608679e77f6b4de6722dea7ddeb9083470c83f16fb13c4b2984218cfcf963062

Analysis

max time kernel
144s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0-18.html
Size

47KB
MD5

a6829abcd813f31e8e62c36648421d6d
SHA1

f01cbb584004e5e8c9a8a667b2b1f053be712b1a
SHA256

608679e77f6b4de6722dea7ddeb9083470c83f16fb13c4b2984218cfcf963062
SHA512

6331ba093d130f5d4fea852bacc0b69b6c71d1edcf182af135af20f1ab08e63b87d8e96bd164ee224193226bb61f252fe90941e5d14aa12ab71a0044183a5a5f
SSDEEP

768:0uLJ5vMAV/vKlXKZpTuYKQnlQDz3ZS33mPV/v3Hur0HGvy+TdZ3w441/:f//vKIVKWQDzpS33Y/v3Hur0HGv7dZkt

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	IEXPLORE.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDF92F11-72A9-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432487778"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
588	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1328	iexplore.exe
1328	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 588	1328	iexplore.exe	30
PID 1328 wrote to memory of 588	1328	iexplore.exe	30
PID 1328 wrote to memory of 588	1328	iexplore.exe	30
PID 1328 wrote to memory of 588	1328	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0-18.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1328 CREDAT:275457 /prefetch:2
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f243ecd06131544d84c80c0b60bd8f2d

SHA1
69449e04f0771484464b1f996d7b6d7d313f4739

SHA256
f7c0ab5dd9d449dd3b7d1056f382a07be5b5b6a642d8447fde23838630ff28b6

SHA512
32f8cebf30984ee6bab03ad9d9ff22b55055afce7cd20229aec4605fb5cf1908b9735412c48536bfb9738e3c93662255a872853d285b90a175440300f75d7ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
198dd7658ed2d5876fb2b6b66cbea3c9

SHA1
f392abe9a68e2a3c5397e921293aa0115835000a

SHA256
a93f1a88f119749024e1a52ccfa9a0bd45f10d265f594499fe146ed6ec0e42c8

SHA512
f42d4eee90b1bdd147468e6e258dc590bbe5b2a753232f85ca3281b14d4d04304eef4f3f41798d152caabf7ca467ee379f6cd2252b6be35b951bde8c9941c65f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1ec9d26c63c396458aeafb65489541a

SHA1
d01ba645ccf273bb6e174ee54cce3270772268bb

SHA256
57fa748cc829e98c9d5c1b80666e849a4480e31c44ab6b0c27b42743db7d309b

SHA512
9e5fb48b45c6e6f3bf3fd9aa9049292e55c4ada70a80de7e6bcdd64fc1bdceedfbcbe54f44d6c752c5b7d4bc9e1ad9d143742a8a369d269242bd9c775e95447e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de474698e63a1b3cb2dffa5f2cc47ae3

SHA1
c798b6a708d7eeb3a2cabc5cb2661632ee266f15

SHA256
1d8b3d177526ac7c8e52585aa6b8d20856e40516a633d6b4626d908eb9770dd5

SHA512
eb88c8a2e98eb54120135d47098b3559fc89aeae16bd1aaa5661a19ec046b050a218c2788461f88152881e20ea49c3d02f8dbd362f5e5c336c342a626b2d57bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80e5a5a1c3787fdf2049c7ef724a18ca

SHA1
6197f94e2ae3d05cb0677ddd505753a477df7432

SHA256
a53dab71e30a995c0a5b4437b4fa94aac4121ab6aa03f25227d4cfc649db66b8

SHA512
8de95f479ed1513946a9eea53ff9e783e40f97c68cfba8aba72df7f7391c97037a8df4e25a3dd0f669cdb67a5a1e99cd85d646894e175caadbcc6aa977857004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ecf58de7ee7aa61458d52448c846f0

SHA1
2bacc9db361f690633c114a0caf27887a7cfb38b

SHA256
4cd8df20de07cd5fa63412917925c4108f67d94c932cee471d693c3534f4ad47

SHA512
1171a3066e0a3909da9e2263975ff6d7e773b572c0a71cda3cf53571a15ccd51434daecf0c348541a5ea5b294f3a81f2de2793f75a294dd1b39eb991e6aec581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
357faaf4f7b738e78a6128349a5e5b5e

SHA1
164fa588e8b2f1140c64a92c967729ca44a1bd1b

SHA256
7213c3931ec353181aa6ee3a69d94dd595320a596bcd92d1a3f5986e0011c988

SHA512
cd41518af000c37b5b75a0a8ea104d3e05683a61f6a06f89ba153fd703ca6288648f73117049673c6575108deeff38f1939d2c329e5395379e5d7ca3291e4788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c0e9bbeecad05cae59fc31c46fff9d1

SHA1
6f02e202358863afbffa526ce5653a38c70156f9

SHA256
d93fd25c552c0ba2330613f9c76a025a9779a1de814d0548da8e98451cccf4c1

SHA512
c9880b8ca38a8dcced1cac0a615d30ad3673ccf58ad85eb614cf0e9311363b8c53a6945c3baeace69d1c5bcc52060f412b7eff1019b83d1dc82d763718247603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4be925f3a46e5a1d304fab987f94edb5

SHA1
1a978d67c2a853e00675e7d1c91631995d4bab7f

SHA256
4a6666a57e6a385ada8679b98a6ee9d29d66d3d9519b1c2a9f5e50e41b283a75

SHA512
3a1d430d0ad053d8a1367767770c003b10b51238292a80b36a1a2a96de0a30cb7e80239a95c5ecf5def2ae79488beae253965695ab289fae43434382c624733e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a18884e79e011a2ea48145f1a5eb27a6

SHA1
4c22c08b8cb0ba37f2601e61b198b4c2d7c8c31e

SHA256
f52716c3bad1b8d1031d0d34994d21ea47f12725d92a95a22079c29febe2bfd6

SHA512
2b29fd0da691599d9dabf1d6a44f128fa748c504944983a299a3c3f3301aa17682a177347685454fae15d68963f323964b43a719b8be4872b8ea4bf0a64d811f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6c830645ba496035128bc900d7640d6

SHA1
111cd908ae1c844a9b77637a9fd96671b9017bd9

SHA256
7d84cc743bfb92484a08636013b07fec0eb5b9be36430a4b60c77f2dc62a48d9

SHA512
9b003d37205f4bbd8fc83361e62145e7ce3eb8ff2ce5ecb4da1d6f50e00aa34f9009771e5fb8a353d760659c9cc16853aee68811a5cc9ecbc13aa4426640f16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
62d77bcf71a6a8b4ce638698e23599a4

SHA1
884e6dd5a014487bc5ef2cb4452fc16a1f06ecd8

SHA256
919e5e23d581d5922df3b2b39c2b890388e71ecc8852484d93d30e6199e78153

SHA512
60bd9bcc9f3bc82996fcdb1a04f930bfee961954d0d1d645f30de3e787e2bc9dc10dddbbd23567b5dc33d3bb2442b9e9046987b128398165b288b3342cf619a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA18D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA19F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit