Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
65f141b24ade0a6053651ae51d1ed450
-
SHA1
4d9da9198b1a3e0d102cdc8f49c5e5c80de98ad3
-
SHA256
cb9317d90e0eb432a2bc30e0d19400fdd998ffa1a6037d324a648dd45b7adb5d
-
SHA512
7b53f7aee8580b905ada9cef8789034243a5531d877add8f7b36c49cef4f55a273ebf691dbfc47ad30d800c34b04639091be154e2a0eb686406d1c1d90e74e84
-
SSDEEP
3072:S4ENF09p68/V/NyfkMY+BES09JXAnyrZalI+YQ:S4Pv6ggsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432882706" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{52092EA1-7641-11EF-B221-F245C6AC432F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2104 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2104 iexplore.exe 2104 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2764 2104 iexplore.exe 30 PID 2104 wrote to memory of 2764 2104 iexplore.exe 30 PID 2104 wrote to memory of 2764 2104 iexplore.exe 30 PID 2104 wrote to memory of 2764 2104 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58bdae90c9d153e4ff0ee518af2139ab0
SHA172905e6d03535f9a4cd34853596c690e405363bf
SHA2568bb999abe5be58b5e79eeacd0031c972525990dc55d6af84ce66c83433e01a49
SHA51275e3786408d51f8099126a2f905bf69ee71c689b29407c1834dc3584c4cb270ff4dc4be169799e8a04dfef718f655ae212b78ab235965b797f7cd7f6bb983179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5783a8d18b5de1b6aea035b496733d3ab
SHA1f28c88e85deed98afc96d6db2f9c955ecf16b5b5
SHA2568a784d02a77a56f830c17d5ed5a879aabc165e4530c2163551b6bff24f198ea0
SHA512f2608ab1d326e6c3b1d83712056eee9c34e333152fc206821e26c7e2be112f8410a06d3b54fb4a55db18c479a964c2ac4719df164309d764b66eba3af2639f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a56c88a67b8529b9b8dd788b26b70059
SHA1c653b1f6c24ea1aceb39bc8aa885c7eaa72ee4b5
SHA256a749c2ad5eb3d1a9208d3c13702f57ab54ca7faace10f30ea57b343aa819a722
SHA5123429654e59a0cdf38d4d363602c83112b2106a044670fe132aaf82880f37ab329a58cebe98d2258e9913c965101f5efeaf86529ed0d96bb47173757cc8cb8824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5abfa772fe3559cfb64bd9ddd48fba6b4
SHA1ec2d28a100e1085bc2334f8de3f58aeb3b56dda7
SHA2566e7c43e63a7b7fa9f93ab06248efb9f07cad7b260f4c0324218eb4148fa9b223
SHA512f9bfbc5f24ba135aad6f5f3ceb6daa5141f7abb03fefeca2eea84ba922667ca0088e46ee5ab7c0680abbd9698d63079acf770371486813d7a2554160398a36bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5988f47569405fb8f34225b93b06ad3d9
SHA105170b4505c964c77e54bd0e50a961382894b116
SHA25671813965732bc17671cd1cc9c31951fcfce1b94b6d1804cdc99c682b6ab2101f
SHA512c0760b4f5f963e76d83cd4a0806a4af1e3139784d6b07a525cd24658bb157f30ca7659377978bc9868c98c2b702a465eb9710ec2959a544c8455fd0b25bacc89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51d037238f68deb8843e23473d375169e
SHA1bc42d29b633139822b0a2ae5cae917b362aa61cd
SHA256b1d483afc175b6b8c5d387593a240a53341e23403725e707d7492b9c9df5bce9
SHA512cc0fa893ce056d698848a439235a4e7eb12381b51ddb58e0fcc144c85aa0cb676957db0a427e48059ff9941cc0ef3d930aee1817bdb0b1d115a8644f295793c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fc5e9115b276a656f5d3abf92bc5397f
SHA18a8b8a80236563039b9b1a1bb3746519a07265cb
SHA2566f103a12b68be77b80555bab80861129678f85756807cf7761aa17bcfa7b850d
SHA51291f5a38dcc71675e60afff7257299bf95e5d9c25711400423113d50c28cdb7ce9cde6bccaceae92d79d47019ee0adddafba4c33f770e84151a4187c2b8e8ec1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51eda0c8e5de5af7720a97ab0ae271f01
SHA15b48dfc30f8ba3af899dd8a3bf82012e7bf3bd8e
SHA25657edce6b937c89611d21bd2df4c8d3dbc6bf8d0a4c7b3dc747021350d7f1dedb
SHA51233a3571b8a5ae79dfe56d1e1588a64afaf631b8490e07ad1548f596043af4d77acece8f0421e04f72b703b716b286056c00cb5a454db63d9fb8bb9ea272dfc25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd2e2407fe6a515ec9aa221489d1630a
SHA1c8fcd43c0fa22816ce89893a3598e7a88707e69d
SHA256fa7664e58d56b7c89300de664684a1e8e653273e3324488cfb435bc791c95bb1
SHA51232b4968920ba502f327e6b9317ba73a49312979b79bd22f2914cb2a3ba700915b51be19721fc47c322cf7b3b005ce7f9ff8b1047c917056910294d8e8e65f1dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53a602edf73e1edcda8924455bcb14088
SHA1ad3be9961b0bd2edecb03e5ec64f099d6a308aa4
SHA256e63a7c0f4e7e9f7c37559e0f8a49078ab108439926ba07a45c2f32987f6daaa2
SHA51204e488ff731144efba77d6d3fe737e830d88b3a32947823c202ba84fd2de8c15109c774f258078b3190300b508c6f5d50a662e1d99e6b990a97d8da09942403e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54e82ea7cc024b345ea61da9b6dc21803
SHA10e027a3e32681c0ba4fab278ece60f31b66ac872
SHA25682d8eda41b3d56d5ab5691d5000c5522024cfbed5cbff1140c96e43ff10bf8e1
SHA512d0dc1e274fbe1636c2d55e8f45c3e27e682b8b8b0057f59c134be3908a9383fd052d567b4d71e83b15e3a37c0f4d27794c09cb72557158d1a565b595a7197f81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ee22699b29f596146a77f9666b22d175
SHA1ce76aa403affe0eb6d2aae163c3cda8b5a5d3ab2
SHA256294d64aaf9a38fc1da53d3db41e9ea7360bdb03c326f23ccf37da46b72740f62
SHA512ac72c13d408f1648ce1f67bac681b015872e1cd023b2ffeffdc1af9085690b3f1f2e2b65b069fcf7460f4f583b09fa8f0371e0a78eaef727e8f574b9f6ad8b32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d26752cae6b122176cd07ad237c32f89
SHA1075a9b09873d591d6ba009b8618108230d5ab529
SHA2563b01f0b65b5377302ac5a6cc5daa627585f2756b22d36682deb7b753c734f03c
SHA51201b338f43d076e398b21d055b6995233c11509402d4260be1070e3bfb8b1cdc73eebbda1ce96fd7c1f7bc814d2614cb991761e12c97a699e4d86deca280d5976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54271bbc0300930229d9d28c01c6fd14d
SHA1f28cbc99a1c87b895c2e474fcaaa652a13edf83a
SHA25653f4306d5e1e0c64788bc6ddd8289e4d6046352aeb27cedae783a6b3090dbcec
SHA5120ccbc44d22c2eb99efa6560071a76ee0d60f617a1aac5503021d9875d37f4f7990e1a93311be4f413a01899aec581dd0e2e084622cbe1ef789f7865c8779988d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ff2055325730be2ff358d0b1a793bd4
SHA13b700d2685289409d20224c982945e00aa5d5fdb
SHA25662d7aded52a44ab2c7756bdb1e9e2637d601fb29a771f0c9ab345e57f5306d7a
SHA512b5bc4a8592a4fafbbe7185678b5e35f1bbed4a8d71450606e15d886cce70bc758112c00dc73e35549dbbe79e3e1eaae8e0d465dfdb19bce89e10e8937c691728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c14a51a74c65b2af4d357ab6f205f447
SHA19e97699d8191ce68c6a623bc63e6f169e4197113
SHA2562995731dcfe79d9595f28f5a26a98f4f6c74261ff687985cfc31aef2fe0d5b70
SHA5120e4b24a330b045c6cb903eda931301bc6df19cd98507eb418c73b3071d8f0113bb90b709cf06417ad1ed7a080b0f1ee3849f94833f4e11940248377925ed1ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b650299e7b197a8383eb5e5a08dfe056
SHA16b0b5eacfee51867a63aeb4ddcd4c53429e41988
SHA2567da55881d511eb44efc5cf0cee65778f56cecd4b4d427c43fe5d557e267255bc
SHA512be0427202cd5bf565f0c88c7a04efbe1da1bd5d6dea7d2c7a379504bba227c0b69d359fef5c272974fffbe0e660111e0b0f1c8d83192403a182011885b6f72a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56bbf439e6395b9f664c8ccb9168f1d69
SHA1a40f0a56b2b7e4fa487b73f16dc3c9370691c3df
SHA25695e75341da1a16405fd8b74902cc992834b23f20fbc43a657e41f10505821545
SHA512ebf6ed89e5c1d64f7297495ff467ae811305778b0fc738019181dc95099ba033210100352c99ea04d642c053bb7b271e6c28c7b23c5994721d1903c7960afc52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5a076be2e04f1bc5961b6871e1a0082
SHA1eb8efaaf2e3e009f34470ba4a53e7dbaf33683e8
SHA25618e31e5a55b40748ece6522f31a19e6d381ac5d7b211eee11e1d5795a3c229b9
SHA5125931d5a128de15dafa24f94ab2ade625ff39955671bb4fc9a1046aa0805e483c1f83c10c3d422109fd66e699e876376b09afa844fe9a2fdea68a54f1dd3d69b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c9d91512725ca474e447b51bfcef8f5e
SHA1533002763f15995b9c729bb0aa285aeef70e9093
SHA25623bfbcebdad2458476e81a5e91e8e0cb38a4fabcc6a5ac46af47ddff03453aee
SHA5124ec1c696587d8494c62435105a5fea6e48320cd75201d42b77b05407e75fc1769fc58b95a3fc7569b17871eceb1c92e6b5a7024776ae2e6419eef106221d77e6
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b