7e120132d1a388a606ad117062f07cef22581d6e6694d514af94276bf6caa556

Analysis

max time kernel
72s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

background.html
Size

301B
MD5

1e373c45b989b0203892ab71a1415d01
SHA1

d72681a38af77efa968316526b54a069dabc1a9e
SHA256

32ce4d2748a55bba5907a392433cf8a4cd22551d38d822d73f6194a4c489b144
SHA512

d1a3ad51c1eef0c2807b129c193d1d42fab3040ccb35f05134a03d1396c3cdcd99b951e7df69e56d5ba6d5c0f8333b66fe71af73d4aaa6e1534280887f8f027e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15F807B1-60BB-11EF-B8DF-E649859EC46C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000018dabdff764d6429648d9d38aef10f08b66740462b70849b3d7744aa6a3f9970000000000e8000000002000020000000033853212166ca4401299eed0c1c5ef5edaf928270c527651d044d72871d8e2f900000002e7baa49b7e9b7f5c6f186ed0e4d6a572de13e8f054ff69da61596901fedee5fc8960ba86d8e59d609b9704e65cbe48898d550e93574314f43a2893bceb2663a788dd036031b97eb00807dd0c5c535703df08178c1e267b7e1007cb9d116cece03686aa892c44fce2c7d6dcd2b3cc240058fd4125762fb90b51b4929f0295ad768653404c2d79d4a00134f4235e3474640000000a006a0fc739b646452a096d6d45c284bb3eb889b0ce78b74d40a471c1ec088fef35acec8a557198de72f836e8399eaea40eec83f679add202bb2d7aa886b2dfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430516084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000e948fe25d206d0e434dca836abce68091ab4cacc9306838aaffa966681a5724f000000000e80000000020000200000006b4f2111f04f098197d5ddc7a104be9204445dc527c3ff017d7138775933d85320000000a6e0feeff09c7d78c0585f4bd93c3241355a142fdac68fce04ac0e1add5c734d40000000febfded42fe3422819fee4a57603d8ab70c235c7c996f0d46778f8df6e65fb841e0bda41fb2074ff7f7bdb931101f1b92b98743d3d18296ada6905e153156745	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20970aebc7f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2036	iexplore.exe
2036	iexplore.exe
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE
2588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2588	2036	iexplore.exe	29
PID 2036 wrote to memory of 2588	2036	iexplore.exe	29
PID 2036 wrote to memory of 2588	2036	iexplore.exe	29
PID 2036 wrote to memory of 2588	2036	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\background.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b171fbf60b26f0cce1e1dbcbb07e909

SHA1
f9903ad21382bef4285412f0d3ffb03f1482ce00

SHA256
29b3c48f060a832a64d0902499bc6bbd89e29cc9dda967a19648ff9eeb6f37ad

SHA512
ae82c45bedfcef8b8188c7747fc3382af82ccf0c7189fed25969c9adb337360871b85700890acb43552094681c5a0cdca58f32aa26c1275366033f5451279563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e57284db673ea035ee7f51acd6599997

SHA1
3ca38be58006be6ae1428fcd76cdd0bbaf42d1e8

SHA256
66dedb85ebf3042eac73509ce2bd1d3a836f5e82e455601b18db8f5c702947cf

SHA512
90e12ab104c5b66d0d19f6f80a7532e2fb7a8b27ce1a4933948022abd0419271fcf713209f55dc35747b4a64f5f7360e81e69d7debf0fbc87a8ac25169bdacf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2475c8438e792a573cb65633bd1bbd22

SHA1
10ef578e3ebd84aae8879e51e1872ece1b443acf

SHA256
0253f7cf51dc97d747c9d9ab6b5488ed61eafd5b31671ba6ca3c6902a8896f87

SHA512
d742c15c3a2adf113602ca683529e8d7037d2c0f40ab90492dcca0c3274951a546230c9910741a14b77c40f6823f62138def206b60d939b821e805dfae2df8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
854bd9860a8bc50bf7726bea56acae20

SHA1
9197a5aad3c6b856a85313f6fae04b121da5e063

SHA256
b02067f81a75142730ea010aadee225c55c6d6b6cc385ec831a64c4e645e0a1c

SHA512
866b32825af2c0eb339b81f55f293522f9b05c3fb41124bec7db1fe05fe79c69a1cd9961e55106d11ec3a0c18d4ff4c7e35896459196e702e836a49d50cbc6e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1860c45ea3a91b8b35627a6d94a9927

SHA1
c3d44857930f3a3cd83bd2582a18c25fd76c3cb7

SHA256
826cb2501939b218286d2f8fe2d164acb77f4b80a7c2d3c1b4dce811fa442065

SHA512
bfef01e123117959e276e893e8618a966001dffb87d736a1cf7ed267535ea052362e91c3ae1e009c08a1c61a7263f77fd7ff1d810f19adb1af16ac4459465467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdfc63c4158ab7f3d7775e92310f3c67

SHA1
d434e9831d03d1e24a07ec5d431eb87ca6fde955

SHA256
d3a40c9b728020b858b17135a84de478465b1d24d9dc588b84adc030720d72ad

SHA512
2756dbd3684dce979aff760fd5db566c4d245ca6fde82f2241ae914945ed652108506eedf14e7585a13feed834d1cc5fc29297eb0933ec1d55ff43a94342bf51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bec1a06555b03adc40c948c7e364ff9

SHA1
ed3b8f67468e1df73a88ee10fc4852ab5d68c46c

SHA256
82d238c5365a91069c3d0cf1d9892c2f7b96759a0b1ef82701abd2ce1d85c689

SHA512
5f6a42819af23430b1206cdd41378210fb3c82c7401986d24a1c648f6679c237bc649baf6a8098c8a866f83b211b9e485d1765520eadcbe3e9af3dd95540cd0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c01dc308e1ab5820d4a79491d47760ef

SHA1
d2e15cc0aeb41f9ba83f8425ee5062bb96f81dd7

SHA256
0523be34ff1649fed018ecdf1f5636a6928d773bcc17a2f90bb49cc15c443490

SHA512
2f761a7849e8e6979346b06298beb4442a961a8f235710d99749ecd239c7ab5ca577c7f90439e15c2191d0e64d51360493dd489f60c1952e9a3afd26829ba9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aba5f2cf560c0ef4457e68e23e83cd6

SHA1
cba4bf150f3d82ecb9da35840cd16efae3026c3f

SHA256
e0435836557bcee365ea3227bee7ec700da6d2b724c5695bc47c6ff89862a9fd

SHA512
b17b0644f62c42216d1cb5613492fa5f09a324639ec7dc00b56e458513270dd1dd6888fdce62b5373660cfc27482e654b718afd0819d500d2b0b2496ebd295b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10885ec9d4e9d75cefaf7d83c0179a18

SHA1
f4a15293735a3078341c92ec1f88c3eaa4d5b11b

SHA256
294f958058a7890fb259a44248e6ec3f3fa38bdbb52eb87a0e5e3dad64736758

SHA512
de49319d6d70dfb30cfb97c6779e497567e08cb04e91cac6e88d00f39c9f6a6f959647b3f11d0a3466f2fa276f26d9eeb6981b7ba0bd00e2661c347d67f2e091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fc3383e34bb73b5dade8668a751c75a

SHA1
561226c6badb1ada6649283e243eba14e30e1777

SHA256
5a289b034a534360fdb532d4d2c08d264a7d1f227cccf973f1d715c1bd7f7c4a

SHA512
03927b9aaa0b6d04c1cf1219c0bdf7a55e22dd905afb38ed63cf17282abd53ed5f8b99d84cc76a6383d2b64d16bcd8e963c4eef57e61a93a4a0cbc6f1c06ab61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
879d1d6602274d8e1e4f743b4132230c

SHA1
671a98068aaca95a572b351acecfeccd37df35d0

SHA256
53027e94caeb33f88b2bd417c86d850faf2c00e4f5e73d9b6e0303df56a277e5

SHA512
231eca3a715272fef46c9c2e59c63dc8bb97ad39606b1b8aaf1dae3b46f958591a4a7b732291773c3889e8086d0740f1561f3ef45ad74977f98092f539bc49fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cedf7762c092d4658bcb38c3a3cb17e

SHA1
2122b8ea7d0d2ad2fbd0a84f11260004972963c2

SHA256
bcbc56a6049ae7a73faabf3cc115938d7dafc0a38cdfc8c8b0791ab29d9eda96

SHA512
22c5f04a0cb849526d67d48126cc445e4881ad6c5115118d2e164caa463944fbdeb7a92de721b4dc529eb3896d8f482b297b4a9c8556950c8527b09253e250a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BA4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4DF7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit