7e51c322d7b1c5da3c16c7f0568b5a6596571f4f204ec7427945312940ff5422

Analysis

max time kernel
134s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

3480aa6f8a2f2e62809b801c80c0b809
SHA1

89043761f6aa08c0ae9920d87a5ac17a951519c0
SHA256

c21aa7d348a6a08fb8cdd0c037ef40bbda9217c278b0723e336ec3121626d4c3
SHA512

da47858b708a6dd99ca017ecbb2e22c68d989be9d4ae80e78cbe743634881f8150e0ef3afe7cfff59f1aca08fee702a96c35f34b28497b26c95f48abcf9ef2e0
SSDEEP

3072:SsPlTQHgzWISyfkMY+BES09JXAnyrZalI+YQ:SsqN2sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF6E5581-62E8-11EF-A641-5E10E05FA61A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a8aef74fc813217a48bfbb383889d6209e5477c87c213405d8855e8fa5e6ff25000000000e800000000200002000000061a7267aa081e7f69428c8c31bf9a3d6bb98d5d3c303f5b3bd9800ef4405f4729000000049f27dd4062b0a098f296b06b4f1ac99d2b0ac9776cefd7d92decef98a1de7eb79b992538529eceed47681cd25619a79d68f211420b04ab582897de81c24962f7400410925a0579c914e793d30bcb4869950b8ea9f40bf1e39aaddaff2d9fcd62fdd35a58c527fcee8ced41841358de5a8cbb69e72bc6e2e06f2dd61b11869e267732f42c4d7304ba4405b406944bdba400000008182b2175476da1b6b80ad0e6104a77bc0c3b29d22ed8933b6371db8ed3071e79f6b138b9650484d086c9b52ebc19dcb4a0adacc5e6fcfd0fcfb3c2c80ea943b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430755620"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000958c438f41d1a7ee219bd5ab8cb4ea378e43c83046c50172ddcd27bcea1766f1000000000e8000000002000020000000b19359b501cdc0b3327e8945e28ab12a396c2af4586f11e53d6a19703000953920000000f500b1205edf246ebdfe8d8d763d429e5f61043929b51f1ce46ad8f308c058c0400000005818ca7d6de5afa733ced10d6aa95db85505bc0ef8c6ee087fc555330139c77727d32825eb8cf70e8e4b0b0a460597811a01d93454789999c5a6fe7d61e708ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509869adf5f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2000	1096	iexplore.exe	30
PID 1096 wrote to memory of 2000	1096	iexplore.exe	30
PID 1096 wrote to memory of 2000	1096	iexplore.exe	30
PID 1096 wrote to memory of 2000	1096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ad9c25de3434206686f7fc49e0be5a

SHA1
014d7f6ed2668ce3d932b3f87141a8d1bae505ec

SHA256
dc8abcf8c90e86e2d99436d4635cd66ebde5d029b914bfe43d82924884e04d14

SHA512
719ff0d905142244c480e7618688e1325747608627cc101da7867aaf3c1502b8c960298b125bfeaaa091b5506145f3d2d930731492ac5735ba7ea6db79e27d63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22f5d259ab6da4f2f42d60594f1f173b

SHA1
9463c9616b7617160fe694ff6efd3066165f03b8

SHA256
cea32a65ea349760f747e6f5f0a1b661e1fa11cc5e309b9038070476d30fcc15

SHA512
61e5ccaf90ad4376f9f500f74e6a4180ec37c8d168f8339bc5e3160d339a6586d9850208f935ee1482a858cd2023a7aae8fee494c516f717fbdbb7c8a3e4d3ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34f05a0dc7391f4b68af4da60ca30ad1

SHA1
1741b52639a8d41a7fb98d9a604600060d78ac04

SHA256
a387290e8f32fe41c2e693902871af2596bd99427a3c0c66628ac65251ba728a

SHA512
ee7cee3f71f56e4ee7657bb701a10e036b041b7004e05b7a5beecd06d7f08e706be5bce60437e2b16ba0ff0e513a464b7dbd761a682f11c882d5d7fac8b37c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a0d6c2e387e46e78ef46be44d185c65

SHA1
1c5d16b6896190124fddbae723181bb853edf9cb

SHA256
ee2938108c55262e9b1812abf8c9f6e4833e15ad7313e517d8188ee671c8e5ab

SHA512
36966e80d0a4511852399e93a29b734e96c575479adcd7abca34de32b2bfe7b9c0acf24525d03e30bcf8232d0fd4e34cfc4b60b938f5ccb554ee9f973390d72b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9766171a072ed84dd6d54685b11c3ca8

SHA1
88e56f745c708103e1391b8bece01a800a18b159

SHA256
1e4b931afd6a41e57720c8fb92d3eadc1566a5d65f7d683845678f27df675c78

SHA512
e064c91a350021304569cfef3407c6e6fbe7fbdbd7bd39806c7ce3d223169390a02e9f09a083128bffe0ee640bb5527673ef0de19ac5f669d9aa3a49c2b1a7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72392687b5ccf3b90921ff3422c02adb

SHA1
642f0f9629192a1f51f30d50a6e768c0a91bc4eb

SHA256
8fc534b9db5b77e3f54942ba6f1ac3b311e085b8cf7e10703651b3cefcb6377e

SHA512
7aa0e4da415b87cb9bf920dc9a3794ce9c79ee9b20f6409a2210a822a7473756b4dbc138cc9cf9d03746690190bba9ae2d2112f3d73e3fd2c5b24acf72ad59de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af39d4441c8d1bedd57b5bde8b826c6c

SHA1
256240f1479a9cf7fd0cb7773b76f6acaca9a0b7

SHA256
a407096370f6a3633e98079dba596b1305a7e4cb006f2e3e0a32929ba563b185

SHA512
383bb1aabc356fc822beb14e542eb3e05eef0ed122087626ae387176206caa1b291699d087eb3a46741d26cd6a492b5aa26468a2f1def9f2a854983c5808f0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f21b54bd2dbeb36d7bd4d111c7d05dc

SHA1
293b37877ed4a895b64053382ee1fbeca3dd9a0b

SHA256
70115c4d38fc8fe3eec245bef5a301f85891482617b994850b5ebf66168bf4ca

SHA512
65cd3b149e9a3a17ef6023aae60f872147f9e038b044fc7cc490f98bedffe9e422e0462770535ae91c8ef6a3cd4f8cbf8120fe6cc96ddf898a559c9047fd4613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acaceecf839a5043d276784278c5ca43

SHA1
4e070b2b6011af52cc11af7a8039788eb148f8b5

SHA256
a39532a0e8bf5d73684ef63275ce4dd16cb72901df66c707d50378975e4161a1

SHA512
cb9eb7c6f3e027aa1fb91d594fc04797d38aa540ff51e6c13b8c8b69d6eea88fb2c83c4444246978e3288b57dd643be1274ef6e811a1c7afda3d81093c3f4fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fefe4f2c623993af00090f8f08bbd35a

SHA1
726c1da6bca4fde692b9fb9ac43b31ab9e5fd17f

SHA256
4ab83843fa55b522621af069841fe16c79c7778837b0ce5b7a3086bde83407f4

SHA512
ab01ed6f161d4db0805af990213dfdf4776ef22dc3aa400a38de11cb1b3fe9aa0fe65e4cad28ee211da1a8882c194138f330d1743ca21338d8aaeef3117dc589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d7a080845e0de88aff58a71fbda4a39

SHA1
552dd6afc950a337fde5f10d723a7872bde4f82e

SHA256
2f2371216eecec6989c7a8e877cac506bfbdffe0a9714a767fecac2427f2f126

SHA512
e797c7157ef2ce26676f06fb7c3fa05fc972417fbab76b2176893f5bb91ee6102f6ac7a74258ff1a142fe4852266d376fa284dfe0730e8c01ba1bd0741fa395b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d92dd371d812113198c9063c14de9387

SHA1
da447dc5358caa5fcc1515ce5f1d693b4e618b16

SHA256
7c195e51b174bb650eb3a95db2a5aa5a8613dae250961b7c0804b05f019f9637

SHA512
6fb922b9ef929984cdca4f3e85fa2437601f166d94bfc7208e879a73b6c9f9f8d57bf1c862e708eba6ea29addca8f2b2ef130fa6e859abd5e56f5f0a74d00d49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e1f0313a6f3d4ddfa6103a4dbce504d

SHA1
e620cf6f679f8490d888e5e3443db61bc284f242

SHA256
5415829a1dde574fb6a22447552f0d1bee2b675b7f3ed0be2726ef7a9540c8a9

SHA512
7af9c8b742d182973f0b26adfbd906828ef03f6e000d41488145736a694f18fc25de5952eee104c3204f765c0b9bed59f7a36c2fdadbcc8f3e9471837b19974e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
927928884947ef3dbf02233e372d5f33

SHA1
f7024c17f301680cc921e824ed210697a317454f

SHA256
b47485e0944c78126c51c9ff5192859a41fcea148252d3498e26e3966b80c20d

SHA512
341bc16b8e607d46d55586ed609a3f4062d72a28090352803313a7b1496f74875e32f3be01a9ca4969e3d0fbfdc50fa566f654cafd8e2a7b73544c57608540b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDDDRHWK\square_g[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E3D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E60.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit