dd66658382b83a14d821158a09848ea09e9070d47a0e3803b03db83b3a81b381

Analysis

max time kernel
141s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

40KB
MD5

8c735e1be55f3bc3dfdd25021eb7eb61
SHA1

b862cdbf929bb9aab035a84abaff94970b9e7a3a
SHA256

6b494ee9fd9e9a715ca601b8147daf9963bd2b2ee1e4e0a5043f9f6c944fb8dd
SHA512

c6aca4cbb550b687c60076894441e308a36ef8dda2d2f44672fe6da62d1c5d2075bb15994cfffff593a89a4dff36554368a4000d80e2f830ddfafe240b0b9a4d
SSDEEP

768:SRmh0OBgpxK8t8VGw7tBc3Z8vfoc+i++mJLJ+BiEWLBv+Ki8QrTj+RookBTGo+Yd:SRmSFxK8CVGwpBc3Z8vfoc+i++mJLJ+N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432046568"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000af6f90a67787b925db786883d9592bcbcd7c6b8ef567f5359c00f44320f378e0000000000e8000000002000020000000188b9d9594ee2ca0cd3b6dc20631a14c1e2b5eaceb8a5dcba5ed2c9faea238d020000000bd53fe41c0b63a6f9a6a5bf73f0d820f8599397f01832a82d80680a5254204bb40000000968635d61f9f246d52b2649b3185343888d643b30168dcdb75af3d870024c8c8e14aa6deb60867b774185306bd92a1c6e3678909cc06913a49338e2b27f7911a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b47b97b302db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000078b316b6741ceec49abd3f2a94ee666d9349f8a8c5de5beaea90a04d218b45a5000000000e80000000020000200000001973f38d1ff713a0cdeed350387f0cec5380419248b940370996f023e8a5b27f90000000e9034dea0c6961929adaa65fc4cb6ccd562e5ce6f4760a7f8ca142be9de7c1954ad7529f950f02950598ce813bc227143578dc6296360ed26e5d93293af6fae3409146a5d1af64326ecda64f1be3586c80c03b236ea537622c54382edfb928316fc3082f1365c7a8f19533b20760179f497d59bf76bb7f1dcd6b7b8798662c72c626d75f7524a8f5bc9e792aa9426a4b4000000066fec830dbf0179799dd2eaa468d351fd427e82999841bbb4ce14e5f29f8bd7fbb0ef749be26a3a900a4735bb91edd43a2c189949794155d89f7672f1066a4af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{812C2861-6EA6-11EF-9747-6AA0EDE5A32F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1912	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1912	iexplore.exe
1912	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 3016	1912	iexplore.exe	30
PID 1912 wrote to memory of 3016	1912	iexplore.exe	30
PID 1912 wrote to memory of 3016	1912	iexplore.exe	30
PID 1912 wrote to memory of 3016	1912	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3629353dd729dfa631c62c4c63f6707e

SHA1
c18553a4e2250e622f7d13b74cb4ca6791b129f2

SHA256
2d2b92845edb2cc8851d27e86ec514fac74283901c8c878f4a2dae2b3be2ec9c

SHA512
45fcc9a1d0dcd96e91a628eb50d521c5f90f6567bfd0ad9644363bfedda2a09dfcc667be11a0276ae5f45b08f9ec0ad922e41154337782054f0bd8334ba073ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
719bcf135928483a4be96f26be9496d0

SHA1
ca60e140530d71c34666e5adb583cd510ff91318

SHA256
a0dc3c55f603b639e7030af7a149028827fc52fa8761f2ec2e14826fa58ce9b9

SHA512
e07a4af03f8d8b5cfef2f758b07be9c5e9989d90e4772b47796515ef1d78d81e130eda693bae142cbf9cb3028df3f63fe71fc40f0c63603e7028379a99030002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f20793acdff6db83f330ca5e9ff10de

SHA1
a17789ac453ea0b9852387943fab4d9852a79395

SHA256
3d852287be6b37b9b0201b664974f06465cab9d8db07e2d5df4bc0da864b9985

SHA512
a8b570eb69a9733dea4e2244f1592db27aaec63a38e9fbf3b88cd9134fafa4a12478736b7adb8ad0075113dca218d7b23f5e8fc7eaec819ba70836692fb0b1d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2de8a2bbabef9701414f651e096c1e0

SHA1
2ce75672df122f003e10c0d215d6093b78960a0b

SHA256
15cdfc38d73a6c3e430276bc0e4b1b4f21dba693d443684bb03509512176fbdd

SHA512
76bac25761e1e4b9313f2b253a7317ea178f2cddf32787c0b21435a107346071f152b0e9777a967702d95c240158ae6181883912ad977035e16f64856d8dfd73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5e53f126b99c0e5f3870e7b1fa404bc

SHA1
f3b6eae78507b608936747d01838aa8e9c77a534

SHA256
3b106dc56f31226342261f01f5588effcafd9a7b10596926e499b60932b73dad

SHA512
a6a65495c1876c3f0282ce89bfe081347d52516a355e78b5d51003af9274cee699cb4c3704956dd7feae8e56e65a584924e89666cfbfea58e91e1a82d7cd172a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4918b7450fa8add16bad72319f307b4

SHA1
0b52e0da8e0cfc55ec25b7022920ad56732fb40e

SHA256
38e831235ae066d2067a93d94fd9e5ef7e76067a0e09b0e07c905a54f78d2d0d

SHA512
890396fd0b429b87db971ac8f20f251983cea49b1b0194b1321b12220556f6b13774aa79b8ea5c28c4a64de4fa5a37d52db3b67f1bf3ea3f5278276b2e178b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23bb4538673174de02967d638e637f68

SHA1
f9ae446a919b3ba70bc8f61fe4d63d5d64c68d19

SHA256
8714e87c47ae4cf50803e6e2f9896c395c5b95c17cd7c77de6d0fbf20533676a

SHA512
c00e492290e1529d8a399449f9a3fc82aac04e804b9aab4b564b081ca3597dcc58f181f91a3ef3b6052606ba7fd0426de1341b586b3123ad721c7a512a6ca542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da57013c2f803618604c6f89a1603102

SHA1
74f5a187114acab6212215bf87f6b3e5f15a8db0

SHA256
7024a826c7b0bef63f655bd7188f1595c9dcbf5a46ca2fabef65d6e4bf51155a

SHA512
7d60f537b324a981adeaeb52ac340f92840e0afe0b021b897973f37a13fafcb0c1e962aa647e8f0d315ea8973ec75967493b1ee56088d55369f960fd679a78ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23de4cd7988b29637d02e447f7c62ef8

SHA1
386d515f416808d76309110363f6ccb77b54ed17

SHA256
27943a76452f2d20fba0ed81a119d037d64cb7a2ad8c836768f86d5febe668dc

SHA512
b0b59acb6914cf82f3a3cbd1b4de0019f512bc68b11739b149e810db640234e8cfdba37b9edb22f01c16b6576c8d914c26b74aaf33b4e5b16ae59bb44411ca68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c7edbade53ea10a85fa674a5c6ba7b

SHA1
1e3a6453e8279a87ad468179823fdb6dee18c8c7

SHA256
6b514eef78edbcaa4bb4a2a2ac0be3090547f3570ccdd3d6ebdf180cac41e0f3

SHA512
8c96ae8c9ded477a74d9f3c13e5d08bec3562224ea7825b389ee9c1532adf8b17363416ff7a6adbd57e46ed06be7aac8192ede33fb2cbcf8192d398ec5349746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7f24da34255c4717cced456c39b272

SHA1
aa2c631c5261eb7f7822d2d6e33d225123ce1f16

SHA256
06be85d5b69d6e212c6c46547582bc3c49fae309e0d0f528f530d99e39313ce8

SHA512
ff3c1934b5fa73e93a489ee10bb51d2fee3371f77be3a5e5d5dd2bb49757159c918ef5f24cd550af61e41ca94c8be114fd7d605ae1435cb5b92890229b06ef15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2c6ce511b6067f98988febdd5c8f8d

SHA1
6e18a018542dec0a6fadd90976a71310976d9b76

SHA256
60da92380d8b8ead2b6719b9ece71193119e5769b1d39c0207510b756d8da655

SHA512
70716bf883c6a3b50a8c49c44ca63aeefb3bb568ddd18cb4d31127956f46c56549333014464047d213a61ab02179eae3adc3ae0d576caa31a0e6022027f8502f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ce9e39498ae2b93641cc63de9278c80

SHA1
5c94ac492649e6d364fdda40e8db0787a87bcaf5

SHA256
39021fb892a4b7fff11fec29905d4675c206a443efdca8cba797c660695a5983

SHA512
c7d882239e1b29f01583f95595ce5c831241e721b49fa8cc76492afa7846985b893dd61720b757b655112d7a77aea4a6b851aa1911b38740231c1e9645b49dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b448befbea980e2ef5c824927172fc7

SHA1
44ef05c625cda31d05d0fcabb8fc3ffa047859d2

SHA256
aa5041bb563630e8174c0dec4991fcbca5f5476b54988f5b82d9fcac479fba42

SHA512
14db23b3c9329201fe4f7bfb4a89a432998ef051f0854d428b5e88d6398b90a19a08b1e3b600c13a2be97fd0d4ac9801510b0c60ff123e7502c528fed70e568b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98342908524a8a915c066a169b4eb3b5

SHA1
bac6f1a3be1a7e94216f0175ec1c55fab2cf37e9

SHA256
5835662fbb376e0f4d63458ab81bf36a0bb972dd4934c3b1d3018c4cf2167b2e

SHA512
95848219f81d3b6d6e1fb36b230a1d6eb3f57db9700dd86ff713919d319984e96a43aab3e942aad9f2b7791e12041c632a2a1a9184487362973ecc7b25a3cfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC60F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC96C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit