75ea72ea450b95e6a3180b6c667189c5f06a3fddd8a3261a4f903f3578cb6916

Analysis

max time kernel
135s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

b6e8f8eb6befc5bd412cdf9b6fbfceee
SHA1

a4fe9c8e9152384b65596b83089549ce9a0d9ece
SHA256

68aa909099dc2de0f9d8f518a98b12052dc781a204475f5e247f98a957444bd1
SHA512

23d58d26d39dcd550915e57bc2cd6da47bc90474fe894159e3ab2a6d1b9b537f197ae2278964daae17c2deb8a4dadb721bde14dc3a138f54d7020e867aa744e0
SSDEEP

3072:SJv5COAWkeGpyfkMY+BES09JXAnyrZalI+YQ:SJnNQMsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432416203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27FBDAA1-7203-11EF-8C8A-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2280	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2280	iexplore.exe
2280	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2660	2280	iexplore.exe	30
PID 2280 wrote to memory of 2660	2280	iexplore.exe	30
PID 2280 wrote to memory of 2660	2280	iexplore.exe	30
PID 2280 wrote to memory of 2660	2280	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
975466f5819a3f13689301a6b3c2a1fb

SHA1
16ac71d17a7cc9518a382db6cc65b5adbee53173

SHA256
710d24b3b4c8fe0a18d3a453b57d2807f38b8a1ed8c500042446176a46ea3982

SHA512
031e2661e8b9f10b25dd3d373a4b709d15769c07615b6661688456e9a27a2648c87fdb03790821373ae3b0ce118f2cf2857fc329976b04ef8bf74cbb3773cf57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e9261cfc1385f73c5dee38bbb08a850

SHA1
5c483aad976a702973f2339fbeae93d3079687bf

SHA256
d77a45c3e6b4365009d10f5b57b6beb8249d761ace92610d8f0e78d5b68dd0ee

SHA512
6b159fd8e46d4f4899b902b0fcef535cb592d1ee3301b929571aecd272b6db8c0c7d9b5998931d37a196668bc578001de8d4c7086f7086def7368c437b8a961a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dca6f3caba98cd580fd5ffbda0d272

SHA1
d07589dd7afd3b8019d4b616c910c83be42a209a

SHA256
4f71912ce6937c8fdc977b272b654b32e31f6b68bbd99e2db1d8d359992860d1

SHA512
ed2d99ad2fe499a2fcae661c3ae6bfdbe17fd1cd45f5652132b59689cd915d86d199473159161c2b75993fc1176b1a9a9f1ef882e87478850f43f8478b8f4f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b36eac70900b0e5db6fdf4f00f7ca00

SHA1
389b4acb54d7f5e2df7c68b2e6287420cab5c4fc

SHA256
1e2f91c809fd28522f0512604bb6a7cd3bfdbe645dc96bd15dc70e352b3f6dba

SHA512
b31f15f34cd4741421b542b842e0c695444433e730c6ed6c29b4c87179a94c924b2be7ef53525b116a53f224c785107358881c755909bb012c1321c21602a992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0458c4cadee1dbc45641901058fc0f0

SHA1
c747b458a08b60cfa4b70eef670df4407f783bb6

SHA256
ef347e7d9da4a2c8627bf4a592be658731a4f133795134fc7d360653cd536e11

SHA512
c4498766fb2d6f70c4c34238e818c194f93c7c3a2d1aba846a0d56382e64d3d40823237e793f0cbc671eee25b61218700d2d77deaa9c52f036feba817d797244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df9932a61c80823ff5403e0b89221b9a

SHA1
5b6f021192793f1862f0f986f836654798fb2640

SHA256
26aaaff75212cd2b687972b212782bf97ac46e395bc8c085e28062fcdd248aa9

SHA512
d6dd0ad703c5d07729bd2250e03e7242862ce4f171ebe1e3d54e68340ff9fe356f64c0a929471ba7d998e3981a12be91012e7b031b539fad3b7431244bff0b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f88f931d615e12b4d0e76e0e44f98f4a

SHA1
9d6542d247c539f56b4e1e41afc2aeb2a90f3429

SHA256
789286d4f6e733ad0ac37e2a4fe687fc518be047768dd6ddacb5a03c2d7dd51b

SHA512
4de4431d3e8dcaf862d09b39045652ac3ac19c162e0d3286e3a88809695925d7f99531264c2897d9bbeebf842c7b6a55244f5ae9b69620d868e21198f585036f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3b867589457ff65470eca0ecb471fb

SHA1
54dbc13e78426564b7d87591be0709486aaf4459

SHA256
292ca67b68148476c27537c464d4d862b8eada2436b5802b4e4e12993f9ce0e9

SHA512
754e77f09fcd4c9f40d76a27f7bddae1e5a84efe05a57200688eb55fbfb7cf4f2e20c4e9e230cb1d39a25407c177f0dc662d2ad297a8b44cc6ad481678a2da48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35049bad1fd28dd430bc6274e63ee4ad

SHA1
51a5ae02fb6285847bc66a9b7a4c472d4d94312b

SHA256
887a7f35a548e1b9971eef5f351db2782276a1ed4c7386e9ac8def3a0ddbd77b

SHA512
89cdf87686e3e72c985a89797df5be59a6d19203faf5c0da921b8fbaa627e52e134b029dd60ae53d91a4440fc7cc52644023eab4d53161208dbfb1282bd70a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2e94e45794664699576c43970814a1b

SHA1
77e7a4c68d489a81928c6547895eb18c8580c390

SHA256
dcec029dda5a79a84065aa955d0948d8e412fb7cfcbae0423d3feb3c2167b7e8

SHA512
9cd69b116bfe644fd8b943eead11fa12a453f27207c620d604bca1e2d6a0e1cd475563fda05f265359e16e63e9de475ae97b89267bf0e1047c0366fca07eff29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddda5ca57bd9992e4a95bfde799e9fe4

SHA1
12a1d30d614cd08cd800c457add6e40583ab95e1

SHA256
0ad02110779a499c968098af812aef50ad4d768aa8e3bda92a6b9265a9ec44d1

SHA512
10c7b8b97310f8e3e48a596b4803800f25f4ac8f9d1ffe705791bea2fd947bfe13596ed4098371a42ec8719ee4729147fc1edcf02cb24e99b92b76cca2a9f4e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeaf6e5218143dc49641e7146faa7909

SHA1
e7d315bdd3fbd102d4460defc09550fbd7f9e386

SHA256
ede7024a54124dcfcf48c9099534f29f1f85c252a923dafe5036fcfe6821ee03

SHA512
3f6f59528f733a8d491abcdbeb70a622e9b4ebd185d1ed7a540dea3f3364523ba1a00df967b48dd72fa5243824287ec911ab141eaf47b5c8379e24df5778ed8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee53cea8d2330bdb789972099c9a5312

SHA1
cd927536437545336dcedc81bc26243e384fb3e9

SHA256
2b5d52befbcdfdce3ee58cb1ea8253f8b6d216fc274415f31500ad1230820d8a

SHA512
4c3a87fa663e2c20a5dc99f15d3ab7e3893fa6fee7515a6c910e441daf072b0f7920be88038d52f6fbd16ea109549ddc49773d92e75deb8e38f16a6f9b09e9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16358afbad5c8adbfea0919424c95994

SHA1
f0d1b78f7b4633c23007403ccd7e27a1af33126f

SHA256
0032c0651a0447227c98444540f2d452ed77c6c495ac3b9d7d82bbae28bfb73e

SHA512
8cdaf22e437acfe744fe8312ea08dc26b6b727c77a005d9b32f3f8048f63fdab34434a316d05b74bc75827d0136d00de3b9a51a5c76b9c222e55c7a478e738d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ef5285b31a03485b2cac50f8b649634

SHA1
182ad1ceccfe980da4c08c0a19800b3f8ee7d4d8

SHA256
15d1af4fa86168f2812af6de0ea5bec38a3f3f2d26c5b4d65178922628ed9375

SHA512
7a7113e487918f4cd5d5e20355431b5b89e327842f376bc45368c84889b08bac75b605130266914223a07dc22848b2fc2b66630297c6127f3a7a23a484bd7e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12df130473c66911d5cf081442a22179

SHA1
faf48e5f7fd8c1373c503dd2acc604fcf7ba5f55

SHA256
287b7dfe02026377b5a45ffb1ec71f7c0dc648ad823faf220d911e83bfc2161d

SHA512
7b38cffe7c68c461e2e690f7f2834d85d5ddd7bc248d65dbdbc064db67c72978a5805710e03dfeeb84d712d5ebf51bd4756b3f80d42b21ffb53db57a2c579f02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc6dc6647d8abc95267301818c9f7d22

SHA1
ae324159d0662375760db17aa1060291e21758a1

SHA256
f3ff77ef1732865f3008982b9167c8cab092ed25cbec3ece995ddc6dfa13c25d

SHA512
5b107122870a7e59b77eac19367b30afb51fd6984ed4f5625e7a52dae0afe598d2b9913810a480b896d1108a4a721c4d9b24858ae86b5feab7d772d6d28610f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19ea8e9a3caab7c5721556a4b9f4d36e

SHA1
13f4e19ac200541a5bd00b9ba2aac51f0b8c762b

SHA256
2607fd268db99dcdb725a27f934242f3da6cb5930769aed35a316f7de83ca1e5

SHA512
3fe5f1025cffa34230c7ae0190ec1a84c62009065ce8b953fdd483c61657b41781d4e054246545c84cff2d9caa65903f84335a6d39f4f9bfa9a5b8b687e40b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEEA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit