a065ea8abe5435420eb5a30d80ccb35b6021ab4cba0e1d188bec76e5fe58f653

Analysis

max time kernel
84s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5069167943.html
Size

366B
MD5

531790ed8094dfeed45df6b941683b1b
SHA1

137e505104100227d3ee44c0260be9ff1ef91d4a
SHA256

a065ea8abe5435420eb5a30d80ccb35b6021ab4cba0e1d188bec76e5fe58f653
SHA512

d4ae4f110fd496d2a1bacce4f8f7dfb4d2bb26552ff45e6de959bc5f1f891a2a71cd5b5f5d51cb9c328087b7716ad3692785910a3c27c9709d22b2eea4aa6d4e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431551137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002ce171efc53754339517c171e2aba5c43e85c4d37bcd4f608d57001bc13f8f75000000000e800000000200002000000018dcde00e1876ee7c77e670feba998732217c84aac0bc7478b5d42f7cd5ad55820000000b1ee2a8a38a8a9ee2f6d1f8af27e6ce9be1982eb9f99f7608644e426aaea71514000000006df873fc56f26513d778d515e80dd81f6110b3b98e3eccb205a5cdc9bb6234e1d30ca06636c9a5891a701700e129e1ad16f138beb5fb3cdcb5863ce41a00cb3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10d2aac531feda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000066442ef975fd1fba723f1659ec0a0e9ab08609a2389b63e675512bcc582c5d67000000000e8000000002000020000000f6dd459e5438b1e9e48bb4f870301af5993c2905addf05ef8da18cd76fcbc30290000000b84e54906839c7659a5f2ebccde4e73c8d4e9db83efecf6a07cc5b96f89effd8c404accdc6b3e6017737b87c9ce718a2d879bbe53f45fd43c8ed079b01577c0ab537e9ed73ae016fd60295e7608c8cdd3e1c3c58820d5d91b15ce37f4db5b18fe51b1dab93683183f9ab6cbea65066ffada5379d84afc8b25e73d753bc253bed08b57105fa8a4328062a09ebdcf184c940000000ef7432e270dca5067fd95b07e917521bcf3caa60241a5c3a07521fceef6d03ad1dabde93cfdd9dc04c2761018e8bc2e386a96f271e7f5224b3f24accf0ae32df	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{018757E1-6A25-11EF-9DFD-D67B43388B6B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1308	iexplore.exe
1308	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2212	1308	iexplore.exe	29
PID 1308 wrote to memory of 2212	1308	iexplore.exe	29
PID 1308 wrote to memory of 2212	1308	iexplore.exe	29
PID 1308 wrote to memory of 2212	1308	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5069167943.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
719516f0ddd9bee34df8cb1f8298498f

SHA1
2864b7ce1ca8519a1687a54e5cecc42e8d428097

SHA256
fc67daadf912c14e10642341b7243b4177fb0e965ef4fba7f709e31e9ea9e99a

SHA512
23023db972ccfbef0207d31b480e09981196077eac223f407aed64f0f3852e65779ba225ef665985985930146ca35df63c33412aee6c19181521ff2addd0a1ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
878814581e2eba9d7e6cae3a0000881e

SHA1
9ed444df06d22c2a5a9af179da1bc30549fcbe98

SHA256
7c8aba1a2f99ca9208b7b46e408498bd746437e12270a21b96101ebe20870315

SHA512
69fcf324f4f7d98fa6c4c05af525856e2bfeda254d685c07ed9e9d9b9b0dc9fde8181ab2d0532d7fb9cc3b9d2f7ce52ef16d67ecd65a3084d784b402d7961550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca7ef9ea518de914d2d1c188ea0e76f7

SHA1
fd3a646bac9177ab4133ab68462e359d7c763e97

SHA256
8db5fc9fe2e3d73283061a47f4bd3f1abb47d9d8f9524246f9e96d1fd227c946

SHA512
01b28b282cab816f26d2f78376bf32b4cc689ea44ba39ad7da398a1b541bddf8f705525a008e044abd35cb2af5bf49c0fd8530afb8cdec14f8e1eafa410a2f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
419416c58a472c32b46bd2ac7cc42e0e

SHA1
dfb45a6a9afef37638e353d1b8a0646efc4567fe

SHA256
2f2369c0901a30c088e5aa3e86f1aefaf5c4aa15f1093ee625ebe5e67840a2f0

SHA512
3245d603da8bbd814be54846feb7ea0d0c5586ce21b439310160647443bc60e13aca3082273a62714aa697628bb6a6c82a8bd06fcc6a31b07fb85eb52d039311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea6419532c1bee346811314f177b4e78

SHA1
3bc7eb67183e4b870114ae7b97488a11505a5163

SHA256
18cfe55812908b4fe3a5b213bd8355e4b900a91f8e3f3de2fd9cd662a6e5afd5

SHA512
38ef1c5a07ba54612bfb9fe32b0991e34f5fcc712571b04810f12476f31a29c73a4e9f7e247677545cc3d2a83379b5e389c193cd3505b9beb8d71db0c5840a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c18f1f44e833d9443d4acf3dca60e34b

SHA1
0e25df2c21d8becc0cfd53eee13aa90c11d08d5a

SHA256
aca4e0f24578c55645c2345604b41e67552dbee92a2b4c9c8fe79cf2782d10e6

SHA512
0754ae0d75746baac9ee5b13027d0f04d9f466c450b0bf974d351ab6383cf927679f257e0620b6d212d8123c6fccf62a6605e1f437db2657a45eaccb8cbf4eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e21f65dcde3e37c63375b09f2cba17f

SHA1
16337b805244bd96005b1b8df2497665d68bb55d

SHA256
302bfa93e49a7126ee5c68276a121a3c82856a6e7752ad9591fbab45421b7894

SHA512
83597edb1973419fac6ebad6d5d6de70408e88823e3539c02975ca280ed71f860c4f0400f909331fa6d0f047aeb49f43b271c4cc9e14dd0010d6750fb6449baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e0e2ecaabefaf241aba83428ed177f0

SHA1
cccadcb9375193fa8730e2e0d7f8998578d38643

SHA256
e42dffaa21bdb0fb789dd4716d8b18576d13b96c16a0a33ed023451db6bdf192

SHA512
b9be10f367ff52ab3cdf7f4481b48d2a0db31c0b67c5438a68dd0041c9e8af9f1e914033ed35848f7958be6847dba11d8607374045f5a13e7d4f9f71eb4b38d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
433da4da7626a20f518a596d48a27382

SHA1
0d218a5b0f12cde9e52845521833976de76069c0

SHA256
e7cc0a993bb5dad60820877b6d0c5bf1960f997fdece278dacc350578230a6d8

SHA512
b6ef3dab26f462abaccae4778bf4df31154a2fb6c4a508d787b155c3afdb35c8e860fd19c60a6b75b755239c4d5ee62bd3364ea38d70e5725839918cfb3d94ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18bba6dbb77626e1f36b5def2d55c379

SHA1
385d9439d8018bcf312173e8ad353e8ea0a7fc8b

SHA256
8f93cf68430a2c4106d76d60d3e648662c56d6cc25bc3f335afa2153096463b8

SHA512
52f0522d50316e0e14cfe9cafddb410e8b2842d2186f68f27b0fcf4f46327cc2e985384b98c3cb002cb80de44a947f521515148b4dfe3e54f1c327c8ab7c2a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f216a3a7ba3828dfcd5c0ed23379acdb

SHA1
547f93ac6dfa0ff2594612b9b8c3fe33b946e28f

SHA256
9b1370407cb211121e79c758736d71846a3153de7b3fb75e4c10891a5490c657

SHA512
21ef240a453b12f7c4041413321825e2aef6327662210bed8e307cbfa3b3000642d01a2223cd73abb50b9a98b0e1e6d93eb5a88ce575ff89bf75a11835ee1bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit