b07858f36570986717d45de50c6d7570fcd7afb20a1399440c5784abf0e2db1e

Analysis

max time kernel
103s
max time network
70s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5268f15d93729b74bffe0eb81b0d6aa0N.html
Size

385B
MD5

5268f15d93729b74bffe0eb81b0d6aa0
SHA1

3cfd6bff2ead6d15396226c705a1d39a013ad2bd
SHA256

b07858f36570986717d45de50c6d7570fcd7afb20a1399440c5784abf0e2db1e
SHA512

b280122ec13527187de8709cb8aba5aae424abb981cb3e91f8df79a26aa54bf96e87fa1b1833b15f45853a5f7d3e00de62981be40380f96b82fb9243683d751c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b009d233d001db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F29A041-6DC3-11EF-8287-5EE01BAFE073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000002b6d1974048756d9c5e542df4dfd0ac62310b8cce28ed509b6bf3f1f4ac7f9ab000000000e800000000200002000000017f7f7f754262f6bff1bf8535c891349fb7498a65ee6fae2a876db78f544059d20000000db0c6fb4758c6e502a494d7324737b9ddb441e093f807cc90375feed022a8add400000008705c6a804a94de70805a4e18f64801b291ef2859825941584f16a2f63f304af85762b6e417bc8248fab6dc97eab5cf30452d7ad38b0a2d2f1a83884b754a445	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000026085b5c6998ea2f71085c21c7c8c5b5977c470a74ba95268ddbf37dce18fb39000000000e800000000200002000000070460ccc463fec695ef2c643f6739e0e048aaa5a2c52ddd5103d99f460f83dd390000000bcbdbde1c070a10265a8c3f02283c1e8c0b762f06e2dbf77ca8780de4b47223f8fa254fb57f3729f31a916aff4c6bbd94df286f3a80a4076f0ac4014c53f0e8d1ee8a319ad0095a21b2a5b0ff3530771e32fa550800b872891dc3febca3d10c53fe9f12a96790f7837e2432cdfbeee5f813af92eeac42894fb368569c979827db193786ea208d07382229d6219787dc4400000001af9b48ef33f14677d3bd7969cd12a0e1edcfb2c4b821ef661269508c4a90c4266257ae45df48bc61d8debe8617d6b44657517b2338164c26f390198a261f8e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431949033"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2336	2316	iexplore.exe	31
PID 2316 wrote to memory of 2336	2316	iexplore.exe	31
PID 2316 wrote to memory of 2336	2316	iexplore.exe	31
PID 2316 wrote to memory of 2336	2316	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5268f15d93729b74bffe0eb81b0d6aa0N.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd9ebd3569344f16a4449fb81016a730

SHA1
176842c50a4f4cfc61c75f183418619ff0afac43

SHA256
967620c27cb6f7c4fcf805af64d487f0a7f7ff61626d145c33bbc1dc3a2ffad7

SHA512
cbfc74c07e17a899a6a888ad17789728d64781a5b0ce857c9a77267b7ff40b7ac3c1ed717c4a00a16b2c92931a76ef3026eae931bfb39190a0d9ab1b01df8fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
292e211a5613305676db5eafd9eb8d49

SHA1
a830ef9c115268df8734d9196b15f9826aaf7819

SHA256
c2d341ece81f15501a6702ed2577f2667b87df761d8e012b6760cad047194496

SHA512
842294a4c7fee12c909ff9f8680abb0b4165ebc4d3f268e9c34c64e8843ad83218f97832678830e53e57cf36850e9ff64bc1ba25153b3a3f0438dd065c03b28b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79307d738093ad4984b6759e41cfc866

SHA1
0f1ca158e4a1981eaaa7150f2a1cd3d261bca541

SHA256
ad1d8972763f4e0a8cc7e96e0ff739b57119ad069e70d68d7e676254c6ba7541

SHA512
f7b436d3ba6781f706810909750b40ffc62f4203e39ef210f75ce7290d98b80819993be45f0c1bd0f7b5323db9d6180a0b4444b0fcc4bc025f5518945c15545b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55c87b985f40718ec368fe0e16465812

SHA1
2689cac0ce50033fffefd53f3cc9a00439c11bed

SHA256
f9ab8175f51b61634e41da27d4594be7331bca8187914a193e0aefc272153d74

SHA512
d084ddf72f9ab8ade1e5d8a4783aeccbd23b0be54dfe82c0abcaaab49a721956007a78ab682a2cd5f1e1ca916d6619504c6c8e7900b95eaad8ba228dc7ba9591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41e57e505ec65f820b03d46763050695

SHA1
eb71511c5f55c7c31014a176f82d010d406fbd8e

SHA256
66051096786a922c5cadd0d6eac2af094f9eae1bae725e37be6fe3599c89cbf0

SHA512
dfd955105f8ad1cae96f50ee89f078f27d7606f3b270ca2c11e3d6a4239ac4b3420d2d2932d383c42031d09aac2e6c765d3b4a80a1f30eb13bda0dcac3290433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7d4197801f03b4c4fe6b7399cb5ba5

SHA1
74c26d4430da995863c2693c4617fea6a01194b9

SHA256
90cbc0381981033f8a50040b3fcf5c2109ac6c964b30bf78e501a202c695ac57

SHA512
7daa5468f862f5af29058396fbe0f84bae438878f7d789f317fd9216c4ab905ffd357e97b3fd51f860d1234f9bf015f5db7cd71923ed586fe8208314e8b49eed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c68fe8532b103aa955f4a194d0eb5e9a

SHA1
2fdd5fb1b2d39cfa6fc620ad08101a00c28d3f1e

SHA256
80ce21c702186faca1b4fab6c6b1745d50fa046d92ee347a1ed9e6431101b23e

SHA512
263c74a3f2a4d0dae32be9b91cf9afa8d01da0dd7974241f884636965ba7aea62db94e3e9c69d4c480a513566e73254f3f9e23f6947776b9486e65b68cd0b23d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5b45274a0a3c2dccf42d068016cc34

SHA1
6078810bab6c47ffc8a64b94c7447e5a32ebf130

SHA256
cee603fd9957acae6aa05c7ddc0f58c86138bf2bd26049620719d27c59cae6aa

SHA512
65abcfd1cb899728921d2d639b47ec55cd953e4731b3741b6f661a00e3de2d55bb21d9e0a30887f2e4af10e5d5579ed3310633a4132ad79f5bf4d71348e62d9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
715ac61c2cf5e71bd71b04ddf0d47a4d

SHA1
018e5d222ed815c5317ffd1f2ba6b45b2d697776

SHA256
36100c7af04f1fcd929ea206d2b7cbcf4a44d3c0f5b1a1d01608d65b0104a63d

SHA512
37edf39fa22acdf955c49bf4982cb5e7737559cffe9585f37621e2a38a3fb86f9853ec43a3e2bd247106a9300533ba29f1430a72dcc622004ffbbc47f67709d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eacaabf7bd9f1bbcdd9e108a34600801

SHA1
1b51009cc0aa68eed2230a099fec1101f125c480

SHA256
ac1d454cfd3e80b0915671f2ba01810d1e57f81f8c7845c4f1a4c056c06cc170

SHA512
269f2bf7bc19660402cd0079889f517182c5e2b4ed8972d26beb151231bf02a4fd50a50e31acd6f9d77bb93625b2fa526042afc74f15a43e5f0ff4e940a0ccbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db938abf9273ce850c3069ed32bdfc40

SHA1
20dbc9a202b624762212892d45fe3c717bbf377e

SHA256
6c4f250c4b5241d884abcebe3ad4a5c301b248f784e32ba94ede733932855ff5

SHA512
ce3c07e56767baab86304afd6f80c39d4ba422c2bb40ef9a01faa466b6af195716d94293b1eb3e53a34bc3706a6bb331f218bc5373109a872dcc23daeb9cd86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e60f381e4a316eca9d361b5bc135332c

SHA1
0c63e0c95639e842a8c102fd5a5af77490224cfd

SHA256
de38eff9a0cb564fd3eb654e1b323d913f6ae78748c2a3b54190cab78a9d38f0

SHA512
6c2933335f3d2ce488b14ba52b2a21f6750dcd1f9e04f872b7fc74f4343ce62e73a50fb0471ec77815ee7a4dc6e9bdaf09b6e2ea138da8e442c9f6401310204e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d9505f13a55fd864859a460897444ef

SHA1
efa1e736ceadbaa24edbee72a192a1abee17ea0a

SHA256
0cd2db7154ca153f226e70843d10d269606a61c8743eb67d3b0cc355ff25a90d

SHA512
f4bece180e5e1c539ca5743d94f9bf0258098fa4b8be551a8021bebb96f9f96ea9ee1ebd97c1b4c273aca9495e96bd2fc023b21c77e94ba9e1c2b96d29003918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb48b9b2f06404e0ba83110d095f678

SHA1
6df57cc684d2e7fc5e623f910a354ab727d7c8f3

SHA256
2d16a3e69e99f9558717175bb1b20a7cfe1fde7b5d5662ae08257f40ae6f7b87

SHA512
9460f9a80045ea7c34c4b2735436fdb77e97fd0aa0543722261d7790737afcf068660b461ec8ed5019e59a33c545b2bf8753c552483f3ae91e13751d1050fc7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a91072814b653e2275c9184975ce0c2d

SHA1
dc239f1c8032bb026fe7f465897815090afd3bde

SHA256
283a60c2a8e9f00d02b2fa5dedb1d3c350ad4986985efe9676928340659fbc82

SHA512
8d7edb41ad967203fe5c949a7b40a9c9133f04cfe5d8bdc90a63dedc32484f430d129a3103338ce1a7ed6d1181ce6a74098e6d428dc89a2846f36e043755a026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaef518fec520d365097d392c7a77144

SHA1
b45f7ea846acb11e90eb1d8e560bf3a27e4c206f

SHA256
34bda8f3e2289dadcdadc92e0145ae565a2dc8b0eaca59e13e8ddc21abe80314

SHA512
350e83131662382b74dc53322aaae691e89df4b3810e45ae2e3a0ecd61e4bb629bc6ab6fbd9a8e8571256806d3de63ebbafb1570af94e5fab1f3d215456b4dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFDF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit