14f338626aedd066b815204b3a303d7f08fbc9d128bd93683f424a90982df3b2

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

f946c27bcfd646f75e3df11d5a9654c0
SHA1

40302998ba455bb84f6da8f46851ec1f14de16c5
SHA256

6768dcc0a9769564963452720b5808700f4718dcad1e58ec891c0d8ee52a415b
SHA512

223062bd195b3d57a56c7b0c31f3f212bd8b6b54d42bb0054b4d99485a272b10267e3dbbdc15aa4a6de6ce5dc96eeac329ba04e3b3d6ae1264b2c63e8a3bbbfa
SSDEEP

3072:SR5FCTL0GiRP79yfkMY+BES09JXAnyrZalI+YQ:SRWwGo8sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8363D681-65F2-11EF-ABC7-72E825B5BD5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431089643"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1812	iexplore.exe
1812	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1912	1812	iexplore.exe	30
PID 1812 wrote to memory of 1912	1812	iexplore.exe	30
PID 1812 wrote to memory of 1912	1812	iexplore.exe	30
PID 1812 wrote to memory of 1912	1812	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3a315a54cb1c6a65f8b86dd79316746

SHA1
6868061f51d67201caa27a91899d9ef30a4a7a0e

SHA256
b4568b9e985dbbf51bdcb8528f08ee9d49e411d136c7e555bea773618be5f644

SHA512
7fbbd37f710559649b37128ac72230a7ba2e154d31990c40503f4ed5d9c5029fac6e7f2a96756cadce9d5114aa7e389d61c3b9334806577897e5e9af08a3f7a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9ceeb7237ba9af484085ea9d7513329

SHA1
601593c93ddc23ebf73c6e0c904f8e802e48cfb2

SHA256
d663322272a3a1dabde9e74056335f5822012d5de6ab6b7e34eb1ca06dfcd8ae

SHA512
7841ac7c6f960e402a8478bf34212e67d02886feca4824d486123faa158fdec44caf769c4c8762ddb2facc778453d9cf7dfc36f11e48314b0472fdc4a24db786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bc31a52b8b299e098d0bda93f44ef84

SHA1
6ca9420a8f8b39e638d50d9b9f6235bc738eed92

SHA256
d8932321648eda563df0cd59e7376f00d2f8c3b54bd8993ca5748b60878f5dc9

SHA512
09c0e04035fe1b6a44487bc868fabb2662c51fa7d206ef0ac7c6e0eea023832e106a8dee65167033aeba5d821c71086bfacfd9388c18170fa6a27511c3eece75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c90afa25f90289e3b6223b444f9d1229

SHA1
5235dc8e77409ea675779586d385047a5f5365a1

SHA256
5edf5fa39af42f101bbc0559e43de02df5a2987f4dee881d7f0104790efd506b

SHA512
7381003c440e029f37b6bbb76cb850468b0a27d5d075cb951da525f8ef6b8e83de2260d3de24d81278176eb7b6a24e39229087a063632fdd351639ac2a9a5e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bad270ac50cacd044b9a3648ceb6ea5

SHA1
c1207a0a7c717927e7781b33edfb344dbbf85f49

SHA256
8ad078c7f871ea87d67e6c8371d5fe7321c5a41da19a69eaa672182287437e76

SHA512
9b733edd59d708e4a63b3bca2843fcf11c4d78434fe40d6f3ff4950f0b4a44bd01eb827780a2b348c32ec5f795deb0fcaf719ef1957bebd95b1aabae4405aa66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7c98fdcb5b2d936bbdb2afed3b4a04

SHA1
8792c8d710fecdc41c39cc393dfb0c5380e7a657

SHA256
b67385e0e2d76f3457fae0970e8e5046ab9086ce6f8d0397153ee67428e780b6

SHA512
3b6be975446cf0e29b0bdcb5585b72f1bebd326a4565ac490092a6e5a8e77fed99fc02623355106b087eb89a395bbb5e20b84d58aa1dbd222e5e427368f029a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ba7888292700bb3484617ced08d1caf

SHA1
faebacf06c0fa69d4099155acbb8cd869795bdbc

SHA256
32da9852bd11286bf9b7079ae0c67beb96d8be70a7712cc6d67b95a8635dfdef

SHA512
98cf264a8bab59579ade85c8ca2f2a800538d930c6d842efa679fbad1304ce3879895f7dfc39a71b6413167a88ed3dc1919dfbc3d4c06e8bd2fb3a111ff258cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f137920919cdcc53ec1c51a9600204c4

SHA1
955cbfa2531681f071c322a626c3c687e1831d93

SHA256
f2d5c685590c8619709077bd07d0ff30473ee965672936dce57bd80f3c215811

SHA512
46c7c6413d93245ec4913d970832861ca92b26c8c822c6f6abcd5cb2865f4f917ed1f1ded4f317e64b18f9aecfcb9ee977122e101982f6d660057000bbbe7b49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae39a132723ef042ec001bbdd72f7cb5

SHA1
099f1255994c3c5037c2256cf38c0b501c4f3194

SHA256
8f5bc0f82d34ce8398079df5395527bc42d628707aeb6b43112f285516f7e68e

SHA512
27cba44aa63a16714af97cb3cff16fd24ca6580643831552a3f5f34f7d9ae5f728e77720898c2bb02e10c574f404e538e25959d958047767318fa11e95821f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0df00b20033d0a5c6b3e08ea3d2e5121

SHA1
73bb6dbb6d52b9d6b754522fbcdcd4111e539564

SHA256
549a9cf0c9f43496ab06e9768ba6e8847611ec00163e12cf1bf772e275a28508

SHA512
846e385b322af3ff7293cbd83032bd2f150212f5785c1b3f64015b9e403acb3825969606ed205346dd3bf600e507c4cb261dc9eb29f351e3821d0aa6a594edaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6405820b755604d746a6a0622a5de3fc

SHA1
218df4aca25c61bc42ae71e03ff401e3b4497577

SHA256
ccabeffc20b6ad886389bdd5a0175b687a5907203a9feae0359d1d1fa5a3de3b

SHA512
f97e9086f7563993dae078bba6640ad4a67d6c042ca665e1d6a2960a5c767b02cd859d5aff9c4a34c37fb62749e5255768c1a6db9fb347a792dae4e55dc4cb72

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA841.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8D2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit