Analysis
-
max time kernel
70s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
b4e8ba79-125d-4730-1675-08dcb6872dbe.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b4e8ba79-125d-4730-1675-08dcb6872dbe.html
Resource
win10v2004-20240802-en
General
-
Target
b4e8ba79-125d-4730-1675-08dcb6872dbe.html
-
Size
86KB
-
MD5
9ab660279bc7b8bb74c396b97fd0fa66
-
SHA1
3788d6971253907e73249b94b4c13894dfae4c87
-
SHA256
deb0476ee688950b1cf29f8d076c9200615abf90cfa10b5e2654bcba8c3cf933
-
SHA512
cfbbefa94d5bb76e779439cfd3baf6694e99694d2b318948d68608b0800005eb2c60c9fc783e0b6d4127fbbc08ac0030a39b6ebe1ab21113d4e3b530599aac8c
-
SSDEEP
1536:H0ejckb/MbMPpFCm2wySzCX0W5zbnkGTrWRDDLQEYAAnfwEUiCiSxazhi:Huy/uMffCX0W5zbk8rUD/b0C34hi
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2049931-69EE-11EF-8E5A-6EB28AAB65BF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000844fae394a7b6b3d61db34d2762d36e69f1f7770100eec7f055bbc58f21935fa000000000e80000000020000200000002a18a8956ec0542c3f05f5c5b1d012bbbe6823dbdcdc8394b291d21c41bac54d2000000012e539fa8c2614769387fa7a9f5678cee585099d5787051aa8a460f5f5db6ab440000000fa3d103b53015146d4952c6b225d5a38b1bd06233213c108516236695a0e2efa82a9909efd82416d8fd5e5fd7412fae03b8db9fc2aba194904c09d60b6e96611 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431527783" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000095be73dfc537bdd1c8233a0a5680c07e7dc59ce6ba0c098a695993e6ff6258cf000000000e8000000002000020000000bd14943481fefc0d5f9d11e682ba16be2d21b407613a2f7f9419833321b0840490000000566398554f5f6c43ab9ca60ca22f8aeea745e060393b8d58dad4ea20bb5811f854bc703f838e132f1e537d814ba7c1f8036f8b842bc18f483710717f3d6c22749fa8ec5ba42c9e0ae6941fb059e25413e7ec99da9c549e43337939a1d978763a1b5353870a2135e4bd8419b4411f37d5bcd942f86eeff04c321d651eb492eff8a10e61c2cc7026c7fac3cb90e785746f400000003e3bfa3918a28c6847453bcc9796f224275b0d21d66026af38d8298a642954b6d057094164301699a55d0d8cdd61103d8911437f012b9d91c0b93ba28f778413 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a68576fbfdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1048 iexplore.exe 1048 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2272 1048 iexplore.exe 29 PID 1048 wrote to memory of 2272 1048 iexplore.exe 29 PID 1048 wrote to memory of 2272 1048 iexplore.exe 29 PID 1048 wrote to memory of 2272 1048 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4e8ba79-125d-4730-1675-08dcb6872dbe.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e077d852a80a98585de014a95ac23048
SHA159fe95b8ddf3629c33875a7276b9a23213200dd7
SHA256e9d4d7628d9d2c9f5cbb5da38f1219d694ed72c0e61fd59906c7945a83c4bb87
SHA512c33fad4714ccec36955012e754d5c304a816076967ff9283485853687b69f0b411d0aa84c74e53a393992277f16794bb31413a25238b505a7f6e5340044c77a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58839eb3c4bd92c33082f2b6e43bf65e5
SHA1a86d7fcee13dbfe2639da138d2254db6dcffad85
SHA256f903476843f1680d00d2cf1f36148cc4dcf7e6f40c507046e9584ce5f910f6cd
SHA51216bcc1d3cd1b0638d35dfee0652345fefb86a9d31daa64c52d40190dff4163435e0520f8a3bab795a3d4b82bf955f66226ef272af33950df3cd6f4eeb4d4b197
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5603972c73caba477b198ab5e3fc92c92
SHA1f1a348daaf42d9fe4eacf1c061dab34f1acd0b61
SHA256b3f1febce399b3504b7f37bf384fa8f288fddec4ee4000d281c6d6d4b64d2d3c
SHA512ffb12da8a9a9b2fde13c57019a8f5150b93e18ec247ef74d5ca46e05c9b2df4ad16a0ecf11071727dfd6d475d6525f6d556afeb43c6aaf6d65d9a5481882895a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a9ecf5e9bf3eac82f480d4a05a79cdf
SHA176ecf245e2fc047ce46cc0c8f698db8c323613e4
SHA256d785bfa363ffec742bc836ffe302b6a87c9d14c3131163517864e2aab094fdf3
SHA5121178f1194cb36eb278fff91e7e797a226738993357011afe1302b298f995889288de54705514cebbb353d484f9e067b024ee7a3e12e2ea55cd6734d442f3464e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a18d53dd93a9ac9d842f5e85c1e97525
SHA157e06038d81742c107a38f2dc51702048a210b57
SHA2566ad481984d492bad804a0f224a59724da7ecef343edff8f3338f8773101ee2b8
SHA5124db6362289abff51069334c813241f095a2671de3040b299475b528b288166f910cbe246fb11cb884dd9748d771fbfecf29add4b682cb280ae1be33d962b3132
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD589f7277448130442c16a6d883d0b3c9c
SHA1def3a3ee1b79c6142a3cbcf0e6ed82632dc189a4
SHA2568eaf761a401ceff9cfa5b600f018e1543f5eb6cd45b922af94fc4f02f66100a1
SHA512df78bb1c0c13a3752e26089a71ea0fd67bba7e69c818712154acb2dc2a12804a89782d496eee67ed9ac9fcefe164070079bbda755995f43b2ce7f894cf93d882
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53246b970ae132c88cd4e2cd48d532d17
SHA1e86e68bfcdf148deaf725fe34801de5174ab415d
SHA256c28a3ba594d10fb442e3649f23193e2a1d32b56ecbdbe533c6b1d9de8f7c658d
SHA512c045eb186752bf03d4b47312799ed7e739bce9c499dc085809991d5480dc6320906ab702e7393753d4c7d30859e5283fdc7698012fd8e8e5b5aba78a7f6ff551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52e6d9385ddaecd7e0956ae6c7e0b7030
SHA1adb996cae80f00f53bd9170eb4a4211f9c4501dd
SHA256ecefdbcfd0c765301c166587851acc95016899d5a604f5acfb615f10a7d711f0
SHA512441f7a809b8538fb85712009a3dd086682f9e440ccdf74805a9306da3868429caae39f13b42e60f2d25f5f8c43e308c5cfb5149b18b670e4411780c4026c2282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57758138641d7681c1c5276c2ef5a6d84
SHA18f3e16820e85dfb9640160e5c29d53585e922271
SHA256d5e88edfbeee9bc219c7f729439fa76d207ba1fed2ddfcc8f6bad558f566dc40
SHA512cf65e97114c5e55f0fc8c39c74274a34e2acd5cef4c86ba2f03b86fda8930b8b6c080abee3cc8d2e2f292325b352c824f6d738c382d2877b1bf96bc6b6b6a073
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524442df725a8485380a8cc05a95b1e3c
SHA11e2245f2d85f0942de2f90b3cf7dc11c0984b9b3
SHA2564a3feeba8fa524e11af8e20846abacb49890b0a559471c6d58cc9657ff5ab0bf
SHA5123a7cd96e527a7b68478ac98f3578fca1388493838719f64a06ea647329666588ccbc309cd51ca1f0859895dd8a47affa49d08a1aa9696b5d6fd31411146eb348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59a3f1157755a62f19867bd9ea13f3fc2
SHA149fb51617df5fa535ffe71d0ef44a3bf38623434
SHA2561d3ded89ee154c4ca8d994faea4b2896b2b706e89eb373e07fdc429f2130172c
SHA512ac8fef99ebb86c64f852647bbf90b6fb6320b3d18f6fa4e43675937309e18bc0e7fe3ce144b1f8f410567c0e4c1806d9d8b353872910d085967c6539902c2806
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55bf253c87321619b6b21166d17db98f8
SHA13e5eb55fa17c6eae658fbbd47679414b92d372c5
SHA256abe9f190d2235d8b5f15c918b1101183d989c032db1ac8ef6c56aa4df4aa6139
SHA51284a32bf7568c633cab26b1fa67f7421689077fc54561e1c94b5539d175a00a979da2d30fec24a64f09a5048e7bfdb1db7a8498943d9a63bff992288688ff53da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0f65c0a06ca65cecd531738b7996c68
SHA19be195b217df191c6353b9f0d895b92fa271325c
SHA256dfcd0553feed607bba27138651c77eef9478fe947bbc108927e68d3ad52df178
SHA51224e0fdbd27a1118a153c3f87955c722cb12723b157deaa1b9d28f67d7e9124e23ccef72bfcad2fb88521e8228e7b11993b0d84394e8157cafdcd38f833f0f3ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cef7bcf1320d3a52921a042f6d4708d
SHA16e8d250cd573f97a34581ed0a4283ead0aa0b805
SHA2566b1726b9c119fc0bf80b7639e41df09c8e662cc1a044cad39e5eb7d6525b8b9d
SHA512e358e89d7e49ba4f59350ad05d23d8837ac9ab652cecbd528b46c5734997292d2cf82fc5a9a60030cf98dd7c657810ab8b32577d371430febf9f6ce9b21ae263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fd6f75f9e5876a5a44ed7ae4db0db6e
SHA193cb9dc6ed4ed736e06192e55ac36cc8806922c3
SHA2565b94f671f20753da43304621ad7d12a952bba0f75bbba3dcdd76470af3941e1f
SHA5125854b283c838ffb46125c9b8ce53dcf296ee8a10512183fab7d7dc3f8cafab8880c139fcd9d7840a4ddc4657414cef14b93a2056bd40064bfa58e30485144265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a0018b6e8cbaf12290d08ec02aa40db1
SHA104e555fe2027d14185d3fbb945a5bcc370e0bc22
SHA256bd14f151304494d13b8ebaf615698a650a2f4ae44561926749836a2a0d5dc75e
SHA512f64b9010d6f05e10a48f8ad3b6b2004eb5aca844fd4a16371ca4f3c6787b18f887934711462e549e2a823bee5b431bba7365b106020b3d1640615c8aaadfbb63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58ed0c5ea739b20ed62a89d17c5b1a0fc
SHA1adf521065b3ceb7a05d3d3e854c426dcac5916ae
SHA256bcf07591eb769baa383f2ac12b7210e1d09e7aebd260d1204bfcaa536184a878
SHA512cf2df1aff85c4716aa0e325ff962474ec3a1c968d8ca7843c1ae09f396dedb716ef684fcc375b3639f4c1523d2f0d0490ad4366985b6092abdf2786e8af448e9
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b