Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
4d14f9066fe1e9797b8fee0a197305e0805a6a054ded1edf3eefd5682ceba9dc.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4d14f9066fe1e9797b8fee0a197305e0805a6a054ded1edf3eefd5682ceba9dc.html
Resource
win10v2004-20240802-en
General
-
Target
4d14f9066fe1e9797b8fee0a197305e0805a6a054ded1edf3eefd5682ceba9dc.html
-
Size
1KB
-
MD5
e576db72bec0737bfd4aba9f07271527
-
SHA1
d38d3dea9360a4d0ad70a9ddaab828b12c86feae
-
SHA256
4d14f9066fe1e9797b8fee0a197305e0805a6a054ded1edf3eefd5682ceba9dc
-
SHA512
785c7543b6180d5e7baa33f0799c5616aa02d40a93d798a4f3fb3117925196f1eb5239697abd7ecf5efa0b49648eb0634240eac9a862a6cb99a182278912a8fc
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001f4299fef3cd0c668dd87af0996f3c93d7c0448c4e25b0574a6377b8c0739653000000000e800000000200002000000014a27cb044c1cb860c2d1b457fca29faee7ba4d8248d6ab221ecf22d4f1e73a62000000088f9dc619c5bcd1fccd937aecbd7ab8d599350aa09ab108708556a26c1be0a7640000000f2766306b29060d6d9589e1352bfca8cc70c36bf46e2381422eb9d0b8e900b0836a2f23bbc2852a2b713e08a03ae78be57d3ec88b1da65ba4e0478e23e93da0f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07058b6ddfdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E10526E1-69D0-11EF-92B3-F2BBDB1F0DCB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431515001" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000a653915ff3a05340ede632b1fc565024e04cbf11cdbc56dd8a541a187839519d000000000e8000000002000020000000291ea5fce87442699b78336f5c5d829ee9d6361130bd1dbe0d227a0d0b4d04309000000021eeeceaaab70d27bdffc9b028fbb35a4086a45fd24db9c65276ff65a6280e2f3d7fc0b8f640504458d7510b8f10cb792a939a57b506f431b9b3d71df69c13d9e331bf56473a15ec701ae2d7a6c894695748fe7dfc262ec46c7bc7a55ae350f2402fa56f8833a3cd5f874406093197dbabda2e7c2bf6d5ac0aa72fb738d695fe84cb359eec9ead73686fd31e11b2f8d440000000ead08c978d16c42c93fab6ef230ff93a1baf782fdc24adae7bd232f16282868ee7b07e528bf9f8e2992ebb2541ed587bc800acb3690207668a9c8f3cde941fab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1348 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1348 iexplore.exe 1348 iexplore.exe 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE 3020 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1348 wrote to memory of 3020 1348 iexplore.exe 30 PID 1348 wrote to memory of 3020 1348 iexplore.exe 30 PID 1348 wrote to memory of 3020 1348 iexplore.exe 30 PID 1348 wrote to memory of 3020 1348 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4d14f9066fe1e9797b8fee0a197305e0805a6a054ded1edf3eefd5682ceba9dc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1a3f344dd0618bde01850408fbe89b2
SHA14138ea4cd06fa3828b998a3b3e5589e6bdb4273e
SHA256254c49e426ab12cf1c214d63aa5ecf53b91d36ae7211aa981d2c9086ffb2b949
SHA512a311c34129d490c960d26f7f41e6e1028879054ecbd92b318305acdb301ca5eeedb3cfea1cad6f4d4f6b53aed21cb19b63a4ccea21e077600afff97c89a72b58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b09d6ca6f956c2dd111c09a37dd3be3b
SHA12d93c2af8751001f913496d1d206b5cd9987c140
SHA2565a7bb72f405347ca7a62c9857fa6d44914aa23968d1e17d2d731f59ac8eba2e3
SHA5120855e25c8e25422e070b82f5372676a716d438917d663645318ceefce6b27f5f2952267d1c53e4aa499476f560d5395052ac87ebfc8c5b1c6e5111a2a0409bc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d446efa70b7b19ef6e195b674cfad000
SHA199cf3d679584f95d859694b3057de37c1864e106
SHA256e17208a392083407350521ada9764b49fda2caaf01d257439d1045b8ce4af7e1
SHA512433140643b83fa14c8ef5ed4c555aa218c3b90702f7431f2a3b02b098db52d03909d587b42fc2386d07e1ac432f6ae7f64762e5c520e0e36e46e5341889d8268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cfdadb8d1b5b6c25cfa4c39c9d7d6ac8
SHA1c0e9fae053db80a745f6486ea5e3dbf77a5c3a3d
SHA256c1f20564f5d9598c3f9417675165943cc3d909b02a3aa0b9c0a51c5005ffc777
SHA512260892502b867767373c794db38b43fcc039a50b068fab3e8dbecb85c75798743cc22adc3bc9c6f9cd517681e828fdd792de9770712ca1c771c6563157018e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50e019ec01dab5c74647ea885d0ab8ca2
SHA10797e29bf96e85ffe7be4819d690652cb8a420e5
SHA2560ae8d75214a334a0d489face8c1c3fccb7e6319c4edfbd57ec08a8864e435ef6
SHA51230b4d7c658c9d46c8b6877495b7b1cbb909b4a986885b74d65e634c2abfbcecec1a26c71ea09549f9c751a18d626629f418b3a8cfe4ccb996b04ebd81a32f318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD510eb06b25bf2e25ad57d5d9c6969e9d9
SHA15bc502adf17239b7ca2ce80469ca48202f424bba
SHA256c971f38854c0a9cac5da81e70c2ed606663c9d0bc96924a2b2f09a568f5b09bd
SHA512a39ec9ca97d0892e8f7c932cb7a296ed717f170a7f66feeee17fd9816ea4d3b68c8eb174fc5efe205b3e61e5d63f387bd522f1b249c04035e91e3c17222e21e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD596c4704936ecf898cf62ce7f06baa011
SHA1558ad096545d52d1449013c164642a4da5528b99
SHA256db953575a719a7b30ef4181c15fa541ce2fe0237a7f4fbb04d6d8205608dce72
SHA5122437c8ffae572d91d7b72a327effe68d78ccb3516e05b375da0dd948478e891168e54f3307c76c72b79eebf2c95d5258c6e20d27aa4d3d8bd2171e15e9f003d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbfc7821c65e389e4d279f7dc6a8bbdc
SHA19865ecf91caebe6fa95a7ef465da90f997abeebf
SHA2567abd182706679b75ac29f63f5d2982e279457615c35e6d2604012274e202193e
SHA512d73df173478b3dd463acf7ae34174aca2a52b1fc2d5eaa54c057c4f50bef0ce33e3ad66d55452dc3642c908afa03014241f0298103dec7d22fef0d24895b8f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57859a5ffe34fcf48bd6c34f508b0bf3b
SHA12ab1595d9f7d52a6d7cffa0016133cd8dac3d4e3
SHA256436b73fc63ecf670e620dec4d6be9fade3f2bd67f50a100f3b245cfe6bf18495
SHA512f21df68977e3acf769abee910cc2142b97548f8faa3e8911a8de956909d22d1d7513d113e322b8bbc26de28d5ac5ca51445be269c44824bdd425afa1140744de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5facb3b0122817dcb9903234bdd900694
SHA1e4a94fa6784d34b9c0f6ea61a5dacc28437005a9
SHA2567a8a99a45dbe61fa4f9a8d9ed54326fd42cc4d09114e4a739d3ef2ac0a2f9da2
SHA5128360727b95107b3cd1672d527e2c2d69af1018603de799266b0c3b4d07023c980bd73297cab0302ad30836b174f1e703739dd5787a0bc4f6dcd36a3fdbb6a8a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5197cac85d2490b56ce60648cc27f59ff
SHA10edf492aee2f14c558850b5a0c31f7679a041f24
SHA256e95500abe46b2766296ab325eeee139b172a51de12c3f67df50400c206dc2ccd
SHA51253a0e5c7c1c1e70f2f0003005a7d4f0eb9c1eacd80376d46048f05baf76b67b1d08f2dac81f65941b30fb13b462dc03da1d4225b40b04444821e98004ab3e146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c798f24947ae60b3ad0c36bda7fef468
SHA1ee2251d1b5870ea64d31075d11f884860eca2df4
SHA256bde583f28764184baf1c3e7aa5be641d589fb7d5f37014101fc4c302c60a12c0
SHA5125e887529b3a0432c1e05f16ddc1a50d449b71e56fc2f16e94ff037dd110b9ba7c2f7f2f64125d50e1e55f649a22c22da17b9bf4afb0715ee89141ba3096a3c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a8a6edd22253ca93cb8914a52c419439
SHA125e7a7230cb98f0302582775c76267d865c73195
SHA2562815fba02c24aa331490ea9bc0316f580734bcead0b26b13425e93ffb808bfc4
SHA5122506effe13564ad597aadc95e606b9d73538aeefa5c147516c835f16410ff19418ea766a954a72eb75bd38c5eb433b9674fe2fd80d11b06d4890e033dc3b186a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcbd7bfc24054ec4c9b16ea604ce548a
SHA1ed15d997bf43bd655ac63fe8485ecb3df9569d6b
SHA25672b3cf03097783b56f5782f032f5b6d8801580254dad98c7a23e72fd78818643
SHA512e69c21fbe1505f0e69e6e0399ad97b438dfe87ff22ae1a3a42ca8ffc7af13fade7f2ae39d1aa7aed89c223772e28d172371889d6bac56870db1445381ba3129a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed842f421f5ac46d059dbb9527965676
SHA1d379b43e7c4c395f498c49ec3d70b0e3cb1f1ea5
SHA256d3c2dd5c7f9fdcdd3304c3ad66adadcc4c5db75f58f307e49ef808bb65437dbf
SHA512e6c6a4007f1342c472f519597e3787310b4ac33c0b6b33dad248c2ad87e4662530af9e250e36ff053fd30e71dafddc07fcfe534d894d19f1e129be314f02b668
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d95f1fbe3aeeccd429f12c7ceea99d82
SHA1f6a6c63058b21bbea9e2271485c36aebfa68034f
SHA2564b0f55d34c3921bbe8d9d0fc5bdf8514fdfabfbfcf5f906d1450b2909496789f
SHA512893781908efc42a1d62f1635896888ec786b1a496380e51e70e71294c9a5e52707c230ed3ec5391724aced2807035df58654d18524986f53028dd811d3e35ffd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ac0e97d890512ed5c02affa907eee493
SHA17c92e6562220c0f1a95cc3a982da4cecea59125e
SHA2567f77265199bdfe237e1291a397c1cfc921c5729612fe1d65e60ac940dc9a7081
SHA5126fc3ebd2adadf08e79a23c4d82d6d7658f2146c9c365250bd758cf410ebaac6a7d842a1f836888a0360acc1ff0ceb8e83faa7d24ae964fc214a1346aee11a790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58586662fab1171723cb15e30cfdf0aa4
SHA17b0c7f8ead58140bb42eaa354408f357e4c9acab
SHA256e1763cc967706cc6a677795ea2846239c701876d716d80cac30689e359ff219b
SHA5129280c927eee15266fc23432f3c2529e01a045df469f2a62507d9c86a6c5e23e13ed7a1582286414967b083fae30c4aa9deaf6673f6614234666f69ec47eed6cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572bf318b1a18eea956f72f15ab038dd0
SHA1b7a593a200061dd5081a2c73701bd85db3eb6451
SHA2564433123b59f9184ce62d2de6cbbb55b077739d0c7af9ed7158fa0a54e21cc58f
SHA5121962c159e8f8dc4cca6caa981b286f1441d44939c67822a75bea4ba97265eb64210eda35094c687043b377e74ea6569e94bcd9c83ef5a172b78905055a1b10be
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b