97105c

SHA256
8910183a6be65aa53bfa94dca46fccbd905068ea4b5b5dea101f9b0b46350b11

SHA512
ffcab0a8b604ff7ba979cddd7a2f9554040f2ab3af26c4421e034ba822c1e9b9e1718c7d898f475cf650ef870dd342b17ea1d21f5033601682a891bd9f65ff23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b691a06f636358dea358be77d7c13fca

SHA1
e2d799dbebcb62f3c176351d891f3eb55b5799fa

SHA256
72d5cd30065d3dcaf0e3fc9c03d45f019ab5ac4977fd4ba91bc7e0aa9549e2b7

SHA512
45b4814b326fe136d35abd1cd1b9a60c8eb6f5bcd3d7216d3a4f9353c2852b2f9a0ffa52a843c0486717b4939c2cc4805836b614a655025b60e8d2bd2d2e6347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2280e764c13deb736ba55459b047daf2

SHA1
cd20b6b9a1a7a7a5628fd965ade8b5b9506caa00

SHA256
651e1185a41971af9a13c39eca191f1a8393afacb3938548ec74ff322fc34102

SHA512
63fcb7a5ae7fb525675393249de581c3b59db55f4a69a0b9aaeb4a7a7d97c4f12b8cd3cea32a2148a63c7e1100fe79e9d371a12fb0b7b276f396d9f93f3ae638

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BEA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C5B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit