ae4f5684ac12c65806282568e0ec9f98192f94796f19f2d1c4ae4621b9cf2e6c

Analysis

max time kernel
70s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DX TextBox 多功能文章编辑器 v2.0(.NET控件)/dxtb/swf.htm
Size

1KB
MD5

774eedf6275e2c368b604f2248236789
SHA1

a3344e951ed0765d96c100c49e960f3c9047fab0
SHA256

82e884b1ea8e53d6cd1c5197c8d796654172004ea7b30d512ada62f3144a68e3
SHA512

106863d0307345808e05b67baafdc1e2587e55cb5cdcc453a7107a491079ad4f1313c5dd055e369ecd0b8386b49e9c9d1d117d1f5a7ae08d6720def29543a370

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005e5d1e78d71c031b60ec0bc506ed909799d56a25ecfd1cc6231dbd5eb8846585000000000e8000000002000020000000c61bf0d310ef2cfcd2c318b9f85770652651f7c75559db97828c686c355f648120000000b3c32dce3069586c81c892a26afe8861050e0ebded55fd995941051d60b7ff82400000003dd48f6c5877c9f5f181cdb40a77b0e2bd73cb5b6a0c7e69994ad81657ed9c4851163611dde53a6720452cecff2981a1b7053e67b9c5ee32b00c9aa0af9d5784	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905175b694f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000915a4d550b0723a4cefab24304f0f6bc81501de6d53008952a66e21b984f4b78000000000e8000000002000020000000fee6e3166c7b2a859d1cb724a948634c397b5c72de3a087d57c9823b4939a7df90000000ea3bf75d52bc4606b8ced009d02a29876348b28ab168c0186f7fbe518b43b9caf9a4fc41880be0d4126f5c1cbb62f4f69c4e493e0346cf92a2c54b687f3507e1e068d8f50a003f99630225dd38827ed4fdf8b77be05d445d381bac6e6750dd8eaec6084471e3c4940c9ee36191d2947e9e156d90820cb2bda8bd1ab8033bde2d0d6240790d721fd5350c1ba3516bdc8b40000000e7c6ed72bfec57f463d3c22fbdf2cf8c63ea58373d5b6b21d9fa197e48cf4af750bc13e076316b6428bb2d6f9184928b10b0d414f8f9d8c086932cd2ced11522	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430494089"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1711231-6087-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30
PID 2432 wrote to memory of 2736	2432	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\DX TextBox 多功能文章编辑器 v2.0(.NET控件)\dxtb\swf.htm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
293fe5c3cebb81d90f01d4adbefed30c

SHA1
93cbbad6dfc1c827913c652bec9bac1adcbada4b

SHA256
bac182f9e9999b3fc38ad53bdbc2d9fd504e483172771e8a20f3f2651c5eb9ea

SHA512
8c9fe6f4c176cec74b58eb1903db2cd3f2652aa90a41f2499798389d83e2138f4196c01932a2be9fe3268609e8c221d5631aeea6d4a7ef2a25de88efa3b52cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a81945e2553da9cef7f9d3440e923bfc

SHA1
b3cbbe66c1b042cb45d813d2f90b5954926e764f

SHA256
23ae7ea712457fdcd70230fd1cb4a0ec9ea23c6d59994217f856c16469fcc218

SHA512
0f05bccfe63e064200265d9f95df2375f2e805c1b67823fc3ca75a08ca5e84552adba866863354c6f38fd907ee67a97dfb52dbab9ba650c3240367c42fa35122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c1e92cc1925f8dc89553c985580819

SHA1
122aa5eb33cd3ad81d1d1cc41d818f3bfe12d4df

SHA256
f465999f69211b4ac7ba63b6da5e691ed9f6af9d9b17875b90797d70e3f109d9

SHA512
bab467127643d1a8c549f7bb36c2ab908f77280a11b71904956ca3e6d4d8145a1055f390b29998ae181307e59fa3388cdf7ac2e280e5301496fdfd1c72a97301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
518713ded8f75934f489bee15c21abc2

SHA1
cd07132c4776faa02d364b683797f7c794bd198b

SHA256
f63315d11d729de622dff9d30ecbf6fa38d4bab87d5f728530de11808278fb1c

SHA512
6795c764a57e5dd4e680e639a1db301374f4c4ec1527582d7ab9ffbd422aca1ce3115aad7a48715d0d615cfa504944810501a2bbb819653072e42490b64e4172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1236461773c24df7f0d4571d6cd257

SHA1
56c6dbce59f586869b5adfb73473f9aadaabb632

SHA256
e2764b4d5ca736e8582205f1f0cb24b4d24718c17c7d98a71e7b3d70cf4ec079

SHA512
3c154e52fe732ee0cc853171fb607ddf08d5935862e22d40269bad205048be92fb4c3139343e3c39c40a058f0720a3c38a27ef36baf9127277967288111c9732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58da2814439f779a71f53d6ce86a2995

SHA1
838975e88b84074cd0e55b59753db290c773c1c0

SHA256
fcb2da185cecf47434165a09f70930764f2996a5822c4b0576dc7c97a6fe1ebb

SHA512
1b3f5b330f05cdc324d3db6e69711b9b7181356243d23c9b2a515292a0ad7ca80bfa9580ef2006331880f033aaeec0ec5132838d23ad8340ac2e0f88e2fa48f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f23c0e18690fd42498f21410432ce6c3

SHA1
cb7e649d31f8cee5f20eb1ecf8ba2304b10b47eb

SHA256
88dc4179c380c56e8982b17fd215e67d70e637fd0d73f75ed8d5b5d5b308add0

SHA512
43f2cc6b4502051c58e333395c33eb16748b294b40d59b20dee287b5bab829df6bd68a34549c9295bbb4fa8b6b3815c9cab84eee1faee88d3a89e5f75f6390bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
714bc577f507b17c758de16b36a70cea

SHA1
e8792f06c63e0f3d9a5c60b9fb6be8e09d80f7c5

SHA256
bfddaf29476c31b978020f13c5b4713b1148f38699832cdf7113f1f4b10abb13

SHA512
fbbb6b10a388916563aebf7772e454b178926be46f03a21efd41c600d5c22fa16c88497d65a2f7cbce4d9edf374dd8a81d68ace6203b725566130bdeb5f0f21a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ccbf8e72167dca8bc403474d870fcc

SHA1
a9ba84f50afeada44fdd63e73535b4d23670559e

SHA256
76aebe0cfb80c2b41bb320139e479ecafeee0e8aba0c5e22e47b99fa3e765917

SHA512
800d4b7db304c83fe06250268a140463b1ff2eea6945b54c37ef73681ece193364dbac952d550f5a614ced5deb39cf7a7a4451dee0544aefe9be98847b6caacb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
855e01b68cb710a6ba43b04659c7f2f9

SHA1
a8afec450929ce75ecc47aa9f28e090600fbc2a0

SHA256
48368e78cdee73f1d60049d264ab67d25e627705f4d14444fee78c25eab7eb23

SHA512
009208390c2382abbd82ce0aabd9798e472c89407936d913a0f6b698d9f63ca9429795ce8f6ed1ca42186d9b3c9d9c90b9c00df60971db6b3b9de1610f7d878b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22309484c211afb5d6edecdc360e88e8

SHA1
fbc61279cc03185a94c1c857425dcf4093a54ed3

SHA256
fac4ee1a4da170dad6f86e7c4df962179f90e7babaaaca4dcce290df51e98148

SHA512
f292282b3b75750efce38e37b88748345a0542c192e9a17eda43c5c252a40cae3cef2859bdb77002884e09237bc0ab0dd60e318926b1ea4de59bc35f36e6ade6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
246cd6b6387502c84f67ac8d9c9ec34c

SHA1
f8b9644fc0be9dc837e2ba61b5be5a5ec9c62e9d

SHA256
e9b868e9c8160112d7bc59ec1827c7c3f70ac909ddba071c339fa549213e0700

SHA512
8f07f42588945dc3dc22a940075bf261f567a2fa0844b2902ecc46feedce3d7521498cfe5cc6f84eec5b6135febf540952ff4f5e526e777e8795638e6bf27d73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab532.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A0C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit