21c96d448ad302f685a588da42e64ce5857bb02487de4df4891bc1abab7aca33

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dj/163/Admin.html
Size

725B
MD5

6a3fd4c1587e55cd2c4412fe2b91d132
SHA1

0c5f0f34e308a820e2fe22f964a998d5394c6b1d
SHA256

bcda4d228cc52db381ddf2e0f8b34a4b89d615f60bd56298d5b67bf05ca56f20
SHA512

ebd9c6ddd963d9cd686e28654af70ad35f3008ca8f97622abff86b2ab444ddc8ee87968affb5f6b2fb702b4eb607874ff16232c0603ca129c4e549eec0ef912f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000076e9bb96fbdfab44cdcd682d7258a65e6c4f1ccc5dab0f91e3b52370346062cc000000000e80000000020000200000007a887782859f757ef499f2499e943e4ef787de09c54ee33bd570dc7513326aa220000000551973a46c7e2563fad716cdc520408a65acb6749fb0d7fb6406da833f035cda400000002da305fb65d5af53e48852491645aa5b24d58e85163dc40ecd44c13ecde38cf5d7060b9d5006240f18e0f4c5d802f2ec3bf51a311cbc9424402016d412d1e4b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0db34224cf5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DBDB171-613F-11EF-B585-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000991ed28da0c34f0c1e0cc134d85aae9cb8b4a767fd35a83c1924063970132cbb000000000e80000000020000200000007b313d0ae0b523f3c997af23119b71728a6a809e83b865e170aa80d6840e37549000000063883729cf1bbf3073304302d2d7c5b7ff29eca5161485533eb9e5a1852c1cb7eeccdd0aa77faa5ffb4026a1f42e00e7be0002b2496c4e84ac6ab398dd0d252baaaa9d13942fb9ec2e9d31a3b2f0d82dc95bad96ae10f90bb22ed2a3483a4abcece01f143a119eea13ad92f3cc06e8ec8dd24a65e35cbfbdba853f63970653e53ce12f8291cc62a2cf350b91a5321495400000002519ca1af0d60c1705d9df4925daf94982eb3858d071771974a3ade694e619a3f11191532f3f373a318ebade1155a234c4ccc96e072ca482e5ccdc6de255482b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430572866"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2288	1056	iexplore.exe	30
PID 1056 wrote to memory of 2288	1056	iexplore.exe	30
PID 1056 wrote to memory of 2288	1056	iexplore.exe	30
PID 1056 wrote to memory of 2288	1056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dj\163\Admin.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0813dc6a0c977ba7e2c5d9de55607b70

SHA1
eeae6a5b8610c7778fd524dbc25c4f00cd7d6b7d

SHA256
e8f661482c250abb85accdeb6396ba1713b52ce6253be8dd7b6af8a9204f3507

SHA512
119bd62bc3b81138ae3029ce704d8a407e57d5bf1e95bdd7e66bef32ea1d19d02e9fb168586f17dc5338cd217fcfc144952d1675aad1d5febc7471d47fb576ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eb05494de2a98690c857e15fbad29cd

SHA1
2799511fd00ead9b4f05b4bac14d3c787cb25bdc

SHA256
349e62469852fcd27d60a0722fc45f36a1da40f07f8dd259c413f7835e6d2b49

SHA512
596a709097811d66b8d7995d38206d02bb1bfc70f2b4ecc074ba10d53502d4354eb0748e3d62858420854f4a9c4e5ba28a04788293d1a9a6bf196aa401f5d692

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8bcd2a52b365de62a0b0e4ffff92f43

SHA1
927ed349755d61371ee3cccf8a7028197774cc3d

SHA256
b748f5f0ac4a84211a5f5f54f324ca1a199e3964108cef6fa79cada4433a2491

SHA512
e1682045e9ecebc495220282c0f568ba1300dbf9a81ae0c9fc419272ffabfe6b454b8fc3228a8bbab97476ce009f8283541afc03d099612400963f4102a22d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
921ee96a9f278d426a47f3c7a5924de4

SHA1
e6cfc3fbcc3589bdba8ab8b97bbb4f0df0439e58

SHA256
5a504b3de32be017d7e736ff681555d8dd2684d734e266e87ca48e8981c70c07

SHA512
14a81fb600f3ad64a8fd6146a29500972f476859a2a39d280fdcfcbd45f4b742b7169e54156d2c18cf418eeeb0264aca4b66e8091cd4b2b304140e240b6e222c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48fd90d9bd16f539d6d2388df8bc6650

SHA1
2b41b813d6c4ae9e71c3ee9ca5772ec20c161252

SHA256
8c8c5ecbc872b0fcce9a1f336b2e8e8df2f26483601ec603a65fc6f1aeba5f7b

SHA512
e81d34ab55321195437092549c988f2cc35ccd1985168f9a4ddd14e59b1f6cff2e35e11bf32b2fdd708f63c8e0e8da3b2922db94e39da03a1f6cfb136d8c741f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5260c762afd7d5e2f6a747714242b2b2

SHA1
e00113aa710afb794e96a5fd6cc26b819ea56670

SHA256
f290fc723f7198d1fe92075e4f626567fbf824e1ffb91598f652c514dc226b7a

SHA512
d4600ca7b86a94d912c4c8d33e307a378c06efe041e309a744496bfa10f8fa259015d7d70ec3394dae30241b2a3fce059668eec32db073a467fc7a4418a53050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe65ce82a578dc0cd7f6aab92654f3a

SHA1
dbdbb459d1dcb5ff5c1d1920d1b8e0a949f57aaa

SHA256
91164041a76d6abb261cad0c156b5f8804f848aa08b3f7bda3ad06cda37d4eed

SHA512
dd3628f317bd6bb16916f47019e668249be56ffadd1d790db2a3168c9609937b194ec6a2c3c7975d4a4735bb027e30e44a88d68f33d5e758ff8fac8594f4d155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414f93d345af5e195bea5673449ba9de

SHA1
412e1f9c509e0989d219e272d77d9c905a0d08f1

SHA256
505ab271caa9a5f415e48c621c9e2389f8ab6b931230411d9e72f7499a74a9c7

SHA512
8d00c42e72b71b10acc04d9a01e91efb01dbc0033ab5275731fcc34011e24305fbdb98f201b78581219a16aa79665beb7f3a2bb99af36edd8dbe28f975737d5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a19264b92f0f6245d945efd16eaf4c4

SHA1
ab38bd70f9b853688f9052e168c20e42010b1cc1

SHA256
8b9df9d7bf1370e4b050318c7a01da7a360f261a17d8a6b8ec0240de652e63e1

SHA512
8d21ae6e970d6bd65d5419de60b280b59f54c34b2c31861925f72ecca38d995137a1794885823c623e49f05e3dfdadb1af0271ac2a3230a587a82ead893a2174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117510db26c970c6f4ba1d74dbc209e0

SHA1
891a5191d191b67c465e0fdbff584bb1b6914c26

SHA256
75574e25da71591bef55bf1c8e4588770c85f17c8b3f398050f43e211c47af5a

SHA512
9d624db0f785118115a1824a2233764a6ed97be6755640345837f938ea910c6cc8f761502af4474fac1904780fc2ac87eb86570382e7415f0eb7f01d9426b0b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC21A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2D8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit