788d41fa93ef536d97670d2d71625dc59726f4c06587478cb9d2ba188edabe5b

Analysis

max time kernel
66s
max time network
68s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5ad9e3e666b3860fcd09fbd5a431bd0N.html
Size

904B
MD5

f5ad9e3e666b3860fcd09fbd5a431bd0
SHA1

d2c766337dea69ec8e04af5d373046658df07df1
SHA256

788d41fa93ef536d97670d2d71625dc59726f4c06587478cb9d2ba188edabe5b
SHA512

ab3e212b0e21664085c8c651e85a01c5a09b58c088bbf36df255b13eab66c491ac3560474b228ec517261c863281bacda929ea1e88eeae164e3d7acbb49c7fb2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7FD108F1-5FF6-11EF-838C-C20DC8CB8E9E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008119bacb321438f3644625a8b3698482d39135382524b159a7a42b3e63e0935e000000000e800000000200002000000077f5020705d681996cc037e0c6190cf03946cdab180767847019e48121a7f120900000007c9f1d05a964dbd27075e42a976a55d80d7b36b0d87747144a5f165ec78b5ae712544c7d425c860cf795b956b94cffc478b033c9b7ff9898f5696f02f1eb4ded14fab46f19390d20dc4005c963fe45ee7f079c98ca528eaeffeb706e334262e932f6876e17f4801f1b366c46f8486cbc98bc34e8078fbae0fcaa12d783e7f122790fa688d376bd1efced5b5832c0ade940000000d6188b6e0fc4f0f795d26cc82d1ab6f358cac6088aec126056b5068feec555da61c5dab0d616d523864a0cac01bb70ae4125d07d19c7efe93279a7e2ae4a3130	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a006455403f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a2993e94e25ca5155b983955a77cf887b9864575afdd7d22deaf22746f401ac6000000000e8000000002000020000000b3c31e661202f68d1dccc7abd074e3bea70fadf3b9e6a0e4edde6f9f3f27eb2c20000000c02adfc0ac7aea1e0cd6929611ea425b7b02c3bdcd143c78b373f5fa780e82714000000067cf792eb46f356d1e584e541eba081e5c9f9c841253e68267da3877c78e65d76951f42115563b34b2fb22cbf82cebd1c9b90361eaa5d2a58d806278222a0505	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430431645"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1924	2108	iexplore.exe	30
PID 2108 wrote to memory of 1924	2108	iexplore.exe	30
PID 2108 wrote to memory of 1924	2108	iexplore.exe	30
PID 2108 wrote to memory of 1924	2108	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f5ad9e3e666b3860fcd09fbd5a431bd0N.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b162b24d031b9ce274b42972b2d7162

SHA1
383036afdc7c2591fb7bf67cb622b4b2313814b7

SHA256
f2a6deaa16f8bd707d7d6d52bee5980c14c8d972943d2f62c4ef59393dd80512

SHA512
0e17945e5bf3a038669f0824a82f0e4188887350d23284edc8a763d4715d129fbcd484cffe7cf9171ae7e63083fc99dae669ee985cded21ef596819da8306d33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e2bf928e99423d68224464d5c8d4f1c

SHA1
441a8d77276a13b94287687c6d50a0f7b1e6762a

SHA256
4a268cf39df56ff870af705fd6676113711680a91be26e6293e75ee2a23c9d90

SHA512
08cf0b242475e74995b5764112f23c91bf18b01b1ba42b720278982407cd3e8e6a182def16faf1929e3017aa58d480dfbf09c3a364f6e451a88352baf65a7a35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cbf0245a09019b9753bde5eb57546d5

SHA1
c7c1c316ca1adcb99a2978f1adae9ad3514dda79

SHA256
67d657f30fb0a9a88caecdf8279b69a1349cf65d5e72979a0e1033ac4317b9b3

SHA512
888a777fd188c9412a60629ee3c358d2331794ce467883d20fa19e80b127586d8ccc42f65d8359d5905c12df5c09a06822680fff332fbfb03f4cadca7a54e232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1898f38fbac9bf91ab4502970eefeed

SHA1
ead22e73a4f7299e348be36b6b2199a4630211bb

SHA256
a188c1fb03ba653ca3e840913dc28f73bb2efa6428f8801b369a567ceb29e7a7

SHA512
3c88e81b750a59bc19a6d2bda0e87f0cb78d2b2d8d923ba229336d21d91709949e76b30fa1633d96294dcb280d87907bc1b3b96bb280ea86f10589746efa4879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e98aaecbe8b2713632c8a9112aa6419

SHA1
ea7fb7c1428d6a830ad259b5d09eb3a522f01b7f

SHA256
e7ef6122824d1c87966170184ac85bce9368020c9c85a8befc6b94d03c92230f

SHA512
93f606599816a47a2a88628ded0ab7f7ff7477ecca6f1fe0627aa2af18920bb8fd96a24e1d72af783f2f8fa6cfb507f9a9e6aca6bb509a70b255d895cf697a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
900e878c41d6f320a9b486035821dc32

SHA1
59695b23d9716474ac005506e18f91912962e70e

SHA256
d135ea667e0f381b88ed2097ee5af0cffb83213f2ae8eded20e1c858b0624e56

SHA512
4bf5173c45da80a2f6bf0202a40318f3c6eca3d109eb2b2a0a4dbf6d7d85ac306f0161c7f3d83057b79b7def69528c7b2ac58f33f6d3e0d26c0f9453286a3088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0412f195eef351fad1659c2a1bf729

SHA1
b03099dfdf6c2535bbf1dcdaec7738cf46a7efc4

SHA256
cfb67724994da5b4f5e2249df03673bfb172e04a3d31c4ae7493ca7be436df64

SHA512
5c31dd7ceeabd9b4d8973adc6700935d4101187ed114c530bfb7291409693681cc886042553e0136df2acdd40b409cc3cd8b0e2fede82dc85db7139976a9504b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
746bd368cf46c303b397e87e48f1b6ac

SHA1
035c30ee94074477608cd85a6c356e593d60d101

SHA256
3e9dd7322e4c2e857dd6717726e25ce386ba72d0a2adc6eb51c4c74131e14fc0

SHA512
8ba53ebb41e530546cf4cb8e388f6dfccc4f6c7109369ed73a8dedf3663edc5b2f2b4b49138513e5c2214b8ed0597b0c82bab6bd6979af8ab0eefd44729dd152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ebcf36097bc33d7a5e55bd0859f5e61

SHA1
55878e137f6b9a8b08cd7d983f352f0368bd13c2

SHA256
590142b230cc68d888056fa31d35ccb8de429f03d13b07852dd449496c4647dc

SHA512
8dd865bb7058f1c7c69590d058c0fd605a284ba5dd49211053cdf18300d90f0a127ed704e585680b71ce4c180e9b1f5ee035645fea16ee2e4251de0a550b6876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
311e13e4504c3635ebe04d0c7f543657

SHA1
33a02ee70fad99d6c03a3234b7e59ac559cb91b8

SHA256
9367621bbad17a1a0063ce703c1def282cba6bfc0141cf3da3aeecb35909041a

SHA512
91eedec16546c112460a665ca794c607665abbeb9a1ba2fc34de32fdbba09b789c68754d316eac945aedf1123cad5042119c55faa2a9c13de16e66c37f5aa845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06bf09bff26d77f7f390c33ad7567dbc

SHA1
f28eaee38c1bc5ce5f7ccc040ae18562ab29c32a

SHA256
4b775935a8f8c35abf335217d8247382551e239ff127a6950a4ee851a663cb0c

SHA512
f58ff2fbe1b780add70190304537e2f314e2902c8cc39db53813049aabc3b7b8c6727d7d7433f7cca92628a25249695230573fc0b226f9909734b4faed749479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7da7c237b8899c85f9c141b664b076dc

SHA1
26edbefbcbc1021c8304f41786a0d6cd6dc5b0da

SHA256
b9a58dc9094b8f9310579c605b79876e8f0bd507388554bfbf939825fda3b7f9

SHA512
bd0bf5de0ed133a11da3634989a2902193496a7276fca37a536bb8eafd403f916c228014811791aeca44e46aa5db989e97249d74bd8b7d20d4185c172e15645a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB686.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB87C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit