6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe
Size

3.4MB
MD5

d92fde4b28939e491c264fd67909e362
SHA1

bc596b40d267121b4b8c81f429af26fa5a4e01d0
SHA256

6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab
SHA512

0c0bb43462bd99d4647dcecc9240961d50d5a379dc65fb673109760d00fa113ec4090b1e13f8bf6374a7acbdbe900e66062cb58bab8c3ef344d53f4c8156dc0e
SSDEEP

98304:5KN1vg0unY2ajHTYQ5DvNOnYlfVQN3c7okg82:y1EaIpnYINMcl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d015dd7845f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7772CF51-6338-11EF-9F10-6A4552514C55} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000055ba3ae8a2202696ba5d2cfad187bca48d7a316563c3b33945ea4666003356f8000000000e8000000002000020000000aac4e49f2646c6e4d1cb62cdce2e1cca1f551592beb0454fc644baac08d1f14320000000ba2421cb117978574ee39a2338b8d28ca19ed113bf75a4117975b090bec707a140000000afa920401aea8d20f0ec228bd2a9ff88fac2e7019609b6dc2c2d866b492f893355cf53278efadc1a081f957bf6092a091e143f46170aaaeacfaf93088c920e13	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430789835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000000f43fbbfe71647bf9c3930aa7c4ffbdcd4f950f1dcdde668b62b14a42bbe3b39000000000e80000000020000200000008a59489cbd998db5ec9759c896fc5bfa99ec69d1082babcf5b6c2babdc969f0390000000219b023d70f0c312d558a08fc75bfbf612d87eda381f927a176172346ab5dc3fd77839927d14c19f524409968a6727f5231a01cfaa37bdd3e4bd8ff70d4c6222b82daa4038a4c34f8d04ea618098d9ab605927173b5d82fd2cdb1a070e97332af3609e349704324f33d6732bc0d3701d39448446692ec9f3f5e3d6596955674aa46e1bf5671a9480c4b61c8c52e4ed4840000000ae1d3dff84b30653b30bf868ad7f405ee5f6149743ce495c7b1da31321215b87eb3337974fef20a6c630e7cc6c456e259217803faf0db7b0ad22a8f75a240cb5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	iexplore.exe
2840	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2840	2672	6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe	30
PID 2672 wrote to memory of 2840	2672	6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe	30
PID 2672 wrote to memory of 2840	2672	6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe	30
PID 2672 wrote to memory of 2840	2672	6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe	30
PID 2840 wrote to memory of 2568	2840	iexplore.exe	31
PID 2840 wrote to memory of 2568	2840	iexplore.exe	31
PID 2840 wrote to memory of 2568	2840	iexplore.exe	31
PID 2840 wrote to memory of 2568	2840	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe
"C:\Users\Admin\AppData\Local\Temp\6836919f07d1c1b03cab70b12351c811e36286dbcff84ea990f6d87fb9e058ab.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0e481d9a53656ba8f7dc72f5e13eddd

SHA1
fca4821657232d8647d0496ad3fc133b85778b85

SHA256
b5a926be54583bbb0f4221384a7d343807a7705c630ffcfb1dfca4425c6978c4

SHA512
bd628be41c371488f0ba053653e19bac7a251d0f00a2c0ea0bf4096a079e6edda578a8d448c1ecf70f91a57165bb118c5152056b5fe9869292630c910318e8fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
135bc57ee8369fce3931200a9aff384a

SHA1
857bbb4d9ed1a6f989e604759ca220c76d788858

SHA256
a72ebce7ea51648d145a13d54c1674a67ba171b8aa54bd2fbb8bed19f3832ddc

SHA512
13be1e09a62cf038cd99f7e204d3916fcdc26c8eb9e1952f7d7699bb10f2e8fc010c84cb2dfa3f992777ac8a77ff0956e8f861410108b0f953711e5a6d3bfa47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a39dc9c43edce84cfed8e5f361ad13f0

SHA1
1e66ab3c389f58e8bd0b63b440ad8199cd324ce3

SHA256
203a294ec271fef9d3a1d9eebd1e4f2c0abc8ac4aa07fe14c90b85755f6d911f

SHA512
38a7d5b62e22829cd9d6de9d11af756ffd15b5b703a5708562bba8ff9031f2fa0899c2546f457efdc3417712e8e0732db94322e672ec4119fabd83706ce308f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56576e6b991b69ad860cc73df2d5ecb1

SHA1
eb3e430db4c9a8c361837c20b473c6d82b849be7

SHA256
a737511eaf091a25a7753b3fd48ecf201b20449b0dcab4a3e06a3d65546206ad

SHA512
c719c765765f973eb7c9786f32c580f4263d6964fb8890df94ae791383a40031d23f0b1ca0515b08f490eb4cd4b678971ce33f8d8507ba94e4ab23f02f73cebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3656e0f675cce4f6c246049221e70b8a

SHA1
ab376d14f3f0833a60df51d4727c8172bdee1427

SHA256
05d4fd2a6db1e84264ecdd6c75f0c516b668fc2fffde0ee7b8c4bc16ba4a6463

SHA512
38ae84c9206c6a552dbe9fe179a13213432a50f92cbd0a8e78d26fc9b493c5c995db5615a4c7c66e586de12c2c18b99bcce1016888f47d9c7c02b1a0b699565d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19e1fe99b0b2dad49fdd278eb2dd0380

SHA1
d8d2669629c8cbb5ea7d3872a0d5b3fd4cc8abe4

SHA256
400cd23e83343a96d9022b52b4d0e7daaa8d7d4ef3a4f3805ea15551d62570bb

SHA512
3e011517f52314bd1a422b8071afbb283d819f15d94e8ed42b2f1413e183ee76c6168ee58cf8e4ac9ea695a20de48313627df40913c4ff9805bf057d4c282481

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f3b68f963f35975c8501aa8c77300fc

SHA1
a2fa1b2686c760259be08cd6eef0231d63318e57

SHA256
91d73fa5517462eeb878e563ecb1601e2e6e6bca65b9611ada8a20ca4050023c

SHA512
55d9b8e9222d6e2022237be28f401a8fdaa38673ea3fc9b8841f607e49643efd476786280398cad5347c10aecce16e80160b34ac27ecc45947f2c2c8cf9748e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52488e4245b19c47b4a9b07649bbe4ef

SHA1
a7e56ed56b8364ba13b0426bf3cb7c40a242dd88

SHA256
786226da728c0773e4c04ac79ed94842c5aec81e27b8046abe02e73900b59d66

SHA512
b48bd9b3665404c4d2ac45883d6a18c8d425750020a674998e7c82d7708c2474c39b11253061043a2f69e4ef1019b5fd92638ddaf11df6891e369647b952d605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84e40de545003c595c59bea3b22aba07

SHA1
cb71242cad4cb47823a43caf9c4c4777d951846e

SHA256
854d7f4565fe3106e25457de3d40f936705202e85907507bc05923efe10205e6

SHA512
6ffad805a7b01d0225850cd5690e1a3e7905b094485a85d2f5a64b8d47385a855e8e3037b3146f8e92d882347630aacbc8d15683fc10280f938628ce4025be4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e9f8e232ca35630676b68c104743dc6

SHA1
99e5f73b59e35ce8f54984265d54d9d64cad8d81

SHA256
0cde28991ef47485409ed0ddab8b7c3ea7c47b55a85747be697291c497459920

SHA512
e39ec50c54fe8734674a3752d148f666c69b9240764401cbd4a9a98581d3835d580e95ebbdbfd567ebf287148bdc537cbc031abc1466d9793be57fe7a481f50d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a20a8e4b97574cf99a9ab711269d40fa

SHA1
9d0be048a7b05adcdc3f5686636761f53d8c841c

SHA256
132cd7614dbc408523108bb279f936a5bd01f6020c7e92678d6b97312360b7b6

SHA512
c5773047fb0ba18a9e2cbb2bd265179c0152146892f7e667ce66054785ef63a426b6a96c42201e368f8dadc668a32ead5ece034866d226f928e09345b6f3ad14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33ba1e6e03e2910d0ebb6e4db82b221f

SHA1
a2c4b8720b3ae75b64623668bd2d7e654ce9e35f

SHA256
ee6101e7498372340ec99c02086024ffd128ee0e951b2aa6082b775068e0b4c2

SHA512
ee74a957c01e42349389b991c7bc7a086ba834e058fe49ff0a7b97d01bf1c37308d70e563146733500885fa6150607f191663256a1f389d3e4a58d918b97677c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ac1292b18d5614a53b48d5ed4a6e46

SHA1
402e525e3b7b0ad4bc7e55d9d407e25c8afa2e67

SHA256
8378fd7ba170e87e165aaace90ff057a1aae9940df96775d25bd1afc57eae52e

SHA512
2d52f0be116706597c9232fac470f4d78bd9dbf3d0fcaa1417b19c75a960808b0888f0bba1956076bdc4a037738717bc0f9094a382087951fe8492da14395d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86114b6ce6d4a7f60ba47008440a1ec

SHA1
0153e35c2b81f0dded694a30e1d11d8bcb308710

SHA256
55677ad115e5968f0ad01939540a90dae0ccb78dfe8599860f2a990b78312040

SHA512
f07b9d3861bf66ec224bced9c5ae2a28b393a19d4daf11be7949d249c917fe47d660186f04068b0d7a5c4b34bf5acfa93d5f88714ce1f1da6a49318082fca840

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B2E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2672-0-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download