831920c5fc965bbfd84b261f5040367749fd92bf21d6b31aac076a092e824599

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmpAE0F.html
Size

174KB
MD5

ea086680667764a8ba998d6c4a7ad5c1
SHA1

67fd22e15ffab9d84682b36f0f85b9efef407c5e
SHA256

f522c589004a0b453d10e7341332f308bd485a799d2be98aa7bd4e02644037b2
SHA512

7c072e4201acdc0211ca601de4cf94f6015a6e8db1e0de9805e7a4f80ea3f7db46210c5032b3d0381d894f003cbe0fb5f7ef7fab1d3273fe2019e7c562ef86e5
SSDEEP

3072:wpIL3lW+lmf0nypDv9MMl49cJcHgTrwiMFh/y0oLqbRzsx:wpS0+lmfMyZ2caHgT8iMa0oWsx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a68795edb680c567479cdf0df2445f547fc2e7c38bf3421ce91acedb60d7c7cd000000000e80000000020000200000004e995234ca36ab37e92c2b181ae9a4eff8942ade65179e02548e5eb8a0e5320e90000000780ddb911e2325c67e27be3d10f90245976ef168b64ec6aac0480aca63d3054b20f5b8effde04e38cb347fd5156a99e88e5e99dd1a5cb4d3177a42a497c034858479e6c1e3a75a005228c6d2ab34ff18dee1275a9def1f85c6a920b484d04c2ec9546217311f8b9a773d3df99067cb650eb9676bb2e277f0460a47aa0454b38432410610ad475491ca981a75f6a5b92e4000000089f06433684361a4a25024c4fb321814c1510769dd718024ca64f62f9b577e9098d111e62e9630525e75e2d7c45771c73156863d41cdd8b052ce0938c5035bd8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000009afeb223b1e9352433881996b315b0d6237a2881602f774f296f605bd88e6b3a000000000e800000000200002000000045e2afc4a62cc7d69995ce0973d2bc7d68898963463764c7771293bf4a38848c200000005cdbacd6295f58d0794ec69ba6b6b3612df60bb62f5a7060387876b8da0cd76640000000960315e66c4fe9e1b9e2a7e5737f758cf33313cb7afd4f3ffcce725ecdc2ad474d24ef21e20afed9df99aa59db6347f0a0fb8497954bd92aa5a91f49d33636c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431520659"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CF95611-69DE-11EF-87E3-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 905894e5eafdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2020	2348	iexplore.exe	30
PID 2348 wrote to memory of 2020	2348	iexplore.exe	30
PID 2348 wrote to memory of 2020	2348	iexplore.exe	30
PID 2348 wrote to memory of 2020	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tmpAE0F.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6e4585184b08ebd07b08814e91cf084

SHA1
18c9392bf712ab00cf438dfc79b4c27a903fdf56

SHA256
562ad0c87739211a50a5113da31bc1425696b315c04bc8ca1088b60a57a97916

SHA512
7a1430a7e81fe29c1c4d865f22a404f092ebc97dc83154ba0b27e4f4ff99e233c69cea74dd1c42d31440bf8bf4b625fcec8b4bb6a0bf7250bb55f8c2bf39f84d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
546317551354ad73aea5a143fde9b0d9

SHA1
6faffd671b0537d8f335deb019bf5bdd89a52e80

SHA256
76ce535556fcc9466cfae240a8ac21e94bfbc4f894aedfdb6c2c460233871b0b

SHA512
11eb958bc83a976f8b81514f167d2d52bf0ad0d34bd433cdb271a119d757e46ade028b2f51b4182f52ff3aacec06faf9e868942c7952a7c204ed2891ff892a97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2cd0b58e4fcae14c343335cf1359202

SHA1
c271b98a0f9ea8f14ecdf70f9a9e1c7ee786f4cc

SHA256
9bfebeb36025ef2f4cd5351ded49f2c197ead77f72cd62e66bb91b01abdaf4f4

SHA512
746e83c5d647e2dad8298baf23ac7a9e97c000f0123b83c849c8c1096ed7645873e9b03a8bca01b47129778a5218b400b46b32b83c187d4e81bc6f687bac12be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192d77b99e8e925702aa89b6893e1d40

SHA1
46c08db7813d4e78cb710a6128c84923e33010c1

SHA256
04764c3514ffaa545dc121bb9a3eaf4461d49f10c12f10b4c8c4ce143e34c0c6

SHA512
7be7035356d6c90f13259460b99d0c7172b2dedc192995b70eaa4e780ad3f8aae9c1a743375f9a76d743ed8f8b7b26fe19d1d18e10710ffdf5ddf12f9167c60a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d605f4f2ba2407538f1a77f1925a05b2

SHA1
3b88c5d0edf743de23c57133900b1921128de2fd

SHA256
275a07b754a85a000c1439dd469a0875acaca506bc2196019136f8925049ab6e

SHA512
30e1dfc2a4e6ae55f22afcae9357c6ed121df8dd0c8d8390a7eab3d18c73ef3a65fd02e70ad745f75e25d86b1bd6c4fe5476ec87097394a75a64742b2dde39cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0585565e4176a7a6f1493aa3c001adb

SHA1
d48be2b22c6fcd1e3f8d1cc27da690d3b4016138

SHA256
37a1f79a33d32b64897f182828732fbd6cdb91fec2af5f4acf4cab9d12cd0e70

SHA512
28d6ee52dec03ce6fb7cd6694e8c1fefe50dae7ba3056661b1394a18c960866b2a25fee616ac142e2d227c5f3ec4b71a2f5cf1d0ece8bfec088a3db47f1eca38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a793dae57561d865da24ebe83c70f051

SHA1
af84e95ac224d5cd0645ea6555dcdd2ba256db31

SHA256
4d15effc4671b98500b7f8c10ad4d84320e13187d821fd39cb785e63ace9287d

SHA512
bf025bcece03b5c92baecea2c21dc71a68d235fb1e04666264eb81ff9e98f5b250fa6f9531ed220eb4edd7c0fadd547532e5ba0cd86fb4922fbda32b1fa83cb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e2e6f212ed1e46ccc43a54185b7b6de

SHA1
2f775ad05f05c9d52d8355ecf544b4f983e41628

SHA256
033cea7857e28dd2251b92fd832d036534cd6a82eb743f2ead66a95a9bce683d

SHA512
4bb303df17b3baf8206c5db3e049f3a88a665a8c7584a71b5d149745fdd79586ebbfd890d1d996baa226b642f563644a3f351ee19e58647cdb961a356d9c4c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef40a455f494c98783956b9634ef9f04

SHA1
1f250b8c45fc82bb6a91a944aacf1b359f2640fc

SHA256
1ef500ee0c5d689b9cfc3043a915254fdeddcbb9e52bf71fe6178199fa62764e

SHA512
a2526853aeabbe59158989a16f1fa17ef2c05ba4e6b524e70122e08e5815a590f59df062a9a57f1b5b2ec922a7d2d9e773e4a31c429df4a7ee30b1ad6f6a0b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1ff8341f5c78412bd55b39e9b2287b5

SHA1
2159c2e368693f7366c0b7fb7b64683be6b646dc

SHA256
72cabf6df19901bac548597a63d4f8bc7fd73498b1dd67de17f6e3703ef6d389

SHA512
de354888dad5446ca420eede87bed1e5bad131257cb1e4169554f86c50b4fb2915cd326c1de2024e40b249bb13416485be422ede5b09a5704df6996dabaecb65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6aad8bd0278d049f828d5c84fe1e5d6

SHA1
e441620a9282a8625969bc88e24a04d1c7d8f1e0

SHA256
b5a5858b88bb1d571c04abddf997366a45b55f2aafba9d6dac0bab8062ef01ce

SHA512
acec4fee8ef817d33ec1a3cd54a99be9883216af907584e8b3420767108c90863d03eaac4f9282859ca6b7e941fd63e5a74f61064e8a4c4476ff774b2ebfcef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
648967d06f60e1fac5c5dd18775950b6

SHA1
8e0c6df2316a50a9dbd727fe13284a1f87637c53

SHA256
d564786d316efffd39b857fb8701190f80cb212f5540dc84db8b23878544af67

SHA512
cd6788c1d489be380f7894d5a97ee1ca00f4bb0f33394760196fc7bb5ee04643bcc26f9157544cafc8ae7be32e0f20d09e7bda6418f12e1c742581c04387040c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9c70cd83cfce5d656d6c36d745c1ac3

SHA1
cf7f9c0d365444547d748409390b2175874bdc24

SHA256
c9a64e10313b29428b1af292ce9dc3c3c998f9bbc0f12c7889ac01da98d46c68

SHA512
3ece5ecd1391f28b882d97b0ca874bac113bcc234220d5b21c815ab60cc46aa5a37eeb055bcf3e32471f4c8b1ffca1c883c383dd8689bae4d1300b2d9c6ea0b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
456c685e61e952e3dc41406529461636

SHA1
cbb16cba5f47e5c9ccd9001f4ec04e39dbc88ca2

SHA256
d895eb93dbc02e0903f9048cf0091c3712d50bcfdb06f73ee5fd6be3046a3072

SHA512
e10f254d1531f18a2ddf3928fed078359e1dc0cc860789032aa9f948f73b1254cb0cc4593f3ac26cf138531f7e24070351082433262a8411b4b56a04cc2d5b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0984117fbd8f98d3a0e4d5cf59cd9f87

SHA1
509245f7088fca1fa130f7fc53ce095d06528e60

SHA256
32b09ade6e55296577ff40718dfe2618eb5c867049607a3a5cc081406b2e7334

SHA512
2d4fb3727e8817d1843d16d24449ec87fe048e7fc9db082a01992579db9269f11c162deaffe8c8e0e5c4a3d804bf0b64f7196f33cc3aa07cded635ec3c9975c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE5F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF1D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit