bc2e28250d51e69fb5e1c1000df69ab12dac0624feead57d2dcf5e9b8d4917d8

Analysis

max time kernel
143s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

7c3c1b50c82ca0526fe0f7319569d17b
SHA1

018c7a24aab6dae5a3e47012898ffab0980dcc00
SHA256

ce34e25d619d58cf4522bd0143597da29c100559e9101624fa6f59987432efbd
SHA512

5c3f584494c17fb9dc8f8ba78a6f21ae44f890abaeb9143c6e34e6d33837e38db99c341f4cf6d818b01d3ebf27c08a634c0553769d570afb87a0e5df5817bbd3
SSDEEP

3072:SUxwT/MnJL3jcyfkMY+BES09JXAnyrZalI+YQ:SUxnnJLTBsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203383f21df6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430662871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000bf794274b3eb19a7c77137dcedc2c672f48d8fe5253959043ca494561e007202000000000e8000000002000020000000e0621bad3ec7eac6e68563d219ee90354fc2ffab3918c2822d68dff2fa6daa26200000008d1ec42417b6ffe03b3a689dffc08177841ba5880a029683fcc572458b3778bc40000000a359fafb4e17581da1dc3e33afd550afa973e171151073fcf0141d5eb97c74dffc21e49f59757f4acfa6ef0b22c8ca310bccfa23875f68661edaecc687c4f893	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000224845dd375c586ecc26b72a21bbb66d5e50c7dec6aa22bd4075ec303db4e754000000000e80000000020000200000000b82fe8ed20c0c4692fcd5cc052aee868aeee0f85cdca76950c56d4e1e00afc89000000058c24ace2d0a0b6b69d15e27cf9b0abd37d54be428f4c7a40f96ed15d98342c13220e8eaebab176db69b09f06b1c05f5338b0ee62ba3e917a24ba9edd0e9f0c3baf20a9079a6666a04491644c9daa0b9e54c019789808b388d7fbf036e45b9417d4ef7a545c6e38132eaef884527c7c2184d6e6a045da586af1a858d00c1c7ff173d667a27945da58578a5ca2241477d40000000d8338c95b86a867ca15f195b25aed88e8392fcbb745776b90e46cc15c45d94c939c3f96c7b3332fb523b9061836ceec92cdd073b3cec244d6c1dba45cc355031	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DADD3681-6210-11EF-B161-F296DB73ED53} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1824	iexplore.exe
1824	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2852	1824	iexplore.exe	30
PID 1824 wrote to memory of 2852	1824	iexplore.exe	30
PID 1824 wrote to memory of 2852	1824	iexplore.exe	30
PID 1824 wrote to memory of 2852	1824	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6a8120fca70cf20ca81112532374bf83

SHA1
8983d5928cd4c69c0767176fff4070fb9ee78170

SHA256
dfab11426acb7937a53fd91d51b30cb0ff6cf6a40147b04878becf5d62deaad7

SHA512
d9b8b2f497f2bb698223c253ba148d03aee76d7ea2d01ce748559a840345f7e2454f5036002e1d29413d41339e1dc385a82d0bb827d66e5c245329d02b4b0a13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
29b4ddfb793d3c5c5dd1456dc6ea0870

SHA1
82ff64a5d8ae3e46d620115c563bc8b46e6fec7c

SHA256
c673c3db8935b18f71f8828cca85ed1e9d370ed23f0b681a717a905bb4d0333c

SHA512
6db9a130d5181521aba958fa271d7cf4fd06b31feea5e457e391579933ff317ea8f9964820ff61be5317ee30bcf6c17727321b98d4b6d000af129eb7b07e47e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
86bcf1d06a44ccc39d010e9d60c90f5f

SHA1
7a4a949ba64e1d5e7475e242c5840c088ccf49ca

SHA256
91dcdbce697ffad9aad99fa9bd1f8d562deb9842a898c9ad8cf0c61b491b5aea

SHA512
cd81e54ca865f5af27dc5bebfeefc244712da602887246e5f352206dde9d85197afff8b803bf0558522b2b6d9cf5eb0eff48630c0a018e72b6d9210f99a4d15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
94fa1f9a516d8cfe726d130626d6300c

SHA1
c89a54448aa943b6b14646ba53e0e974f9c9021f

SHA256
a63a2e22c8bd08be26a79ed19f7d1c3028bad1dc11775fecab40b6f96fca4ebf

SHA512
fd601bd83ac22076de50b6db070caa4384eadb45b8653de328ee80050aed29b1211d11e723841b617d7fde3965755edb8943cd885ea3724fd56fe8c59abf6a69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c09c2957785425485de0593b7b6ec5fc

SHA1
ca773f75d668dac17a48b7c281bb143d4a823a26

SHA256
40d03b2ccbd202babec51397b4e660aea3668ebe077ab73aca0840f96d96f591

SHA512
66031d9cd51bc9eab69a044906e946404a495a59b089102b25721292a4ad3b7101ba796e75f83275f519da304be977dc4e6f4d4f19f6adaa089fe60472da7e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cabbb2016cbe0dd8fb04eb9908ce7fbd

SHA1
5d181bb093e317c05bda44ae9b6db01ff8aea46d

SHA256
b4865cedefe72c69913dc987b10beede6e16ff0bcfaa5d0800c14bb00844bfef

SHA512
95113c501716db1d0bfc82907f3bc822d817ed39628b09e4b3d55fc0c3439e2ce81976ac1cc44ec2c177cdfeecb5bef419a4f064aa1185898afc68d3c59e4020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
729eb4d4a2cc122354b93bc2d50bfcad

SHA1
4a48f58ac3ab30ad749f5c43676ab71738177bed

SHA256
9fc251dee4d7702571b0a49e804e1547b76e76f835481fba272c78e91b378f37

SHA512
d4af11351cfc05cf77bc42568bcbdc96a86b0d3460d710e9917b57e392ca293a589a5e54a842caf4e1204e32451571919d9e3fa0a3d88f28d555a1010cedf777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
03c0751974b07057d65700b250986133

SHA1
85f03247407eaf8350d975af3e1f010b61ddfac7

SHA256
090103862e98c546588eca2ca42ede12e19610c838b799bd70b5805877d5efcb

SHA512
f14037105250e0bdc60fa9c5126210c5439dcf065a2a969eb80f17a5d91ee8105972e91af6a67887b8734a00202e43b57f3878ff7556df24e067d6e6ebca9cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f323f47051f6ecbaba3e0941335120b

SHA1
e352198edc04479b7f7a76f2c59af1800f99722b

SHA256
aebb17d2afdb5f52577aaf24000127de818da5ea77fc931c092d0f1a06205731

SHA512
3e718966685ad5da78de4f529e9ebb489ffeb2a3d07405a67644207fb81606cbd8ada2dba61e5c6bdfa5309115b42d70efe4c198ff73578402aaa929116f848e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ea418848e999c1f358d6dfc0a6c5e349

SHA1
086a3366bab1fe29149700401f9dfbf9068b2fa3

SHA256
5161ca7d9603dc11cdf57cb885a843226cc7d76aa062badd5970fd09cc73dab0

SHA512
206a0e5297c945618aa2a29b0173f502e285888c49f1cac105a601e3efc07d65f4ef8abfc8450b725c8c67c26b3702917b5b3c5b2a1a8ce76c8c311c7a2bcf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
38059b7a8ccdf3c76a1aa4086d9d1e6f

SHA1
95f64af5b9066c69c1c4af4d38a0cf968a84a4b1

SHA256
c33c8e5f72be3e6c13fe2f9441c98c65b666e0b6b011732a1afead3ade64a8d1

SHA512
1cdfbd18e7113b07fdf1659065f4127a276b1103c13a1866236189544079f2cae9a04195d945f38c695f73d7e1375b65a17eb5d81901240362881dad2ac67761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab785D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar790C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit