cf771e89ea5e14d126c04245b9c32b5bc79474e74fd1975d79f1caee2552cfc2

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload/editor/plugins/about.html
Size

1KB
MD5

8e801d6c4b210910e599acc8fcb31f28
SHA1

d8e93a673ba7ca73d972f2e88a776f8a85813af7
SHA256

090ada0b04880c8504a293ed70243976425f7020d5ebfa0d3bd8df7084911c44
SHA512

ba889960806c20a09a01e3bbc6b81c53a2cfea21c04b0403b6b15c4c6c207dc30d669c115f9bfbda77586135ddce4a58409ecce02b2d27c2301a01eba8424ffe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430391263"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7883B561-5F98-11EF-96B0-E6BAD4272658} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000053e4171994524fbd5c23fd75b9cbfecd66a513c8e7049dbe03a59822ac5d54d8000000000e800000000200002000000071ba16b2dec1bdd00de36a2b9d713fb51c91faa7c7ab688465054b634fc378d8900000003c87399e391e403359548e2a5e06a3a72149f6eb48addfcf83129e4acbfae42ccb7d06188df2a8b2d18c6e85536ca2bd6ad1e4a5feb9e0c305f2b41f7fbdc471377555bbe4173a516d0daadcca7d8f857d40516e1e18dca0a6cb4bef4fc4c06a257f5a58da4cadfd86f0c190cb12ffc5d982cea9b1337cbe602d6bd2fe73123494d65afb46f8ad1e3c42bbddf41ef74640000000a8b7bdec4f2278bbd81716b0a01032f9f4639e63575ffa934ecd70740902b910f9a92a962b2e9c56a0d3606a1971a5b2c4bfc6f608c34d19d3a8c4cdfd6a4587	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703d084da5f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000994eac4d53056a007196462369b9fed3cfce78e654f3fe68b1a8cf65c66f8f99000000000e8000000002000020000000e201bd3ddd7222396aa021257ebe30a1f6af21052cc699af0bcb638a2c6df7f3200000001535292c96ec269d8c03322d1699d7209d502d5358bcf8173a9d15acbafe1bf44000000023a492ab7e9d52b5c5bc2c519b9e61ee5b40766c85d3ec524ccad408e0a895dd836c0b13066c250ba7b7d3c968d878cb2da13346d9f98fcc322751ccdbff6eb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE
1984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1984	3028	iexplore.exe	31
PID 3028 wrote to memory of 1984	3028	iexplore.exe	31
PID 3028 wrote to memory of 1984	3028	iexplore.exe	31
PID 3028 wrote to memory of 1984	3028	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\upload\editor\plugins\about.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c5161dcfb5bb768c87a27d3234a6b72

SHA1
6bca88ca2f6c321ee7327d9688c6f37630ee1fce

SHA256
39e236709433774a59ad7832f26a777ffadb33cbbacdc2deca2e84d96b54e37d

SHA512
27528403d0bbea9f093d87648e0202b6216e48ba479cc480770958f35ac74baa2d97368e951b7a5255c99681b6eded486307a8b7c8a12337c37a65e972c01728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
013f98c5d1970afdf3344d86ce90d323

SHA1
50f6203243ea0c7c8116fde6e7925e79e4a15739

SHA256
408ddf349536c6ceecdde4cce70787849f26468412c3817f3e5bd18fcf0b000b

SHA512
178bb7e000d7f07f77f4c4c262d2b7a03ac95f184cafcf1e123fb18f2cc65da8259ceeaa445a916c19e1e253db5aef5cc32b8e1624557191b0c15445dd3c1f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e53699fbb7202d03be0e34913a9ab9d0

SHA1
fd0135685c878628c31207ecb94cd5338bb71301

SHA256
f57c0513f240d4b64877331f5eb71a9c288baea8f1443ede2ff6c65fc082b235

SHA512
bdeaa1a0aa21226d0d3f9e5571833225d39565a8a735ccf6fcc5ff7cc0f70c20c84d585f34c77d1dea4cc6065495560faf30f3d164bbd78b40c34641869ce23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd227342de4c3ca82384f4f7abca52d4

SHA1
aa71f44fb1e5b9d6b507bd6a82a9f18b9f1d439f

SHA256
8e4ce1800217165209e68b5aeb5489a4113df4a459e961614a7a022bb956758b

SHA512
5883fad5118398de02e79c91192d7e25bae7aae53b6e13133e67edefa8df796739055581184530c8726bcdb45c13a0411c8e2c12dace1fce173635116ac17efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13725a92f564fc58da6346ebaa271b51

SHA1
794e2d608136057fd3c66eb5132aee6a9175e29d

SHA256
02bc91950e98c9dd35c3e9cd76e4995906eb7934b0b2b204434e81ac7d7f4eb0

SHA512
cfa0093874a18e0a70e6861d9879b04ac155d8b97f0700b4d32b1975afdc333c0a309069d8c632493dbae3c74095eff592834bbcd85ff4c971eb31e34f9b1f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e5c657774f226ee8f72a4bfdee832d

SHA1
7c845053ed40013b054b36d6be8465ade0f25cba

SHA256
939b5101fe55f95a56ea0c6188875f99a270b28f8770a9e87c98d184d90a76b4

SHA512
2f9975824724f3c5a1689b4ea680cbffad62b9a7bc8201b9937a875f670ddfd8d3a386b6a940af31252d75655bb5d03fc304f545051061b0ad4af4fa80441629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e9c40c9395f807c2829f6a6af46a8d2

SHA1
b83bad58f436f8245bb3075131d0efee9b6c16df

SHA256
316ceb31cd82bf22bcc4f1f805dd2d7f3f0e521f6836b3b9a574ba0f1e9fe986

SHA512
aa607ab3042a5eb16c2f4d279ca0d60be5d6fd95b41ee18183e8ab116b1248f55bb3c98abe53e86d5bfee77c8025efe6b4f10867bdc7e781b6ec4a84c318a0c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bee6a079e62134b9bce2270490c3a57

SHA1
8b60385edc970d1c4f819f613cbd25145bee63ed

SHA256
72d2dbdf1abeb2f78652d7545af359146c6b9e74e18896bb33732538b3fcd2d0

SHA512
e6ee8513f6b659a7c6045c3a1f120e74f53252016a1227bd68dba10b58c7c0587b9ec860b705e8278b12876d6221ac8004c7c584988444e23ca288dfa20f2dc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70a9eaeae311de15c1a7c07821351e4f

SHA1
df0f0a46a12fb2d84bc835305a2291ca3bdf5d52

SHA256
ae68fe07099de1d692cc7da409355425db65ed145dcad2158cc817f2f994a9ec

SHA512
5bd2c2953869aa01c7fe09bd5940266460c4a900ca5db9d6750cf81925bee0d9a91fa6aea34e14c524e0f03f79162f5f301c51038ae067fec6d1995ddb538425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222641e8fbb1858c19af7409ad005e90

SHA1
4c6e0b39fb11cb7ea450ccb28a73306e15560362

SHA256
16096276008400d67b6718f906166a891f790a2045d265b51fd5382fb1525e3e

SHA512
96b4fffdeda9f743a97678316aca0d015d0cae37694d44f6d8e36bca9c700fde0f2ed44807e54258e9c71b6c192ead1c93c80b33781eef9f822d88b914e7ec92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af4afc699770b6dee638131b55834fbd

SHA1
a78c4850f2225be84e30c2ba2076371f3afca052

SHA256
76f3188d5fc0fe5932d612d7309d3c45b9145f9dd2d50c56470416ba1682a766

SHA512
0a47202ae7a2037654686289c4c32738be9e85b87fb5066ee3ea6ab1d084e631413247e6565fb178738faa32cd140f7460b7700ef1c5d550f7ed006d0a487901

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF29C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF33B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit