594b17c07cb503de74a9ac9a9cc6c64824cc8c62670a2953497564d8a86a29e0

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Help/en/demo_topic.htm
Size

1KB
MD5

24a6ddc39ca6631583b7fb54806a577e
SHA1

fe86c20cf66e6047590d707e6eea0454243abf75
SHA256

cc03a4a08caa166a4ace2cac33891c25eb1faecf21e19be78901545588133a9b
SHA512

f9ead5727d36e5abbdb1d46240ad10de84b93d3d5db0fb3c0f13470ce8892cff40c2ce5207055132c219204d85826b116b7d74a757f66e7ef82e852596dab4f9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430456444"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C3F1AC1-6030-11EF-8031-C644C3EA32BD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000127712b0ee81567d53b1570cd4d44053abb4c4fbaaca2f2f4c775478829af1d7000000000e80000000020000200000002bd628087d5f7a21773c3181b5b6448e5dd063a50d49e6fc4c9dfaddecda47ba900000008a24c755c53a7019156bcc71833606348ed8e9c7d2fd76ed9d2f3c1d8aca57898c4b5588d4210a5cb18c9ac65d490ab1c373894097e93c3347c8c732d35c10b0c3a80d77b095991e25142f7b5fdcc58264998b5e2202a4b799e3059acb6d3d8283f6a6ba58c672cf0c4419a7a0e3305f37399442fc10aa31444a1f63848cb5483491d546e039f7fd4c7ae3451931d9374000000026aa24247eaaabcfb538f3b9d0c058b7c45ee0aa50b8ea55c14127de6703fd2f39d50ddba29ad78c36f07ac6ba654cac6241a5ab879df64d9a9258dd09b54822	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5035b6103df4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000006b472744f755fe9cc2186747f67de7ba577d519ae2fbf16d18bd1b9eceec6d27000000000e8000000002000020000000cbf32bac74d190164dbc93b4afa578c13e515fb97feaf1728556405cc15d07e020000000992c9864745394cbf14ee23b0d01f4cddda9d5c2496ce3b5a6f87b0f57701d0040000000eb75e2796f2a9bd533682b3dfe831aa94481e6455e4f63fa4ce8f67f8a4d8410563c3f97b38c134d13c351d1f13c8c0a7f69d734d7e9f7873168072182cd1e58	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE
2424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2424	2504	iexplore.exe	29
PID 2504 wrote to memory of 2424	2504	iexplore.exe	29
PID 2504 wrote to memory of 2424	2504	iexplore.exe	29
PID 2504 wrote to memory of 2424	2504	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Help\en\demo_topic.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8566334dace95232665c34ba484590a6

SHA1
9d40ce748b485385501cc8c6fcff198ea3913c1a

SHA256
d6d069a9b1aa56daf4b53fba93ba41c2cfd9569410fd4699a557b0e3bbc4ff39

SHA512
480ab478ef454f5f9eb3ba3c014e93d0af913b5ab04128ba81335f9a0b3a6118c9bd6c2458617fcaf9624235605cca9cc0be1c598cca59ff1256d98f433cc2f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1645f12cd1dd7696c6f81f51f09616

SHA1
a308ca4b8925054f843485c3e65247d237e74566

SHA256
f38de9edc51a4d9583bf4d5ca8ec762d643f0a88ec2d64aba4b5576140fe1e6a

SHA512
805972b3747bbf703322da580ceb49886a501b63be6388481818faa7956850dec13cf4e0455f0294c1727d36027815ea50ce4aaf149210cc164a753e2b307396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eaa7abd2adc9decd59ddcd966f380e5

SHA1
302e4a6883a7d5182b35080a2cf36bdc622abfb1

SHA256
205854a937cc5705e87e949ecebc2bb13abeb60f8b4b4831775aa56595214512

SHA512
cbadd33c19d51ffcde8187972494dbe5e90bceabc4cbd2153c9cd4d85da345c9d06da6ab76e711d2da4f6a757fb7bba410eec5cb17052a7c47a61665634051c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6d22dc3da4984c5c2cc510bff121e79

SHA1
2b91c5b94181e0846fea54ad72c372e045ff21c6

SHA256
a2e55b8e2b88cfa65e88c6446f4e08394541455dcf4d4ce4e1a527cc97369dae

SHA512
8cf233aaf38dab0ba250149e2005bf0cb834711943ac4f99a46dce5bd83c9020cb5c82b0a7ad337bc0c66f838c363559b498fe97d235c8b85c82e0aac29b4516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efc0d90b65f22decd2c030d1cff98ea

SHA1
fd91157d7e78b4fbca69696d26cc74e924936042

SHA256
9f970c97117623e253b5951795a7f3bd0ea15bb87c3578b2371c04b03facb52e

SHA512
216f218d292de7a43a726d8272b36e1b71d9098e65450f0916423bdbfbddd33640df49810a48aaa6417bf98f283629c98461ea85dc3ee58da670f51e77d2c007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df4cb5ed9af16cd7ff8b5eaf699e0ab

SHA1
3c0c8cfa1dda42a6955093177dd53046662c3fa7

SHA256
efc8098ee923e83a84505a8f23f9da5d5d89b06ae0f68edb1b8b50dd7d0f9640

SHA512
2dd525d38c3cda02d8955dfc01cd4c8bb6a11a6c839a865980b5a7cced9a1b6f65e96f381bc1128f26df70243675e8621b5f9acec49b1a47cfbc9d40ff48ac1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4a8b92269820c2296aef7401947112b

SHA1
5eeae3791df33e25b0a8006b6e5de49dd3690260

SHA256
2f3628e1a1baaf62e5686ae3fe730f94a99d863776481e9895bd5b66af97749d

SHA512
1f94ab186cf52fde00f0141a9e9844d7731ec2208d055cf6bacc54205eca9d7d4461188945c879c6f6069a8b4af31908bb9e9a256463cbe4f1b99d768d1a9f7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48ace41d49723db2dbc973056990583f

SHA1
a14996f9c832d9a497a5ec9a72a84414a305e96b

SHA256
797cea4cafb9ae246c5e109cc073b6f4c90f41fe7b807b0eacb2bb5850dbfa7f

SHA512
1ebd196f0b78bf8b6a21f760546ed805c19779b199f124da30bd3d8aaf95106f66ac68df79d7ef5bc7d1d220b55cac280afddc40036ea53903bf321e7ca41687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a65080f4474c5a9a28f44ce0762470a4

SHA1
41e829cba45ddf776a5a9bcf62e141a25dd4a728

SHA256
7632a48fe716e9a8ff574cc02099acc2510d96be9a6ea9b51951ec51b0b75cab

SHA512
7126fbaf7cb8f2338315596fc5feaaf84618dc45f46bdb499c7cbec6c0f615722884f28991d3fdae845a7eb7e149db0d6e0b43c5c74b2eab836b376aae5217cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c0244a9bfd983d606cc6c54a65c850

SHA1
37985f74b8cd1938839aef5ee58092448b038b8c

SHA256
4fbd9868957b70fe4c14a3ab02ba2e9b375bd90a4f3731de4753781a7fd655e8

SHA512
c262d6a1a4e06f815403a2dae091c8e2e60bd59027b836d2dbc9e90debd0e71f49659c6c89c30c9bbd630e605e2d4b45201f6ebcaf28e0654ffcb9162a51719c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5373.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit