6622e01a5aa249d49a06c9ce85dfd1cf6b5ea2c3169cf6ef3938351e2607803d

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

5d3a1fd216a6bee6f949e10ce3d18ce6
SHA1

739bddc34f2fe0aea210e441c8cdd7f27d8d8a0f
SHA256

60c075be1ff9db22fdf893344ab6dda9ce2f86afc605c55dad1229761afa27ff
SHA512

284ad2c695d8b7fd3f704a0973a2fafc84130cd7e291cb4430fbf1b19fe2b258e7ffd8c498c81a17ec44c2680bd17b8f03b300d3e00263a8e5517ee308e818bc
SSDEEP

3072:SUR0t2pzzlQyfkMY+BES09JXAnyrZalI+YQ:SUVbNsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{731851A1-7215-11EF-8287-5EE01BAFE073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432424060"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2336	2376	iexplore.exe	31
PID 2376 wrote to memory of 2336	2376	iexplore.exe	31
PID 2376 wrote to memory of 2336	2376	iexplore.exe	31
PID 2376 wrote to memory of 2336	2376	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f092ea45bb0361005481192d24890d9

SHA1
b5a8bf53c9f6a0a2b68b519ebb457a73f0cbbfd2

SHA256
77692a0cc9950ecc14eb985075383abb660e693a53ab1b92f13587b4ada24b92

SHA512
7cba009fdea9691080787a37301d78ab3090c64e02f4326d31e383dc3aa9efcce0018cb56e7b70bc123ab9936309e7412de41ae9c6b2bd2b9671a04b4b2dd2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26d7a711499441a7d6a7edf6b1010bd

SHA1
84e2126fede0e9c0c1b0cd849433bc6484b203b9

SHA256
fa229bae72408c77257a656700f8c3d30d741586b979fc27178ddf279aa0e5c6

SHA512
8bc81d138903adf2d08e0df3a0f7817814ab4aea25ec2920cae5f15f26651ecb8ce6d0df9b6153e2d4fb838d536a7ea5b9e3572e391a50ccf6dfe5c9136401f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb7a241436e389a3882a3da0d93d6db

SHA1
7e236c9edd036f9498cd126acb4670b0e01c81fa

SHA256
16fad99f377d5ffc99ffd8f1abeb6aa9663625693ae00212bc05298a38d5f3df

SHA512
0bcc1afb4ea69dc4eb2808cdaa26d8be30ee224e29bed5a5c9286324c976a0224e2434ed98596c6c28ebeb54be5b9d794f2c97012b38f371bc60a16c6465a76a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a069434eeb511932012fd953fab6e38

SHA1
2085380f76316c504447a4eebaff306dd4bb954f

SHA256
ff76dbeb734e57da9c1c51edccc5805b3f36b30eca551fa9e1f6d87ed669f2a5

SHA512
11bbaef0955d93feccacac89c84d39a5c25987f92aa15ef7e338bfff9111871fce6afb7cae41365bcda81b300d84b0f67355c45a4be44981ca6459f7be474c34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14a391c73acb7c3cbc1d43c3686ef0c2

SHA1
7c34972a23dca9bd38681f06bf94f5f886aec41e

SHA256
81c88a315eb8506b97d15d33fa27cd20dd354c9ea9d5eccc15c7ed6dd9098844

SHA512
f963212ee6b8e13e6b310f2e8353afca7e1a96de422646345ee2bbdcd429bf711d13435384b06eb937887654443caec685608aee4a5a835e18b4d563377ca82b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88ea40b10813f54c3218794ad4f85e2b

SHA1
083e6174406afc5ab31ff96f5ae3d597f38145fe

SHA256
22e7dbd5661397192d6367bb37ef8adecf6c2f9c61a82372edc53cbbf7522254

SHA512
45c550b1f97b37968d3dd7933a48fbc62571ec427614cc2927c4220a85b4221c1a13656fbe707e86704d6cc843cea7b3c1d438d559d399b1c26160344d585c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3fcb53c2d913da53609cc0478e6a9c2

SHA1
518b877961ee3f029cde1d13ce63d5e5a580c9c8

SHA256
83d6a347c7b1ebbd9a2b2079fff3e120eb9762389c82976685a9fb4de634b3e2

SHA512
d120331e5dc29528ccc5efa5e43ef86ec380d9280a296bc33e0fe19b65065037f904cb5cf4c66d9c19ffe1ebbab38b14280d31da59d6a279e2002bfeb5c434ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6f2cb41860f3c270a0a73e706bdfa3e

SHA1
20793e20994fb6b44b2eea30c0aa6e4afeb77998

SHA256
eee99126065830aa36a08adaec3589770ff7719696dbec9a8b301625bd2a5bf7

SHA512
0f103ce4811cf30386ffd6298401c615c1bf13a3f426ccbd62d8c230414e1cc7060c59d6ec83d190e5f553a469aaf759bb9d262e1f9717142f8d4d634dd9d871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07bbf091427d26bfc9ae2cb5191a995

SHA1
85cad72f7348d423f002f42e99ca5bb3095b0086

SHA256
b98c6d2bccd6e992f604d256800b6aa2f7365655dd455ed8f3e22a07d1c22069

SHA512
bfad27d70846f853fef520c9ed47d39e71d1bc1635fbfd776453175d9d315d05901acb3c372dfb0ffc71f00f4f15b9433c9c5c68c159d77083c8791245309567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08129b17ee82bedd93dfe636475068d2

SHA1
cd208ef1c06b4e4edc7dfe3d63f73aee0ccc56aa

SHA256
5fd50a7aaed2c9d01f0ce7feb9a9c24a48380936baab1fbbabdb16915d38fd0a

SHA512
070f21154db063c26753692b062453c9bdf33139d6c2072def7206b0c7087d9e9962a9fd224666f9932e447befc44cdc9135b3f35ace1d3fb6b9c9b069fecbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52456bb4cbb9cafc59fc376c20b5fe57

SHA1
a1c23b5f3a4392d499d9fcdb44d95fcd294b19b5

SHA256
927640e518d4db54c20da41659803952db4549629d60552ada1af598292b7c3e

SHA512
8015c8cf655f03c21c6e6d7b60f361dec7b31e618f89276358b6689a37a1cf1d3b17557a28e8af91d5c864c990cfeee05f4612e10bca4d0f69db3b2dcac0e1bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c1d3d34713141cd486e7038c508be6

SHA1
9aae9fd7c3495b20defcfc5fd89f308c29dd6355

SHA256
d3c3b15dd7706b28f23ed21332f186c06dcac2ac1e961dff38a1452653c27344

SHA512
ddd5ed8def64d80c27627e8ace2fac548976014f9985e82356de395c8a6f33da8fac5ea79b48fe66108e7ee246ec0d72cc2b5a0ff3eb6a7287c4bbaf592ae385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2b3e6c2eee9917255bc5fdd86857c4a

SHA1
e0be0bdee6a0eb6fe6cdd2c01e1b9b92d150e604

SHA256
d7a9bf9cecd01950c2f99dd840d12bdd2505572ff36b87c0c0575b387d9304a7

SHA512
30fd83147f1b32b6dbedf5fb49d863b077bb1ed37c5a254e29cb3f0b6002a81675c8e535a15f02fecf77e2e0544f7246e4a575b3c24db31de931aea24be04dc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5925a58d73d8bbe57f6883ce86d519e1

SHA1
96484363a56579480fa27e6ebc834e226f4715e1

SHA256
eb2c43be2bd8822f5dfe42254afb555e8d5ee967070b0bec721dd95a441cccf7

SHA512
26f4737abee481ab04805c508b2c5fe11f16faf22dfa9e38b35af7fe93ab9155f19b2f70d6483373f79c2979eae52f0e6037c257e41c5e570eec65be0528e8e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
879e9473d0e89f24178015b8fd1a0f80

SHA1
f107f0a8d3780f5f1da83b4536902f80be682800

SHA256
e72314c2c469bd89d9547196837985d3c371f5c388cef3db0d6b090f58b207fc

SHA512
fb297db940304864809d0d29e254cf8d0f595ab8f93450c1c6e0309ba008ae64ffc87e598ca9cc902d711fe6e0517fc23c4eb281c29376735f910a2c6ece6440

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1621f7c69e4dcd9ee3f35bfa47b5223

SHA1
58e9269c6df9989775fdff81415dd9b034ff0574

SHA256
5e5c5dd277f459de160581053f125b2735c531519b454a2a9cd9a96169131692

SHA512
97ba21f73e4dd94e2dc5377863118b3d58f30c885f3c59e428894c39eab233353372d6a5198d4ef975578bedc8996a248f3fd21859472b466731e6adee101cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3add54125f661088bdd3cad7a21c34fc

SHA1
7e41d7fedf7fc45603b8386b51ec39b09551172a

SHA256
0dc23e84076142537e6a82acc102c80adf2828bc72b9909e8deded88bcb1e312

SHA512
d7a10b026d0196c77557b73e64096c47311a697c1a89994970bdb5890910330f39191c4047e582d6295a934dae8cb61e4c62565bed57b71420fad4dd2e43d711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2710a26050e8e3a56112e3be4c30d33d

SHA1
d06396da46a075d70c1353bd080f224f4ece5f8a

SHA256
0f4aed766f9ef19dd2095c692894f9cdaa5eeb65ea2fbf5738bd8e25bae57727

SHA512
c12556e9cde791bd2e0abd6e4aea31734c0d6bd2519d9d673f0e6b616f4c4a3c9d1efb6d0c21c34a40487dffedca729bf609b0ddcd3aa7f50c0c4b95a6b841e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2929138592c1bad10c1dd8021db73547

SHA1
87a4fccfbe9e59ecf36e3d888cc0edcec076a630

SHA256
089cb4b257b06f0f67bc67012bda6decc504ca2b0286236f0f44876da597ac50

SHA512
f199b97ef9c884b97683962e05c90ea7b518d71a53f81162556eae4fcced6e8a26922d0ef47d9b5d608c74ac311675b325842a92b469222f93747bb3e7af4c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD08A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0FA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit