3faa22a9e445a771b5ac15f3af9a87f816c565db5e5e39e017cad9fc689c2275

Analysis

max time kernel
137s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

221KB
MD5

9d77d7ef7b623083d6e15a2b24886c92
SHA1

12f00e3d112519b9a382de1f5739695f81005ad2
SHA256

5e8c3e5777d55ef26ca244ed3a911ebb7776c65c24c175ce716cc7bea7924bdc
SHA512

5b5290b9c285ab1e2b05cfb5b61fe2c91d8949862fa36bad465e92ade31f443c294719bb7a47c6d5beab3acacc92c52751dfb59871618a1fb7ebbf79e3839a7e
SSDEEP

3072:ShmM4gC95RnwkLyfkMY+BES09JXAnyrZalI+YQ:ShbI9gZsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432505302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A9C4571-72D2-11EF-8EF2-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3012	iexplore.exe
3012	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2728	3012	iexplore.exe	30
PID 3012 wrote to memory of 2728	3012	iexplore.exe	30
PID 3012 wrote to memory of 2728	3012	iexplore.exe	30
PID 3012 wrote to memory of 2728	3012	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a616f7ce68a1f1003abbfb1b4470100

SHA1
4372460e4ab3eb74075762cdcb257d3f3607d13f

SHA256
9d07299ef7dcbf17370c2c302d090e43154f34e41a3ebec096864e0ae46eab9e

SHA512
d5a2372f4c91a1920884a94a4dc6596b5c06c5f4b81c0b7a360c35bee8dfe2851bb77c6936d7f31a748b57eede8bc86f0ee4af5406cded4be55f81a92c6bacce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
026cbb443b9d74bb04110f3af222f21b

SHA1
fec9459358854309e07e08a3bb056a942e8e4dd6

SHA256
a199228a1e464090753c9b4b6e5f948d83ee36e8cec3257e4447294a5d7e5754

SHA512
0b6043759c8c1b8e8bf333356cc2d991ddfddf7e0d6e00908f50711650a5103c312d3a17370175b5999dcb332c887aa3fc96701ced4712c095a5a9d74b178d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
044ed513271d46901b3829cbd29c06a4

SHA1
6a06f48b1a19929d01f907b3c4ebe5e8416b1663

SHA256
6dd24089907da8c769861a3dd91647c401b48348fed3dd2f2e84e49410845675

SHA512
0a482260a43f8bdaa2cfc77811365647f9e4db39bf8d67ca54c49c9ad53285905495ac4ba09459b6f25ddf782b8fba987898b2996000f4ffa6687429b56e22e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6797764ff66fc9ed7be3a775003f1344

SHA1
eab7dfb372b1e27fe31c6568151a2b9455d30321

SHA256
1730b8d0e98575cbf02baa5301076cac7f7e8c59f784cbf67d5338fd11d6d36d

SHA512
fe76f56299cdff4a489998aa1826922b23a88a206cb7af482df7ddf3c49300eca8d6abacb919a87add8c59f6dd38de4166618143a64840c575516ab4b26fa5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34591bc9ff6de6986a9b2be4030aeff7

SHA1
8ce951b17c909c0a40de1e33510543fe248b1dfc

SHA256
acaacae49485542a29c25950b735d91cc4f5b0a6aeb15fa1f700be23ee317a0b

SHA512
db714f62f5d63e783b567e64333986c8be01cf392d74308174c96c0084f3cd9affb90c5ef0dd007081d76a37efc098f14e19e95377707ef88e7ff7b34aaf1430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5dbc016ed86ba80051210a11e7bf35b

SHA1
4876456b6d5978f7fbb2f4e4d7cb594bbc437de3

SHA256
03acbe16d7ec30c6456f81d59d43d5e3b9001982c98a88fa31248031a9268fd0

SHA512
8de7f2bb178131f7e0ca07c6ac320d96b1fb554e0d24324b119976f1dae953355b0c8114a1e7672f1f13522a8fbc330b7124d8d574cbddfbb2f3544af757805e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
584f2880c39085c4e0b4cb54b703e559

SHA1
e7268a7c00020fdee1d53072b8aea059777887f3

SHA256
990323f005f3ffe73981a278e4b24733d39e173a029eed877ad7c2aaa0a64b3a

SHA512
ef524d95d6ad81dde6f384e8fe7fe9ea4515ec493d25df2871c963df29a2293a88536f1c065b07d2f5f0e4e3039f5706d93990a56bb2b5efd1b5fef941f55b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2ecc6194d3d6ac345d81ed558140901

SHA1
884180094e51042a688338c0de14e34b7711458a

SHA256
d874909bc6117c5cb8dd605ef6e0abc1a1c38fd76c5b290512a9e97c30a6364f

SHA512
39415522758177789731aa41ec8f4c6e31d013133865735045a19c6f7c028f394fd6109f638801d2c0f530870dbc31627e64306d4cee2a2dc25f20d8f4b2f2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e52c158264847323c4baeccc977fb743

SHA1
d36844ff2b6224fac533de9b3c002f68dafd1ef9

SHA256
dffd075fce3f36a8dd788147bb721efebf5856f03213a8eebd1c11fbea0a544e

SHA512
f50c2ba049c5d27ef673626ab2a01fe271a951c19ab56cd903e7fdd5ffeef6963e3b1e747bb89030433cbf2b398022e733b3dc6b4b0aaae58bc9c287a7cf736a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48cafe3fcbef8c6cfb94e58bbdfad3c8

SHA1
36a14016bfed89db62dfa273e089e0e5d44b06ec

SHA256
8eae10091c3a923974b8b4088950e9abdcac5a1f3a771510ccf2e6af4b0167bf

SHA512
9cdd86d93487f3f7bf074da073f4f1d6a336159943e5c3622471eb2f2e5bf136bba4c070d9cb36477458c0117e638159664067fa0b93d43702ff3e9dddf55fb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
605caaffbd872a430976bafe129000dd

SHA1
e32da0d55c2a4f8eb2c666539912321aeba9dcd3

SHA256
66ec73e2b8fe0cef883519cdb02b43e853397fe5462fadaf70471cfc915a86af

SHA512
3b660b14172b77b0a9b6bc78a30c15e3e6d363f1003ed61353d5118c8571b8e81737bb25d5eb2a5d0ca59aef4fc67bf0de2a1ac740887bba649479a88f202ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3af424239e3da7afb9490d79d8a3d9e

SHA1
4db5dad6ba96ac2b3f1e3d2d3a60c4fd0fe6f485

SHA256
8e174f507002635862dceca1cdc436fb046f9073f911decfcf15d14fac3a9244

SHA512
70455ac6eac6796c6005a7b895afab59aa6f5eb00a76bd2bb7de0b4c395999d0324880af44cf5ce2c08d74d44a4e12e6a476f612ad89e788c624ae81ac527c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0da95e81cb0931003b0bac5d75d9f92

SHA1
91468bc7e1e3243beeb668259186b413d2bebcff

SHA256
ed2e2903092445cae8e38c0240bb22cb0ec7a517daf3072eea046bd47a2b61d4

SHA512
68dc180b02866cd865227e3d7da3217dd811ee7d0691cecb5cbf14178ccc291aec5bf0565e5f955b48f70e962e92f6cf116948aeeeeb19613f23a5d10339c611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cb249cb0abcbb8a9da938f96a771a0e

SHA1
044928e039b07cdc0624c7d102ba3970087e835e

SHA256
45a414ee6da863485b90294c25d77cc7c5a30f08f744f5c0c36e268ce777061a

SHA512
17ec811983405d34337dc7a605cc4fc20967bfb5d386aba891a48ad9a96eeb520f1fd652b15847dae0a92f4ad8f113ba0f768ae73b26f2fe33d0516c28a8312b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c12817248e3432d834a98995a53700dd

SHA1
721fbb077d6e917e0bfe228b82381028eb1a4e94

SHA256
41fc0e235f4f3a5b1b1ae0bcf835f34a3b3ca827a26f5ec89ce0f2d9635187c8

SHA512
f08441f03135da8cd8cb2d47935db397f7cbc06ba527d3ebf4bf4ada2e2bb0c8aa74f0b3ae15851e33341c034a66aab432134b4248c230239dad64baa08683e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
825aa398b3ebec2f85254469dcd8078a

SHA1
1027c8b000941161ee38cfa05d2f29bc5ba9cab2

SHA256
fe8b2ff32f031ba97ef4f5ef6d4a2b2dbca11aa41ef83136f4a76a703475ddcb

SHA512
a9fdb71d7437a8e1d27908fb897c237baa16c370ae890c621888910b8ce49afc52313ddb94c6c8350e8863710ab6887967afdaeb6fb9bcebe104f80e3156a19c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e2c4028bf96782838ce40afd5126b3

SHA1
bbf90c02551706ff96837f4aad1dbc7517f21d0a

SHA256
6bb252a65476f10953c77232a32307f93d902bcf65f003a509829c131fdf6517

SHA512
e77e8dffc9a518ce517d2f22eb5e0ad549ae0a5be4715f86b27f5dabc579f1a274df2abd35f2f516a4a15dfebb25a116ece2aa1ca734da10c226105f13cf702f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b37009cbe7117e05097c3f971bfece

SHA1
d3d929d3931a7f89da9de907ca5343ca80366e41

SHA256
b06a557907d8f664b1331f7dbe3522d1336131d3ccc7365c04dc566bab457162

SHA512
9b60ec107f76649a54bfb644a591da43071ff9bbee47ecdae9d125b958247907db60340dff0f6dcabd7cf586a541a08221a32095eb68848788221c28638e664b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F22.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FF2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit