6bc80699e48cdabdbe1db69a514253a50f8fee3913af83c56791279b40d3b3d7

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

msvc4.html
Size

9KB
MD5

dce913f781425329c1997c63f4a0ebe8
SHA1

1059808f15571a9f9b073036fa53b44b15ad2321
SHA256

6bc80699e48cdabdbe1db69a514253a50f8fee3913af83c56791279b40d3b3d7
SHA512

d2c8398424d7057a717233630839b4af179f212f1d2363764ed0d20ccbdc9a4068e0e9de2634f99728a88098227054eae8e1479f01298780b321203a381a459f
SSDEEP

192:/otS2izFSqugxu6Rnigni6U3qV0OKPGDHj3A:/gSvtVHPOqVbe0A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008870422e8043486d3412e40487033393a17a36f035dd0feb819883cac212afff000000000e8000000002000020000000cc5d6da79f05e2dbc219b482ab88a1255f1e1831733e603d28ae9a58a361dc2f90000000896c835163d805780ee48ca75a1ff4af95eab7790c3dc9a0ff410aac23011480eee73a2bba982a39c0c8ceab1900ea24dd4bb263934ad44a44270e27e25439d90dea4c0d8ce2b6072862bcb4530411ea4f49856401fda3cfd503a373801a98397c7bb89088e5846171de4f2fadb3dbb2661b5e25dd24f6bbdc4be70bd6e972845087fe6589f380a837eea467a3d6b613400000006867aed778689f59837dc1f6afaae95b6d49fb4363cf12ba6116a8178b9ec190e0c15a9e51d3ea3716009d86e348b10268dcf18c5f6388965e6a5041147cd6e5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430430261"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000db5f5743ec2cc154e6620640637eec706eccf5f43053218420c73c5d8ef2c82a000000000e800000000200002000000074bd733b22e45f39c8e6bac382c423333b66ae074011624552ea3bba19ac6638200000009fdff5c738af837d8c1e149a81757540f890e8b9fa090c768a4bdf9ec6126fbc4000000037b6ef2049b017554b0196ad53155028ef5c550e7d4aa2e09be40dd34bcc06eba0a1fd5bb96cc85a2e0c9773d7bb3739f607df19031b619243a427297264a2d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45194B81-5FF3-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60afbd0700f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2680	2788	iexplore.exe	30
PID 2788 wrote to memory of 2680	2788	iexplore.exe	30
PID 2788 wrote to memory of 2680	2788	iexplore.exe	30
PID 2788 wrote to memory of 2680	2788	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\msvc4.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6c74ac52e79ad7a938b682fd951f57d

SHA1
05f85743af650d611d478d5e4058e010dcb12cad

SHA256
ee481b6a35e87904faae9beb0884b5d363cc8d820fea9ae6f65b5fca5a5d93ad

SHA512
2f4629bc812c16615a3b45fdd2e3098f4caff9a9f6b8d4d965adee92f4a392f6ca808ad7277a6e5457ef1fbbdefaf05a2ae272c042f2ccd24b7ecf0444f6e226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe546f6a818f354391e9b704474fd91

SHA1
bbfd89efae370afcc3c2d64c706769d0ac05d423

SHA256
2322dbeb317cb3fb6093551345508fcc2f51e23f87cce1f57f992869cbd19bfa

SHA512
6f57a31d549bf612c6c17ecc05d8996807201396b4e2a955ddb9e96afe0b43003a642a9aabe15e7c5c3918397e5090b1669509c295fef900c7fcb2cd2dcb632e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77717ba7aa051608f4ae9c05775a176f

SHA1
c22fb9876763aae470654335dbba657a5a8cbdba

SHA256
e0e8de7d772536c69d626b61e21b8d75cbf7cf5ba38ee7935834d80bae67857a

SHA512
88c578e18acf7527e134ffb3d8a736d9c7e8406e9042afd0a0d21ae07f2e02a4ff3631015f3a10cbdda639e88385dbea415d723e41178be2396cacce89bb569c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07ca9a74f231813ad3344ecd0d6023b

SHA1
1134b135451912ba83603928ae7cfc7d5c602ff3

SHA256
845120bcd2acd60320816a55363d24a90a57db065c31a99611b4b41d815b264b

SHA512
5fceb5c69357bda1e1c94ac40e8adaab40eda21a3c8c5f6415afea23cb64b5732ae22176562853a2771f741e551b562452b25d4cd6e97d88c3e2c748a6146951

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a422cb3c770b965e7abf9d20a0085915

SHA1
d5d2aa65a93127c9f5b51feff3c024f04e86b0a4

SHA256
f41bd764af74a127519b01a0b09ab9d218cca13dbfb47c1b27f7fd545b8153bc

SHA512
7aced0feacadac0672f9d199b125f1fe8aa4e5a252e2d8fa2cff5191af03a0411519ef8803fac0d83985a2edb9971471984404a5226485fdb527483da37ad9e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bdfa03bce29e46279b3f55066915833

SHA1
7580391512853a98112a4e28a19a3aa0211b7229

SHA256
339a8add05904ac386ea3a141a00032aa33139bc705885d55a574a96c99d4a86

SHA512
09d536f9d29a5bf051399d86b07172f4be4983b6b34bfa0f768137515a1c99f2c6b90a7c364bf59f83c6c5576be22c808ee15396f426e7f7b4bfd15146cc16b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f678a49745994fd84fec517217d21c59

SHA1
01c9e16a0cfce5344825e0f9c50a69cff03da0d2

SHA256
03efaee4140018516d44a51d38fc8da0fe767c60c23d2071647ccb55e4f509e0

SHA512
4024c4d63c916c804e476eb238c99852bdb094b221cdb138195c15dcdbf2044a1e6c407788cb3e649ccd8a609cc4ab231f8cc12cfed9a2f44bb1c592ca7a8206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cce6cd6f77368e107565b74eba73f1f

SHA1
4db96c9be85029f36d01fc78e10ac2515571e265

SHA256
34b80ba09c47b0d3059ae868d23ac9c9187270ad168f739e7676df07463f1750

SHA512
da027ede0c01649403bff0d296154790a95e789e166358f0d5894e2519f55eb7aea2b53824e62e9b38a31ad6517272bce9f12bbc8dba0996508f362824522682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f96eb0f560f399071fb62a74667ba95f

SHA1
784e801f8039e19adbc87572f2bf0467daff35d3

SHA256
7147511f87fdd0206cdf4b94f8cf9e5598cfb4ff4a4d2b8ea011e3bb279d9056

SHA512
0f18a4e57e4d33e4991437c6e8b6747170b541c1e55079d984e4d62b6ef1a13284a108da191be00a9e27472ccd321ea993a4b6d278864be8f46f952172bce4b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b39c090a0be6a277a051eada5b625b2

SHA1
42ffc15006693916d75f2614b11b772fa054edeb

SHA256
e8292c823d5c9e6bdb17de24f5028a82f26c4fb774ad1ad191322f3ec520eaae

SHA512
2cf67736c473ee75f81be07bd5d22f59fd5c1382021700b64b7f7e1e4c6e4ccd2d3c86fc69047a43d546737a5ea5d25907f78f4ed0338e5899738a343667f8be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f88224584e1c0793b762f7c1a722496a

SHA1
772e1b32576a688245f122529ddc96bc8baa6d61

SHA256
2fe895404cb86adce6636a63931b3ecd5c909d66e5c23bbfaa4021ecd2bce4f0

SHA512
ccac7585038f0a6fcde470b406fde140e09f7713f832a21ff07ae3bbfb2f12f9efd6d9e46a5a2c142b197100c031645d605b509bd8a465b071f22a91a241c027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50dfee4bf83367647dfe9de376a171c

SHA1
9ded97bb1cb4181c0cb0b09fbe1abf1e108fafb4

SHA256
61c9e6dd56c074750d0a709efb8d3fe29eedc00c54bd0294f0ff80a56126a97d

SHA512
d0372834a8fa691299303a3ad427f599060245cb32e316c235fd0e22b613c3373446e2b89cc4bf9f718a9c63974f2a0d22d66ddab806de7469201d3c9e56afbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0177c39edea3dcee76641bec0239188

SHA1
64c72b7e6fa0e960e997b2a0a608e481ec0d5a96

SHA256
6115ffbfd4a8c18949b59c388816c930e891ba1da707233fe4e2dc7950098b0a

SHA512
16bb8ca8893c5b4f18b8773143d7098c5c550cb9df16139bbe78e3afd535d96d4f9d5f3d0bc9925455cade572087c925f0d6d647172154b9ac8962cbb3e2190b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D56.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit