2521bd40021b5d9470557b5b1d5fef192b1bf64072c5775c70e8131f208a598e

Analysis

max time kernel
137s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

245d50fe2beb6d7b528841b938a44096
SHA1

04a5c9f34f5ca75cf4844e589c8cfbb1855e79e7
SHA256

327a4e00f07e930728bdac768cc470b5503e3ca0c2d2531fdc1996d22ef8f064
SHA512

ef9eef3723084fe3ae7a18eb860f64086b968a78244105b478c8fa3df1be961ab322d2f1ac7607047d0c83447d79e1e658c3b90d663d907c81eac518c37adeec
SSDEEP

3072:SZQoCkePMWfiLyfkMY+BES09JXAnyrZalI+YQ:SZJIiusMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432297327"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FBAC611-70EE-11EF-9E99-E699F793024F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2764	2252	iexplore.exe	29
PID 2252 wrote to memory of 2764	2252	iexplore.exe	29
PID 2252 wrote to memory of 2764	2252	iexplore.exe	29
PID 2252 wrote to memory of 2764	2252	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5597135a9aa44c0881e226f1bd1aa964

SHA1
633b2ed2cbd65f5c851eedce35b941172ad44563

SHA256
26078e45363935d680afe4e43b1c33d7ad7ceca87ab1ad43c49420c756d442fe

SHA512
6a8b53840bfdf362f1c2020e2c65095705717bbae66accb70fb176db8c7964e618cc01f4295249365dd035a9038fb33ff47d04242f343d7aedebc1f755313669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
500c543ca5374ee42f711626b2c1827d

SHA1
91559089c382fd71a5b16be9976f393e9933d924

SHA256
096d5bd1c951ed78fa2e4eec3edff9bd97464081b0e574dc91f93193553d0aeb

SHA512
f786c97ff057662163fd3765c7382bdee74c77d913984532da77dd6d694be25b41d14bc8280eb385b2b2257e6d2d3913f193e96b9282586b1f195dd1d97b8dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ff67f8cee1218d51608f03df9c733ff

SHA1
aba57a721c603c9b137f437c967501f9dba98776

SHA256
6be9647839dcc1f601cb754bf0bee34429e5345ff781096654de105189fced48

SHA512
9182c67755896db94670f7063ba56ef1473384c5560555c60caba0d558209d4c1422da6ae7e6adb5d4c3411588fb2626bf82d7d2320993725e9cd55edb056baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f902c35d2bfaec4d91520ecb4f4f6a

SHA1
e430b9a14a804e91302c199eb50dd09a442e92c1

SHA256
f29afe0d6eba385a2238e42145196165f86daa4059df74a40080b325cfdfc4c3

SHA512
90ec18c6c6fd3508183650ff465f7c9b76020b17db048905776c517b9a7161b2f564cf52c4b6f897690ed6b192cc635d09a57e00ae4a56bc0df042b96bbe9fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb378a9f15e83fd636c7d3a308c58ff

SHA1
1f5d55eb4d086503147560f5520cecce7c24c54d

SHA256
679b83cecb4a2c5a6749dee4d720d95e8300c77dd1a46bd95773a3ec8c3db96e

SHA512
69e5048e6ea8fcaf8f2550df90f01d4e158f5ad1aea4db645001ee11a10031bbc60e56a27210b5fe0d3346e480f27bf55ff35f6a8ad14bb547e9b782e73ab70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d943d59b47e06da0fee0dc05187d93f8

SHA1
fb7fdb815c53d7c68027a696df5cdc10c14d4f61

SHA256
fd81dbc6029851e445314ef3fed85af12130af30f0ed257e2013f232d9545dac

SHA512
c363be6718e6d68ea6c6baa5993c25a7e7fcda30e6ec700baef9ed72696b533821a951001972d09e22d3e66658fd25d8e5e23d265b6a971bc532029c8ddd6aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6c1038d79630ca0e86273303387bfe7

SHA1
3ae0d61c65fbf1164c703eeb3709b627c1b1e8a6

SHA256
0e612b2514841b88fd1fcddf4382bbf5cb717b48142bfcc399f8e29ff9580021

SHA512
a8adddc03f36f2026f695792098bc5e15b0fbe5e6f5fc75e9cf1162e922d605084e79065192a12876258b0c3cc63d7a371054807ba8542b8cc46f370912c9e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f78836a45c1a63ad977143e3174932f2

SHA1
db979d453a2ec100c43daa26db3653ae16598718

SHA256
22914ce9934a44c7f55bc76976e87da36e5b7929afe60c4f3c5224a1c64b27dd

SHA512
c74132023ada73d11da0a352831bca1fd429896986f86b89f42c71998c7c4fffdbba002589bea63f4bffa551b94cc6d04a8abaf44cf9ebc2bcce0b768ea36a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a14f8a8040bdbf1ad5647c0e05d1cccd

SHA1
8d899adf7557d07ba41e57c0d6e03300a5073302

SHA256
c681ddcfc271ac49d8910f54719ee70c6b8edce3bfebf64a769b006e251550b2

SHA512
b9357fb8b45c7dbd5cb6a4b56046651d2bd2e3e3fcaa7963d4d5e6183e43f0a03a38f85a7e3961238ad8597420b92ba4b21984553e168bb45ba975d07dfce813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209c79aab72f863f2f0bb0497e7249ef

SHA1
702962a3cdef3260e50bc56a8d79d985895281fd

SHA256
46882381d64645326bd000e59ed46a16b565e96051d3c4d207514823d78579f5

SHA512
6312e4f158d20cce4be02055e7695118a4f2d8e8e8337f041ca4729af2bfbe62ed5a20340c0d4f7c652940401c1571b107d14b1b165e04dea611967a8482b271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf7a60311b08995cbd72983b78b3475

SHA1
d8ff662e2c867f873f3a7a99ffe0ee80e1e71cb4

SHA256
b472acefa542d9bd87e91bb07412a616a9196f4ee44b9705ce955caf408311ec

SHA512
60701ecd95669b31ea7e5fa2b38403d01389d489e4be0ef855aafceccd20dc572291fc21a76786ec98232563319b0cfeffa5227d0ac1edbf17190295e8b930c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1ab0ce97dfe7ebe9f2db0b5312bbadb

SHA1
78c10e60ae10ec2d7d7d28c28602f3a48700aae2

SHA256
de404d505493d33a5c19b9751ad89aed65eee6a4faf1e9bb332922643a146e10

SHA512
35d65bae3a979b44f58430a89a89003810c8ed624f73236c53d7c88cf602453c747911a180a7445d39714871a4a53cedb330e67d5153256882f943bf53b8d0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5442cc100912c015e9e3bc7fc50bf3b

SHA1
5fcbb966b27fc6c150b6aab49b5b324f01b05f84

SHA256
6a3b53cba4058958014111d80d6c5497fce0e271d1063655137db691aecdb966

SHA512
2a775461ce5ef4461599e913b14bc459e9fa607bc226da5ce8373e6ff666576cb03f568d80278cdbaff613ccd42599dfd0603922454aa0ca252b40bc369275ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0a211e4385334853cc5895bee089792

SHA1
033e26f75cfe4f6c721228b5458ad7ffef1f356e

SHA256
f0876f67bff29f8ebe4694cce8b4cf6de09f1c866a005a15ba77a22e3403682a

SHA512
88c0fe0df32f6af770dcdf9567915ca63bfdfd5e972656d4492b24b8a21a1cd788c0c18177acec17154ca46fcdf26506a3eea97fe3a8d34419c8eb703b77b8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4319df84b759268c8bed1c53ef5e99

SHA1
481c35b4833e1604e58aa51d48a7bf4730a7a8a7

SHA256
79b9457f4524a24ff73d307a12dc97390ac718fe97559fe741901bdd5d5d0e08

SHA512
06d7bc0d631897e325383009306d72c497cf8d400f6f50c56156674061a21b4e1f99d308a69934a193aed76019772b6cbbe320f56dab8df388690ad88f5ff84c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f4a82fd1f5e221f65871fc6c1fab727

SHA1
0ce8a917a5d7fb8f62060ce1f678d89bde6af4d3

SHA256
ca692b965c3c3f12c6c02b3f69f10aeb012be3071115d20463b2544c22bff0c9

SHA512
081566f0c65d73588a9e1a4fdc010ca7ec409ec1721a09df1e8652281f639d009eaf9b2670fbb005d08eac7f94299db8735eb7785c65b61214f7597303b4f57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4059293326a8e2378b8d9a3873532ba1

SHA1
4d3ffc3a0b84011285022b27cce67cbaa2198deb

SHA256
64067479e87f698a017f9608af1ac28e8ee52102a95651522676d67a1ae6f963

SHA512
c64d456ac3c627206b9d8f1cfc44410ac689f78a27e884c28179568ec65a1a93c0f67fa4837586d5e6244d32eeec53dc55b11ef1140a636c82cc4bcda74cd3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bc8bdb69d7e135e60b191931f6c82a7

SHA1
a2bdef0509b4e15d9444cf62f331d491f501d9c4

SHA256
0f9c00a757ee4b7a2ad2636754ccfd645994cdb69da4790657d5fa9261318a5d

SHA512
08fa7b04a39f32d21ca4a86364ab48c643700dbab3578935ead36cec009304f7532c5f83e433da843b486c607470206f2b6995547b5272a143ba974e4ce0bba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f66713338425cc322b7f3686e70f93bb

SHA1
28cd199ad6fff459679db3f136f001eff24ac8a4

SHA256
f3ed32c5f17a523fb9dd558d9ee2eb017aac04106e879b288789cf8396f27ec8

SHA512
632a7f1dfd70e50affa68d6c7731a7dc09cc3f6d24f60e5666ca48ac3bbdb5e8375be29f450a378bf079e7f81e0dea7eb8ee791486a0ac4f491858db98914019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D9F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E7F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit