08f5dfdcac6ab1104dba0104d466fa33bbcac5fa6e90284c1158ac0d5b294d20

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

541b192835c1dca5f976c25774b1eb5a
SHA1

a12d124587005015c2bcd99ec829d7e6a5134f03
SHA256

ba916d3327dec384bbd16fc0b71a341bb39ba58583c699d5b8e22885c69e1006
SHA512

9de06744f392b5761b534041583cda627f7aebd542641d0d21829950a312e1a9cf2cfa69f3ea8254f9aa9ead27052b818aad0d4306f5f77cbc60198ab294ea37
SSDEEP

3072:S7+BiCr7rTImyfkMY+BES09JXAnyrZalI+YQ:S7IMjsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431757551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CCA4281-6C05-11EF-B2CD-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30
PID 2560 wrote to memory of 2428	2560	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fae4eb89b08f6db7bce9c37fbdec2f2

SHA1
d51befc58ebb50f4285e753583a5ddedde95b636

SHA256
3c062ade2601023d63a616573387121fc55b56e8d078d6557fe3cdba87ef4449

SHA512
8af2572016c85c6e7cc999e0e724de98d0d0c50edbd734e13d331c4cb8f5eebf98f7111a750245cfb65e6e0fe9aefafad51b3f9c322d0ff83bd2fcd78b70293b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd4f22e4a9406ef842f4e5dbbc233411

SHA1
2a035326fd8d4d196ca4a7e45e12e360f2d5d753

SHA256
06328411ecf9a78e26bf1acc3c79709ea40d72f96de8912ee6a00f6ce1cd777a

SHA512
840761bc1f4cde15f9d623d49546862607d9727bb26132e8cff2653b632ae2bb2028599056b4aa036d99ec852850ddf8f53984e46d8d7e354aac43e6da7fba58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b00d5abb3e34ff1aee9af625d7985b90

SHA1
fefc9258c687d574e0041c6566304305f8d59b61

SHA256
0b5e1e542c57693e3b4f4026046e19bf364bbb8bc329b49b4302df5e1e244756

SHA512
85eac5867bef7014bd284001b2bef88760678e79ee292158c129f9322f2159bd5f9e83eb7e89bc5c48fb8c35be5a12bbb3dd0508f980b9381f0e2a82c5c2c24e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44d7e41b7e94468fe243f9f06d7b35c8

SHA1
f99e7d6d31fd8223e7d24080f939b7f97a006a5c

SHA256
f55b090616a5e62e5c7fc85657fd872aa5fb6a8986618f40fd2f28e1232c1b62

SHA512
01192a5c1b33f4863a3fcac08e06c2e7387a3e22998145af640eeb83f4cf5c2bd82eb61cf13ab54ff28d47bef765f3ece1b8d2645dc0467fe7bb6f31c4014d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0797767537fd5a9e154d09ca4e8741bf

SHA1
01af0017a7aad3dec2b31343aaa2206808cf37e0

SHA256
f079867268b20b13f0cda1c9f23176804bbe430cee434a4b36e56a3bc0d5af53

SHA512
fdf5730036a5bdfdf5f686e789b519ea10930a6923b16da72778210c36d1335abeecfd3be49b9e393e5570089ad4f52ae6db9e69fa95d3eca903b564e67aca72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
987bb7e441e912405b9b734f2b4421bb

SHA1
880a42709a10c112efd55d0427e567c047c328e2

SHA256
79354e9803e0785f254ab3f974780f1a95a1806fec90aa511a3a7d9447d9a285

SHA512
924c15dd709c671f8075e0c30c8ede9504a5d4e3bf1b93e81a6915e9a49839fc4756b74371fe5569b28337470f4accee44c180f9e0318c5d34e51409e8c333e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
874b1c0736909f5568b46d3036c4c153

SHA1
27461534922fc0beaac985121c5b125f3331fbcf

SHA256
2ad354d7e0203cb2f91ae2eff1f0f0562c0c57edf533bc1fe5c347511460fa86

SHA512
7a9cffd34f82e50ad889b3f19720bbd74aef60a4d3ef7b6c6d5c0d7f3bebf4e612c86545f1725838dcecfdd12dd10624b6e48a1588e3c769a3a05097ff8f8cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb94e0450fa5d11f7bdf0942e02d8b3d

SHA1
f5e48b0c2afc02793c321bd07a3cfe1b7434f259

SHA256
fce1fa07d2221bf95588df3eb9e868e2545434048f188220b11a6a4c4915ff2d

SHA512
ad72cc867014dda7a9654e8d88e98397ac0b46fa61e13af649200af7bec2563e1195f7fe36098666301d1b7ae0681d492ab445f7096c6797498a6d52eccd60e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5be9afc490286eb0fcde2d65512963

SHA1
abefa3d1537dc0d1660acc76c57f5886f93d08aa

SHA256
4d5afb62cbca762f689aaa9ca14fc0865dc1b2e416ee975da2cef08cd1de6cb9

SHA512
9f757a9b49f267221b36acd1c169b5d6aaf341d20a931d7d02600415ae33c33ab9dfded195900887ad0525b03e6308649b2fdf34ce9efb7321669e16a9ee1e1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
613bb07fe3477ba238b99b1926ccae13

SHA1
68384b338f0f2a303f6dc3449d43c16d0f18b199

SHA256
4d6b5ddc1d445b452819b281590c7506c35fa09e0c5676101f78bed5d6c432c9

SHA512
5d29d1e1e6a0291f17814c73cfce484d685c2408677054a4e9dbefb906b960ccbd670118082a5cde2c92fb6667ca2d81743387eb8e077c1e77d787f91bcd45cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a236eb29c2bdbd87e98cb2924d455a85

SHA1
cc69eeba5fe08e40cbe501e244ca892074927ad5

SHA256
9ab8641e3ac22dae5aa01fcb84aa655bbcc6f7d70ffc4f42eadb81de9e1beace

SHA512
fc74d89c28ac450a84f6381b66a24fc7a9ca9527e87dc17362e0185ec59e85cd8b1984a8baf9df02ef892eab51230eee608c4c828c280efc06983812350ee260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85d93680923bb5045cf62b505df999bf

SHA1
d0b167dac0d6e3b8572e40269d4a5f090d648615

SHA256
8b4c134dbfb7093a55f8e45045f86d5790cef766c0d6102cb143e87af4b1c724

SHA512
5e6b3cd9e29bb854f672e52e29b48525ab519056cca4dd8257444337aa6df5392997f280e149a098619f1879393b7e988e039d2f0df21af0646db6053e4bda1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b84f78f331d22acde672d5f4d2478930

SHA1
87374bddb2ea7ade9de1f603f74415047a0416fd

SHA256
85da0dce978428cc6f8e16e9f342dd5bd9755425949bdbf742f6800194411139

SHA512
c89c92bdb41491a548824a69835e59261a4cadab9311f5b0b1073bb184cb1100f0a2a6f5c3d5f559ab2b70fbbe7dd63e6a70ec2f01b8678d67027f4a734cc0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d6c45161001d2be5ee62a31b0b32e89

SHA1
d153810c6fac0ddf3689a744d98e4a0b5941ed7b

SHA256
13e80147a28f3d74c29e9c68f66ac100c0b3b797a832e3ef059a4726603a5a29

SHA512
3fa3a4da2cb4f53bf72207f3788b5a3bdfb38ed1feb50379595ee3d382aa7b467c18d17975b82d68da47058528e6decdd17bdac47c061eaaf7415e043840537f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd266f62da69ba49a5aa7794977a0192

SHA1
6f341afec164bf9af50951f5ac243677707b48c2

SHA256
5f19f13b51adbca96d74469a260502bce9d29f544f69c36733ab7e57290c6058

SHA512
fae6a014c98e2753eaaa7877e25d5f414785ec8c80358f462ba7a7751c0015385cb6c617db4fe768d61264636a01f6e3e1b94e68b52e8a571e103c755a8c70a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38ec10fd20019d4033d361ea5a579dc

SHA1
f077a6f90114337e179b6d5a9bdc487a8121c502

SHA256
e033e8127a517b10f34e615d4a44f84d5cac2e91a97eb995e5a0303ada110ee2

SHA512
06685d3e6264f45dc3272b28384b100de0ce9df733acd40e4f4ce12d6cc82bc52e31b2594bb1c32bef1a031d9cbc589c64a6d68be1b841170519809f1ab70557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b01d8cc0510c24e490ff7b5a2eac93b2

SHA1
8a200aca1c6b138a49498c5c5c9c0ed3f4d469ba

SHA256
f60d1e707c8dd0cbde92f1def531a903e5afb03d3b5c9d46bcba497c55b6b0d5

SHA512
486ff27ed5c22cc12c36733c0c62da8f39125aad6699bb7b828d962d00a5644ecc6f85c9f431788acf3a9fb089751d40c87094dbe3b4160812fa9b5da623ac5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8969b955796161e4442ae3614bf33889

SHA1
b4eafaa046f68be2ac9c4b2bad3a4a01d84634e1

SHA256
1068fd8529d0eaab8e778658e19937941b0e0a6eb3e23a3d88c7f848580e90b4

SHA512
12f79c93d367a9d2eb2c971f4f6672bebe3e9fab2b1070e1dbbacbe9717b959aec64e5ae84a1ff044d4e113f89c0411ec4b62667cbd113e06ae1ce8d43de6562

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b562289fd9325690abde92f6a740318

SHA1
38131061896c273e461e301f53e03ddf0448d0a1

SHA256
6f1f4d6a72bd1f18f0fda1f7ebc3a044f1a49fe47a9d125520c926cc696110f3

SHA512
a9c234c7281980e27307ec788ee99558d4c4eb65166caa409e2faca77cc3d66054b02a223eb5aec0cb1e76a067153da5807fa69a8d816931261873acac8fd27b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA880.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA931.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit