0736ea5186c01060980ae7f5fd0c1a2a09a83ac4da9f55538b1a8af376c85fe3

Analysis

max time kernel
118s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tinymce_3_2_4_1_htmlbird/examples/templates/snippet1.htm
Size

42B
MD5

87042b028e888bb7318fac5d8b4f2731
SHA1

50703e41cf22c6bde9871bedfed336abf7422088
SHA256

e1721c7bc9459f7126e438d067eec4e702661e0158b3e65a9f04bf258b3e8ed4
SHA512

6f6d3103011426ca8b97a88d118a00d62ab053f000826246c457795dfd1c8c8543567112a44c424f3f2ff255709f2fe5d6395541370019e8781128d1dbdbbb41

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36061031-6CEE-11EF-B578-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a1d942158dc65e790702dfaee0925fb8c880135c02c4fa6c5c8d736b77c7e96c000000000e8000000002000020000000094ef7b2a424d3c5c846b106acd0831f95c62e06258815fd573386a373b4cddd20000000beb6e14a262c21e3dd3c2f550ef4817fceb618ed0e2bdb1e8b17ad7ca4138bbd40000000db7069d1e59353623521c1cb8befe16bfbcdbf44312423c10a6f4f024760e7854958d6bf68a39fde3c2988f766bf3a0aa0023b4ed959d74534367f129defa0ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000d5efe3976d4864bcc5ecf3332eae76f65d3ff1f44a079d5b980d359b151733e3000000000e8000000002000020000000dba4abcf26950b5f56ebd160893cbf54775a9a41d69988f379b5cfc997dbdae190000000e0759672883d9f5d6b2fe99557f88986f9eeca366cdb1ea59dec86e514ea330bd8791cd554ec254e0fbb471041733e8230ce496b113b9471d63dc9f20246231370ddce102f1625351c119085e27facb8956b64582cd6f8b7b52193d4b57a85e08f3276bb77b81c2809392de6ac4ed77b6cbbb569537c2446890a3b10ccbe3f1555b569d85865527eec3bc75db610301440000000178eed30531d0349d71957aebd55d9bad685a1a29b4b5569159fe5dd2288b4fb614bdde966994ff06c9538da8f89ca3938c786142b3c310df5664912e2f6b320	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e066800afb00db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431857453"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2376	2104	iexplore.exe	30
PID 2104 wrote to memory of 2376	2104	iexplore.exe	30
PID 2104 wrote to memory of 2376	2104	iexplore.exe	30
PID 2104 wrote to memory of 2376	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tinymce_3_2_4_1_htmlbird\examples\templates\snippet1.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0388aaeadd27653e60c92b49b6d2b570

SHA1
d4a69debf4b936e535fc31e4c86cd49ae54a9b6d

SHA256
5b9c0a8d7af687e525376f406976f74eac24a6a5633753147d43cf16f03ce318

SHA512
aef753958d9a004aca6f97b5d9ce573dc7ec8af5df092eaa6b4d0d23ac9bd95f0eb8f06d8acab8a4d1a8d760d1a0e55be3da3c0c8e36540e50629a957829ccda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9ceb9fda0d18395e4610f0236d8dba

SHA1
9e77c4658cbb278f59a050bcec3302d078358a2d

SHA256
a56b1b66d0a9a04780a8c0639f59456d8d0a2ef4436a11f81f70ae7fa5c4c06e

SHA512
f6c291ce0bd191e95117e97d85ebe9a46b9c2090da1a9694c55628a9b9d8453101f337bb592043c6a68697ea4c835cbbfdcfdc3886a93755aa774b8d53f999bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ddc46712fbb389b75ba241af26828a9

SHA1
3aa19bfe34fb8e1f32f3c670c6c77ca4119988fb

SHA256
4b0c1f92e393d7a35d93a85d733cfbeed6ac165c2f329f5377d058d5b1bd3f50

SHA512
d1efb81eb110fd80643856adff216d032103cfeecf469021acaec6303903faa3212601dc519b28fc58fd3a552721da929f2006a671e231ee59d14797184630a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
965fba777b43a34117d53b15f913c87a

SHA1
8662705341f65409edaa827ebac238d744b2d429

SHA256
b3f9d9c5bd8c1bbe10df27c4c8f67386345c510ee762c900eb37c78aeef3e6d1

SHA512
3f1aeb7129f314437bb566d88131a8c7f03bc01a343954c8cd1ab1c1d5da3bcb41e064ee108ccc08e6b6dc685d56d2119dd340c540bf1d27792d38632ec793a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eed852140bd7163fb15a09b27871556

SHA1
774f8c94d02397b735f04a3f401a9902c293eab4

SHA256
c98a125d6995aaef96d51aef09bc0ac6990ed6a7aa63b795ca40a1994a9ebbc4

SHA512
0100a101f1874929848222ef55a1259b4b0cb68381485819c4fafd16d6ec75e7b4fa0e2254a09aab82049882913ecd2ab8f67c9c5a9739b0fe41b58a13195c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df5b90831fc86017da8a022431ead8db

SHA1
6698e63770cefdc6cbec16293262c50b01f85e2d

SHA256
fe657aa25a7929e5f6b0ea35ca00c78adc547de87d33f5fac4ce22f60dae1885

SHA512
0a967da961a45dd781ec39c658dfb70557a729e4e12a70a52f3417b40a00183c842d233f84a6560b5a810d3bd4096597c17b06bd9cf8dcee21ceeaa217529521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
732ca77c3721516b7e5bf2ddbaefcfbf

SHA1
a206559d75afdef98cd4088260c6c1754f5c153b

SHA256
29dca4eb538afc7c0323ae5203987fcbce1eb0c966d037a4c10c9766b83a64ff

SHA512
660be86939cb05d04f250b2297ae2fee869ea90ec3a8ac4c22223d65d9c8ed4b09e45a57c2d3b60c845a046d0f282000a319ef2aca4c9524335af8c3f92172d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0cda1a00efc703567726ae677e6f993

SHA1
45198ffb45d683a645b8838de06b8024694009be

SHA256
167ebaa1c54d88f10ac19fb1c8b6e962eb024dcd7332ed74eb76366f428b45a2

SHA512
48b41194074e74a4b552bcc60576beec85315d66dbc1c1258a85dccfa50d60fa2b9e7e5a03faeace65784d92429d93b1f12f41416897bce22632317c56b9fa9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bfbd32996c3972a65b081565d7d58c2

SHA1
a88105c768275418bd22d73ddf573ea7cf96b3f3

SHA256
acd8220e489d113769042c268e4c16897155c7dd57927f2eb61e10cc011fa83e

SHA512
c7e481de258c6ee0955281e58156a7e75a5c807028f7413e0ddfb984d48db7e97c7ab2305bb0cdfbe3012c8dd2ebfbedceb73283447ea3f7206d87b7e52f9759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1d15735743f651c9e6179dee2d86849

SHA1
ed6674b2fcf75a0f67dc4daee79e54e3612a5c02

SHA256
b5590e747d611ca67ca9c9248fe10f2e9d78d4d25e3609c2db621c4b49a22a4a

SHA512
e85625da64377329d507b2bbc988bb3994f0b1e30374e2eb6e5bb487d423e4a702b11bc55b4e9608958094e862827c2829092bbd95b3f24e2c407503a0d82adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e29089fa41c4b682da2c2a78dca30e5

SHA1
8e0a85e148be8a6bc24457e275c1fc761e873d4f

SHA256
a0a0be60d3ea74844fdf4a8672e55900d93d659081ac1ceff5cd6497da038dee

SHA512
0a4cbfe6d81db214b501db9e804675c3bc1443817260a63268e429567138aeeb10f101e8c2deb694759b397079d16fbd193a65dbebf9495feaa2ff49c0a5d2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc46fa571d380ea167bac299665d7126

SHA1
2f369586a50db43def5652faa80221c00e5de33e

SHA256
24c0a2935f7a31721fe10ef3d7a84eb49d6a4bc05b50474bb94e030fb5266639

SHA512
539fd671a57220fc3ba864a4023ae0f6758c9a9ddd7c0332ffc7f00dd23bc46357dbb320020607e1f118cbf104f7440cab38e08cd52ca71e1cf0f3734c0d5ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70e0707dd9feb591335298099c0fba47

SHA1
f77eed3ebd8c24cd517e667a8c5c848dc84a286b

SHA256
8618dfb81608305c17339526f7096fc2aa36eb28173a66dcb9bbd3c684c4b69d

SHA512
56fa4f5ef5ea08cc2b3aca1f06cc80679fa60957ee3031fef5a97d0dc0e34be92887ec102cf6ac1e4bd923501d64c98f0bc803392c39dd324b477cda99196b9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
360cb0c32d427710e8e6d1bff4304bcd

SHA1
24030032a543d9dd8d78f7669fbfac395c29f7e9

SHA256
a4958f1558d7e2db89040d450473224a4d041146b7be165ac18a2572fe5aa087

SHA512
ca2b6560d45cabcb1ac003e4ddad5995d8475441e5df1d2d4e3d82be491658515e93508babc7d7ff677845945687772560bfd39ad47f542cf332bb841bb05d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6eaf5d2b8b82845e2ef285410f555fe9

SHA1
620130bf01969f8bfb8c9e7f9e4a9632f90f49c5

SHA256
494afd1a0be89edda8a2bd79a33f21ae8c84046d413c163f0d3b1814b8727089

SHA512
5aa834647e0f16beb08efb84ffe6632e04193850b1252789382ae27042ec9017b2546db48f6358f0cb480f327db3842925ddc4bc00a724ab063df5cceffe7c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72e64d548de5005612cda24161a2e161

SHA1
8df3665449195b3e82565ed77b38385e0d00d5c0

SHA256
9a79026786f6c162418be4674cd698aa910d42267183953f810916066f0b213c

SHA512
ab2803d4d6aa248d1c2ca424056a6ff35ec6d9e8f3344609060acf50f4840975ef86655480115a8171662ca555919313426388d0812044e01f2e817487e22238

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8CB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE98A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit