1fdd00d772e0f06af325336a5cc314b6f0b995246a033281fa32a17a6d855ec1

Analysis

max time kernel
117s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

relevantSpecialty.html
Size

7KB
MD5

cf5d5394fb17549ba347306c9b79949a
SHA1

b8d8db3eedf3da48fa43e92319fb381b044cecc8
SHA256

c3777516aaddeae9112318727a102c19379578e0a5a3802f58012301e662c27c
SHA512

1297b8764c866ce90e8ebe741f85f0f20b19d9b4ea9dcac37a8d535bed1cac63af40926454da19b63a8a689b42f4737b1fbe7dd75e4c74a7e9fc91b23d91556c
SSDEEP

192:I6b5Zzm13A6hjqoXkwISqcIJQUs2LuNQp5pQQmwW:I6dQA6htVUZjmiIF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000297c1c35351f327ebfaa3911059d9118bd2f47c5b43690fd1a0a508237c84149000000000e8000000002000020000000475a1fa326f0f3d7608ef8fe10ed4efea60dd5f8f9c725885b46d9e9161ec4b090000000c51e84696c19189ec902fc89cc49dddb8abd899b8d1cf4bceeabd6e9915db66b9dea0951d5cf26718aed88d06b5c3eafab64c9a48bdd225a8466494cb7200143e4b066357f59e6b93e0442c6b50ee83ad072545cadfb0334896be27ff56f318fe75df423d3346e644de3a24d56059c200f8d3b464f667f8c81e5a8cde06f10109b40ab0ba2a5b6d99b2e3e73f3a4253340000000762cb7880a6c1362e85060cc218196dba0a2a2fd1bd68ccd739a2dec6301e1d9a2b9bdd22076c76e68f0008d869c5d06a7db02a56545168872d6697ff6eda8c5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431088257"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 500f9510fcf9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000dac94d7629ede94e4fb244b82484f454be3e96e72a7e90c09eb77156245ec1b7000000000e80000000020000200000008a15be27453de403d85f29294d4a811478d169f3f9c8e7eb9270ade8ec0eba7c2000000057b83a77151a55edfc12e1da0217778eea536f94e9515441de2f25711a6402fc40000000a59509419e83203fa8df10bd3ae869f1f57bbea4d1ef44466bd0b6764f41d6c4b9cfc31abed0544ffaa25d2243b70b4366dec2b85a5b570f5bec63b5c4f4a622	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3C2A7011-65EF-11EF-B170-4E66A3E0FBF8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2804	2604	iexplore.exe	30
PID 2604 wrote to memory of 2804	2604	iexplore.exe	30
PID 2604 wrote to memory of 2804	2604	iexplore.exe	30
PID 2604 wrote to memory of 2804	2604	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\relevantSpecialty.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f8859dade0c706ccda3e738f8daaca

SHA1
d9218875e57aa0da728b703acfd1cf5290f7478a

SHA256
0fb24cfaa64c5819189af701ee335a5d1b48244035409c0d61cced37df0794d5

SHA512
baa59ec427c208f8d8d65c197ff523e1ddb51333b4336c1db1398fa99e4464925f552babaa5564d8d6c678389e43d70888583645f9684945c626211f4e7a93aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf7eedc7431acf225e3ab28279bce58d

SHA1
24ea00957612e23062635142f618418dee4ccf23

SHA256
ed00771f89b74e487f1db7b8adfae10e8f00a79c3423af029a3d57b2d50145a1

SHA512
f4333f0ed38debbb852b4db458f2f6f441b4e339a5bd8ef9d045f3d88115ba1d1d40899caca385090d2e66833853fd8fa620385d65dc594ebc82f0829c553698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096d34131c5494c624a2d067af939405

SHA1
76d7f10eadc2a4a3b0d9ac55aa326882a905a77e

SHA256
530248fca9ac7528d0418eccce31fdcbcd351c8ba707097597522a0e75caa21c

SHA512
000458eaf5711548e57f530a03123b2bfe0ad26b875fe429a1b8286da50be97c137f7f21b5533998a52a9aaa078b9095451ad7660702f3b6fdb9081ead9d125e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
737ec4380a93e9afce31f00529bb2cf9

SHA1
ee3918e929fdbcc21dfac0a504b47bc93a31ff38

SHA256
2428a787fb28163eaa587a156063090d6f9d47d737a6f5be18b62df25bacb29e

SHA512
96bdc77863715c6b3d0afc16032d0ee17da8a6d7e36f4bd58c93b3bc8dd244c3b0e2a519df7b19b119152c1bc61b6103c1a7c8cc20719589ac0a53bf0e62bbdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcd72fca559bdad8a8709cd754273b07

SHA1
8d4465c8d5033c7ed1173024cf765bbc23f07423

SHA256
6998f62d204076ce75f44fc0a4d931cdd76cbb251a12326b38310003a6152b3f

SHA512
bc09f71e6a910b58e22abd513655e404fddd25301a16a79f735edab09a25f2074d038b5731b1e4e624dd650e73e5a2c9a94bf258a803a33f37fa05a5aa10b987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55b1e2fd518c97da58a33de4e8e5a3f5

SHA1
4165a240760e2e334f2411ce36e95c31ec966921

SHA256
1d633c530e4575e8992eaefc181fc1d2238a1e4dda5399519ce18aa9b1f14114

SHA512
af06c02eb5cde4ede3716ede901177384f56315f520d9b3fb6be1efdf390ee34bb2eb9c38a600c7043875b64cdb8cf81d6517194c3a64a9672a98691266ad7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab65E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6677.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit