d995c02e206ea63e9632071906836272925bd50e70f2f15bf4ae439b473d1ead

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fission_receive.html
Size

8KB
MD5

82cd6d35ad3fbf5c662e6f79cc55471a
SHA1

509983dccf3ac5e21493cd906cad835b4a6344df
SHA256

d995c02e206ea63e9632071906836272925bd50e70f2f15bf4ae439b473d1ead
SHA512

6a283ff8bf1a92e349c66bb8e7c93d4e616512d504e45c22ad9d17ad0e7fdb9defa25f1ac108820a06d7e0d90f111b3a1fcac7e42681c761bfd9f7d0658228be
SSDEEP

96:zGxoTtfJUY5QRj9j8BNjQBtOOt+OcIUp6aVYPVLzo/0Nw5cNgmOZvZ5+7y:6xmfJgRx6Q+mx7lacNzo/0NwqWmaHCy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b3402527f4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000676c3c2e44e7d968191514a564fc8303dd75f4622df4a00399ea13f2ee5d3f7000000000e8000000002000020000000a14e669984f96b929241951ebd39a6011f5a885d816cd96ce656142802097afd9000000076308372f052bcf2effa7f961d7cf4bd7ee65d881745490a2a988ebee67f152efe6b6f3aeca477d63502caed3b13e4c771e9578d5c29d44b1eaf5afc204d48f1af8997c428b2a2d0e3819e8db36fbd8da74a335a83d830ed65504d50870062719bb0723bf4f6686aab402e2a4bc40172fc90cc3dc5dbf7393075b02dced85a1907d66ac013ac922d1f7b08f9d3e86b0a4000000024683fe883005c4c082445f438e2cebb753a4518963cee664785c72451d77a60b2e23ec49bd58b517f980d51e5682480745d5bc66c3b288fe5f961880a2a299a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430447028"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50D642D1-601A-11EF-B254-46D787DB8171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003ba0de44c40bd7b74d45054d22821bf12b721711c35201eb0b86d1113d7f8644000000000e800000000200002000000048d736c4c1aac4ac5148d3528a709b883a2c32ca937714fca72b1e069dfdc9f02000000077538480d64fe1b78784a9860c37686756c0b2e420cf0c4b38ba31df3573744540000000fb8e5b15bbf25487ace251d2a93b4ff30c4f9f6427fd8b4fdb4c1f753af1a3ff86a116dec5b1ceaa1e7a12739a9737f8955e40c4758ec7220b96def9f06a5778	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2652	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2652	iexplore.exe
2652	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2968	2652	iexplore.exe	30
PID 2652 wrote to memory of 2968	2652	iexplore.exe	30
PID 2652 wrote to memory of 2968	2652	iexplore.exe	30
PID 2652 wrote to memory of 2968	2652	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fission_receive.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddade6ab395219e5e662d2f80e408cc5

SHA1
98f64e8cbe640d7f73bdbf1a4ae833db8800399a

SHA256
a69643c0c34de3ae05cbad673004b9ee6e59c0254e7a3a96ee0dadb9df44f7ce

SHA512
88d3837452ae2a2d0d4e1fa2b60aba61863e106c36575f5d48ccd57f6e0e5dd3271f31a3580dc4330085007cbedc0058c38e6cef1d33b4dcc931c793c94887d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
136b728934ff6b0581b3f3cb73f7e51e

SHA1
1a9643d8260cb8c3daa1de57581787ca19cb34fe

SHA256
3b8cdd29c798ecfda3cd562202e9f8b915f6ab6992e9b5e5169ee139e62e3ab2

SHA512
e3280f4ab6594e0e273422a2e1d6d63feb5466912c013e86259b57bf9639e4380471a5c1ce28a211196d185d4a9b04d8d24a69336c2d6ab7abe3d857f4c2389a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8288aed20753796a78a940c750c9903

SHA1
60fca4a3f891e89c30b88ecbe71ec899b40a0201

SHA256
5d88592b63d15a55c602fb5a0f48b67abe10e2e6f33148c79471747665b3bca6

SHA512
35cf6672651e037a28c9589e6bc4402397687a504da718fafa2e609d62c2b556e34a7c6e39fa69b1a4fde4bc363670376817e209e3c3d1daead9fda90288d4db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d547f049524f585d5fd651a848cee9f8

SHA1
b4ebbb53b69d8064d264048a83dfe7eeb6a3e6a8

SHA256
b8ad5d41edcf2b5853ebf3ee7e22ffee2e45f3f976d749446ee3ef4cc5d776dc

SHA512
407e2ecd320d3166402ae28d1774ed77b229efad6ee8fcc8af226465820506c702760b07ea50dccffeb05ea95ce8adb4faedc2773fa33a36818932e1afb24f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34c12f6c4a09416b9437b4a21474ed73

SHA1
ba5022d5b7bd24e92999afb85bdb9c7b6704a40e

SHA256
ce9b76c49d41900678b8a61fa1a9813cafed36b76e03a4461f33cacc138e2869

SHA512
1348df17de8771d3a97530cf6a5ac8221df060af2cc89b7f83122ee4d77a3f1d2da63e8a81a0c339aa25a0eb7ea4dd2bbc1a00aa3129a6b4243bc5e85cf1d141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90d9bf7992d868644e77a1486aa045ea

SHA1
648a59834322dbaf6131a5fd570e72a689b83ce1

SHA256
179bf46d7e3f83ff41365dd819561930db3e51a435a19ec9f48e2834b8b07505

SHA512
b7fe233e5e3e0d22498fe5fa0385eae54092c52dacad4686ca05251937d264b7b760e6f4f0fa1c20d0f7fa56fb91c7d9ebcfd03ce6702d00df0d14bcb9ee88a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4fdd8625af76ad4d7f471a81ce5b1db

SHA1
56cd732de4ffee268ced0c67fa28451329f3db69

SHA256
15fbe7896976c276cce57fd770921c144c46fef17a49ae59539c28ecefef1760

SHA512
b277b2bc626a2a9f0a58a252d679ec1870dc37a959d8bf813d89d3d208bdf8797eda922cb65036394f84b423afe4f7ece3b9810e029e0eaaf84477001f42f112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47561df4d30a663e04beab81512a1731

SHA1
5edf0b2e899b3fb19f5eacb8318d3289f467d1bf

SHA256
f5e442d70a5f299796ca866efefaa3e20a81de1f196e31eff5bf13c6ae4cf1ac

SHA512
f67bd7d4b2b4987473efa232750903af3326c4d68efe0c877bbe223365a534217a30a16ae8f37becde6c718cf8bb5057e7afab0353e695d8b298bc20f16adcb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cfc5ba86602a70d67405a461f553ce0

SHA1
aa4184412f841f9a5c58cb22d16517eccdbd0d63

SHA256
4448ea7cd6711b1352d97b61bac376f94ad1782bd718c6c165411051ddc716a8

SHA512
57ebc539bb5bc8fac51f7f87f12f43f5b172a777969480f534b3744dcdc7e4df9ef1481a4f4c9cee2cac98feaed40e70b625bea03eff219fdf080de727f66b8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e9034b5c99e6a6b4bbd7f1b59ad278

SHA1
8fcf25968ead6a3f590a0786b1f0c3642c456e4d

SHA256
2dea3e1caa99b00833c2972634cde759aa02cd6d445520c755d30cd3682ca484

SHA512
b34aad68b4635314bb203a1d2fce69dc60a4ed35a039c03704d098fea5b29c67c5346069903482d20ac541685ebafa905ae781aa97e2594b4c052486e73a7c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adda63026bfb30a282cb5105531b7e10

SHA1
2bd9fda391fede9e689ae80d35223001ef674551

SHA256
cfaf58e46ed2851e2be118f7527131648f6c04fe50567ad3035894432ae6596a

SHA512
b1def64f42a923e4ba9501e668e1a7a134093875a547aab1e7e3b7f7001f78d5d83824c75e41130b80e3f84305dcef8dcf9b67353c3d3466b2e274f2d85a2262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b22c242e73d9e0b0fb44ebda8a766e12

SHA1
645946583862e5c1f7ce82ce1189f7f6f1d0ab77

SHA256
2ed2d23e317ff48d84ef2f8d0b47496f7d59a54c0ab9f864e754676b72aad87b

SHA512
76aaeaa88d4644d75e1b224b4a486b89f6a173c18799c802ceb29fab7037981ca4dd5551f625551fba4624472cbc25436ffd44e71107ee224914e048966f019c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f54541ed06489040a41e5a7dbb9edbf2

SHA1
20cbb2a40db192f9e27bebf16aa34ca18ed9fbe8

SHA256
e42f8993a7efde6e7d6f6d0d281c3f6b14879d48443a9c305e4ee917c924756c

SHA512
31e493e3a7f2be75a790afa1f4562471ed43dea27df616fcfb37c98af9c421466997ad1808ef5bd5ab5c2d6830738194e2707c065d2a74207ad8ce381bc2f86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6079.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6500.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit