4d72740a693c3f3264d6a84f3ffeae9bb52e2786bec25092b878857a3e77ffa7

Analysis

max time kernel
133s
max time network
134s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

a4b68c8811e3634d4d0a2525edecd9f6
SHA1

c31c196accb136d9cbda012c8da8301da2ddbf82
SHA256

fd2219032e54815cff05ebcd6ca4516b9571005a8dc8f5a701c3498b48f2b706
SHA512

236e7cb61b6457705a796cd373e900619b8b7b93677e0e3ad85d6a6b87672fdec27dd362b55ae42161e739eb05baa6a830dd9401b34fd53544bec9755550b36a
SSDEEP

3072:S4+1B6lUKgQGyfkMY+BES09JXAnyrZalI+YQ:S43IAsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431109194"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A848BA1-6620-11EF-9816-E6BB832D1259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2736	2216	iexplore.exe	30
PID 2216 wrote to memory of 2736	2216	iexplore.exe	30
PID 2216 wrote to memory of 2736	2216	iexplore.exe	30
PID 2216 wrote to memory of 2736	2216	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbbc9b5da9e63deec7a914e4a9b56830

SHA1
dabfd32c418c223fd873dd858bedb92dd36185d0

SHA256
032a7dffe9df2c25892e3d9ae6cb7c4d6ee009e49c52b594f91d71629b6d3e13

SHA512
03898825be894fd735a656b59bb1748e717ab0ead354b7f3dfb2652baff432924fd6458cbed4d04ded3ee90995f76cef08bf1fab74361443ca6f3a8010f68ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09767eedc4792db496a665cbd23c5e7d

SHA1
8de489c0240cbe80e257d158d00550e12dcec07c

SHA256
5d8063057f5d4b0380bcc8dbf3b181d7d73df49214b196290d61bdeef2546784

SHA512
488fd079d4d229fb914d4e6335838792e499cd02aa9ad50764ef05d148bf686ba6e35fcc7a524645d3f4b8f0e5cb37bd200c4c19dc057c4d9026b4377501f69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc842c52b9300734c3c205f1f1a106a3

SHA1
1fd6c0cfe4943dab526488007c302e5146ea3d2b

SHA256
360d5e802c6956ee70d73c196f6465a81d481885191b0650a03469016c235f30

SHA512
d0a9b96d9d3aba50ce744ca3993267a8fe7789bb6cfdeeb713b2766fa22785e1cbc7b5e195a4f32de2fe42f0da62f282ce33bf4c11f2693c48aff4153c7b009d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be552bc4d19cf55a6b4fef98aaf3010a

SHA1
b9247dd83de6074f9302dd01daca4859037abc8e

SHA256
e5b17d3efe39fec23a3f07b6882645d6eafd823131b2b7eea02df3ca327213d6

SHA512
2be54d6fb8169e65faa1cb990c94afba6872523b1f42acacd8f1790d272006f2b4ef4777d6f1b99ac0d80357fb079863185459b3994f87eb081fcc7806aee71b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57a7ab9e582a21a4ca6333d8cef51b4d

SHA1
3756b74a0dfb237d5cb202defda4aae945dcc47b

SHA256
0192c311077fb3ca00173719a920820a55c86be11a6c1edea9c39037e2a73bc5

SHA512
7d142ea2b863f3b82393e397c4a87bcaec44ad6e20f95222f481847713bb1a40b1ae251257eb7ca088f643702545e0371dff008048c378d392fed1b721324ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a22561e5c8fa9ec0f4e2a0ecd785b346

SHA1
0eef5e4c1ff7066cfafd5e4a4fe2f142420bbe86

SHA256
4ef54e5a71567f59e97bcf8a350edb74d0471e64da31f439e4db9413f8c4449f

SHA512
20e02e31d23e66181f985e64ffb8ac1a6b8cc1d9b95814fdf436fcf397b080be96d14802171249aa0f003f8d34d72ef401f4f5e3b88ade26e2ff938261f98181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fde8b5ae0ca01b4cedcaa494bae4fdcc

SHA1
d3137759e1d6b9010a189650a1d49cb4d3324a57

SHA256
42a62f0b4e13a0742c47151b8b5e09abbf9046f9ead16767e821b295ee5c0af3

SHA512
c2927ec0e7e9c0d58447c02f9c69537003484dfd3bdee2e9e21d69b1dc16c973429ead3dd3d450a70f72b8a7a0a8fad9f8820d60ca180242d74f6ff5ebe0fdd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80d6a02a035580dff85d3a4ee74e0ebd

SHA1
4dede6e777ca56e2c5686379814067ee555feb1b

SHA256
4c9f5595f6cb89c3a0d3a518669277ea607612468365ba30ca2edeede180990a

SHA512
70a1e350523b3ab229b825ff52c7c3e9564f7b499b0a249603ea17f7d66bff9a419df2def369b4ea4977f789cb0a15a615cb4b8152c552d875a94918b90e6d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b8d7a49f2a26297af0c9fd95188b4cb

SHA1
163ddc9fbed2eca3343acb1f42b1ac0fcf0c98d3

SHA256
f636709b9f7b83b9c12d71adc887f09cf5aefa7183d4972a96b0d6824d423766

SHA512
26a7c6744d1c0b9776a93af15c1c7563accebc5631c70940fc51b1e202e8cf2111b249f0b8f5740ddfaa06ceabb89f19be4397bd40f3c318abdcb07640d60279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
499f60392de70559a3b6fcde764f323a

SHA1
fa028dde42d7d130267ca4c9d9e9c77212fe7e2d

SHA256
71674b208f47e418081eb298f879dc14567d69f909e07ba3526adaf18c56ada1

SHA512
2d289c35c732058c3e40c2ca872267313d645a6e544f96641260a19d3bee12286a0aa38a6939eebd85cbae511a29842b53945b8145c0d2520238cb875df0bb30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14715e44cc6388d8d0aae724fb6e71bb

SHA1
8c1459227b20c0c50002122ca083c74d80a70089

SHA256
23caf582e128882ec3b105e39504b0476d16b1bdb9e2fa8238f6b376bf0a02e1

SHA512
dd3ac00f0ff3e9da6cc3257b71a03433c59817d68f17abe5d027bd67439f10d25f54097bf8fb1f2ee65d1c64ad2670b96c870827616cf5f42a022f35b17d5bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b2ee93e8da7be1db3607c2197d882cf

SHA1
ca3b660e69b9cc185efe73444140291b6300ab79

SHA256
7d3605a8085ef039626c1e1d25b312b39c4461a4f392634c2a3b8e7c539cd47a

SHA512
c99fbe290680666d9244c44f7501ed22b767708439173cce5e2569b2aab334eb4deb3207d4018ad3a76ebefbff28ebc7b28dc6da305a68c51639fadaf44491a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001986313ac62f86486718feeb32fa35

SHA1
51436be74956aa4706b4ddc6e4d98f4ef4036169

SHA256
286d96f968e3b8bd12f7543cb15a734ccde54b83d0b52535cd00f4a7d16043f1

SHA512
0294ebcd5ce140cab1647fd59a28dfbde64aa3fab61d89b8121eb6dbd2a079de97b49380aff70d3f0ff09def7d214848814b318ddc88d5f4d0bd49b70733dfca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a506e0211d7d285880f76e2c39bf1b7b

SHA1
df6dec898c3020efb38a0c6c0df855165ff61a11

SHA256
79745bd097a81a43e529ac66dd45826a06d197c85786b27db19fa9a4a6fe352c

SHA512
a35fce6cedd90797ee415a93615a8b27758f87b4c96117b79b8afb48bd32235d053a4d39567d05e4a3d438367b7931e0d116499719ce0eeb981a110fcc3380b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b33e96271b2213b5299eadec3628c523

SHA1
b6040ad7bc3a8095df030ed559d8dec1a24c5240

SHA256
d37189de6705af1f2d34b6faaa7b12ef72d977b5fab298ffa24b3a5f9400d3ce

SHA512
c05cc3cb2135f235ddc5d82a07d3aeb47e8d27f62e3497c872f0050c528c2fbdbd6a8e28ff5471e6a1a39a2751d373857845903657891b1c41de991a4ac3233a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ed73524104cb061b82926423460201

SHA1
e3e9f1c8e40ead12da1abd4a307fc3a5317ab398

SHA256
4426c259e9b31725a5fe2de1ef33063722a2cf3aed5fcb387f63bef7290a8072

SHA512
6bd03462e75941e395e9cdfd8b0452c6b2f535664d70bce419ffc6c97575c0c8be108757b838da1b2be8c834a5e1dc8385e0bbb4800090380f5e2b53d2d6bbf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1de207da607d5a61aa854b141707b8a0

SHA1
8c4d9ff28092ee0660ae129abd00aacefe3037c3

SHA256
bcfb8a502cc97f59922d8bf94d132adb137cf65c805546076c66cc40b1aa1fe4

SHA512
d1878f7648e3017484819425504a30b8a5f0635528bd52980b9de019bf2287170ac881146dc532d64a7d8dea3518eb2613e124d214bec621e15fde5b559f7161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8efc86b820baf8b968957f5eaa3ee078

SHA1
6a87d4414da3b1a783c907c59693eb953877fb48

SHA256
bb48ac470d487d9a9a76cae33bca4cc80e556587839575592cf6df72ed941d59

SHA512
0d5e6d1fa410d264ce2290e9392ac30143855ca7050f704c713db6e493000d6b3d1865eaeb697c79245825bec6eb320749a4619c2589ddf08fa265ae421d0e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9e2907448d9f5e9e2aeaee928eca0b9

SHA1
5410595e33119639a1a1725e5b721e38d451ab8b

SHA256
c790195b1846553d335cf608c8a92f95c8ca36c2ce0ec79da027a3342d03e992

SHA512
bd98c8eed147331665f451015d47d3906b344b33f4ca6cf94987b788042a94cbb43c9ec3d700ef7b93b2b4479b18fdd860f376c0e6d0da8caa71a83fbcfd85ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f09225997abe70661f74c0bf8089b6b

SHA1
faef15e850dd67790209aed5cd12b99f26ed4760

SHA256
9edc9e8e168aad99746bfe8115c64362ebcbc95ea49cc6aa884628528c2649b5

SHA512
be3bacd56a3b774bf6ca25396361511243c741bf72ee92637fbc25ed3c02895aedc5176920cad3111290c92cc82eb1b87cd1ff76144ade46be74aa84224facbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA535.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit