6a9c1d5e07624562632b30676708023c393ed1589c403e2b8577eba90b7174d5

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

40KB
MD5

4fef584d91068b937badf1984fdebfdf
SHA1

07f3439a85b6de2a75389b4e841dc57efed66661
SHA256

e0f5f0b5ee75d4b88201381e361513a224cb3c46b1028c81cc763693e5293445
SHA512

bba9dc16e585ff647730956c4d433df700fd075999d1aa67e63a4a211d2ffa1f3ca6a1d0e840594ca8feca3d8ac5aed5b0acdff641a4beb30c74efa13e1e6f2c
SSDEEP

768:Sdmh0OG0m+eiE5wzMCyKBc3Z8vfPg+DvaxnjJ+siqBUTy+tlq2wsj+b1r53pv+Jd:SdmSy1E5wYC5Bc3Z8vfPg+DvaxnjJ+si

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D940631-71AE-11EF-9D9F-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000005784c1502870c4988d1835f5a183fc00e5b1f592e52833fb498bb273ecb7202b000000000e80000000020000200000002f4a760446c01e9e9f9c2c67714b478d2368c224ee336e0ebc2bca4d4ce9250220000000378b724ebcec302f23e1bb8f2e69b1c601fd749a24a86af3115ac9000f01300640000000f5f4774d6b781ef709b3a96247555861dd4014b4b51c90be06ad7742da26b53e0f219ef91eecdf39a564c0b3af55ea36c3f04b1dd1b71e0751bcdee62f89917f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432379734"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01f4354bb05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000e0500c1cf09bfc407a1304fb7350a83d4d737b2005868b6dd7bf361307b7ed99000000000e800000000200002000000042ac03df0deca7114d7c83a3dee3971f156c20a8915c16ee9528acd104d5a4e690000000d3146d75502b613dd9e55055f8fc420fc48dcaa3d91956307276fb56864f7659b4df03f8c490a8b0038f6e508c1fedecfeaf0124d7bfdf8f7ff194d17303064f30f075cc894b5a3880a846a663ac76277024599908f78c67028a6d9a81033312fd6b273dc95b4903aa490e9a1b41f14154b6ccff893bb914374e6daf782af6ec6608cae26454fb41841954802b6b65524000000047712ec7cdd8039c6adfbeec2364cd970863717841c70e6747d332b874015b7ad1e6d6a1ba55f95e6d8b14f933845bfd266179e06e5e4b165ba4fd7fc3c11d16	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2388	2512	iexplore.exe	30
PID 2512 wrote to memory of 2388	2512	iexplore.exe	30
PID 2512 wrote to memory of 2388	2512	iexplore.exe	30
PID 2512 wrote to memory of 2388	2512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
090be0ea8300ec819c91e9869ec8f37f

SHA1
d121bfbe6cbf5780593db08f48f393a65095094c

SHA256
2e28d2716ca877b5a595309e6ae532af0410da3359ba0cb8fa44ea2350e547fb

SHA512
c383b90c64c097ea2acc2a9d28e89fb874d5a319c4ae483e7acb4ba8f49ac4096f985105fce5cd85a8a48d5e22eec8c055d716d411fd771c8a97d818122625f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7213b555810d13d420c8e97e460eb5

SHA1
84f9627723e47d401c9bda75a1b716049d2a5f46

SHA256
f8ec815d2a2f1eb18dc06355528078479db29702a1ecbfc1705a21da97cb4515

SHA512
d332a7eea6bb29ec84ecaeb034c598135a0af84da6a0ac60045e70ebd03cc250e5668995c1b20c57a4c23a9bf55ad8fc16b27ace347660460dd9d206006300a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9fda86ce10aba07a9af559a7dd1a9f9

SHA1
fa66dfc069b22b38617657f3b92d9a3ca3bb41f6

SHA256
2fcb8ea94eaef498014a6d96bf6d633bd2b37a69402ec8abe07bbfb9dfbab329

SHA512
0b379991ecabf889affe2bfb1ea62c491956e1032aa197f4ac32c4b90a7f389a269e4c8a12e141d9f78be2642ed930b65b141317199649316b5e446e8f9e198d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253aed691bcd461eb232013f17647d1b

SHA1
4ccd3b40e5e37dcd1671dfd00730792697eddacc

SHA256
6464b5be2445550b57b1784a978ad831694966b31e9d2c9364d11fd40c4acef5

SHA512
8e03afa59e3a5fd9f84e264e83365019e132f18502c76bf4fc6a217fe1abc8865bb733f5c41eac4bfcc061da89d3b83aecc9e2cc3331ea29071d42ccddb954b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10423e3ed808b308dbd14d5b0cfff166

SHA1
5602e28cc7a7e3c329a363489a72d58d01b01b34

SHA256
6c6084af188a9facbbbe64df10a305934ba476eee251c3d22399c38e542a994d

SHA512
15062c1a7b8ae5b9edde07d4d49f6d33d8dd53179185a7dd6faf89236beeab093b75664b960364774eb982c6fb7ecb81aeaf20853510e1c47592c4c35b9f7785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4ae05bdf70754458a10ed6a4568b3ed

SHA1
b748b0bc719c15567edf383f073c16cab610f0eb

SHA256
b6044286dd30b4a5304ca058672e03d8fa9e0d8c9514c257bd6a83911cb69fcb

SHA512
1764ae8639b86306b9929689b1b8c0cc6f6b2de51f05e5488b567edd529ba6fddd22e237fb005e9c0023c009cb2405b888da77807de1508f5b827c1e26355761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc78ca5eb122a1b60b079731317f27a6

SHA1
7bfd9880260fdd18d9bfd3991f6a9b2bbb31b8c3

SHA256
bb2afbef217a7e324f60227c0dc554eb87b12fa0811a37669a126fff32fc703e

SHA512
875f305fc6477339487fc7c8ce95ab37395a3dff21338ed77a158be114e2a0be2fa199afb2a35882928b8c63c7448e5105e5309da3edc19f77ae43b200121a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cb4b5470b94b01234baed1821629bb8

SHA1
69e45eec62b48befa037e1a8a4ef9991d18909d3

SHA256
44b6608dcb9f6421c6b16c5d1debf85432d9df06616a9d7591c693618ddcf2d6

SHA512
a7703c8798d2944fd047bb62660867ef60496573f767265340d147aaad10af92efddb44a46919d3b738102607aecbc01c1b495e25d7a81570b69b030a76bdd82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa64a2f6ca2146804004991347a7e3ee

SHA1
8e22ce77ce2b52b98cc1c5c3c4cc204f7a4a7e94

SHA256
a3a2d42b4cdf64ffadc72a7006ab31463247db1499107851917cd089b745afb0

SHA512
c7d53ace85b2ef80dc297e5241483720f4dcdbdbe26e1ea17b617535e0ff4862689bc1f642d86f2bfca00499f7b79dd85942aa3adb85e57bbfa50cb30fcd5f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit