36b2facbd05e32f053c412a855ec11a73a2ca020013a334038c42c6f1b26af40

Analysis

max time kernel
137s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

cbc6c0a17508af9e76cadcf579766393
SHA1

87f94105c5bc83102e63ba7b962580015c5b14b7
SHA256

0c50e98e69c21dbf6f877c1c17b905085aed7b87200a633174e6e77d2b4ed7c8
SHA512

21599daea468a6b4073f3c52c82d8a0fcd5b75377ad808488b090981def91e20dc3def4b0ed3617191aa25ca144625195d17b352f901b27b8224767ef39020b2
SSDEEP

3072:SOtZcf8U+Iqr7YyfkMY+BES09JXAnyrZalI+YQ:SOe6VsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432887607"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BAAB6EE1-764C-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2516	2988	iexplore.exe	30
PID 2988 wrote to memory of 2516	2988	iexplore.exe	30
PID 2988 wrote to memory of 2516	2988	iexplore.exe	30
PID 2988 wrote to memory of 2516	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc190b0ff6efd7b5e71ce347bcacde0d

SHA1
15aeba7ce046eb60fb72e01b3a7dab8d75c6f4bf

SHA256
1db64471d4eb229856a9508042fffbb4134473dc4a414de2c9fad4eae5d85985

SHA512
054d8f030c4b0588cbb8144ba0d256932e818c9c9fce0baa11fc597c91b228d1732e779a4a018ec6e02dc1864c86b1af3bd17ef13709c541db1a5a6cd48e9558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
326b66be3df191cd271c5cdb88c7fbdf

SHA1
534d0ab59465133ab68a278cffaeb6cc2b2a18fe

SHA256
f88eeb3bf1dee1d4607df177401177738c6c4893138562f6b78077c38de7efdd

SHA512
333b6d7b8bb4141985a0adbe64f87848ffe04df44f6923648696d39b6b8563ee6e149824fbd88e06cf4cfd9a785684dc1423e2e126194b7325962fdca386a801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34b5985194ad165059bb2da7513eae3b

SHA1
01457f86373cfdee86516d29f99c9af3d822d1fa

SHA256
d9eb3a834c5bbc6b4b407892726879c66fb5bba9f0d463626d850302dd5c876e

SHA512
9d484834372a1e30df2a7824cfe79251e9cb46a54ff4a84af1129ceddb820cc50bdf3fd0d8f7f7695ed31272f91497e3c4801a3dee439f8575eef43b38e97e6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a831d96d18d8c0a9f069229e41cd892

SHA1
fb59f785ff5fb794829d46001df58faa73f2f133

SHA256
72f0ae8632fbb43a84eae9312873509c9e0643f740d6431a6e16dd59b03d6bc7

SHA512
5da0980ca93a0a5871bf2a27cfb4501b377bbf315e81a0ae9a1a72dcef626b661148e2128c246fe67e2dcfb4d8052b40b3a7f1b49f988892f238b5f912ba58e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3dc2a91ad50a936bfeffd22b6cc9008

SHA1
51fef4788b2c187793fca0fff61300270015f6f9

SHA256
9f02cf65382f97e788b8c888b999397c3742b528d7b2f1c34e67ee346f8c433f

SHA512
013f47d1757efe9521374ad0f15cc8b7c4ec6ed43a5f85d068d490b2c49affdd88f8d2400be9a27498c21406f8c679d46a5b5137afe1ffef8c62722960cb544e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a729d435a88f0fdd2602c3470c7b4e33

SHA1
465a4dea05bf9bb1f86b274d45b7039e342c7910

SHA256
de1c5f4c4fc53a45d41d609fb9cdf84417a3bc9e1fb0561b802c4c5fa0fa8651

SHA512
b2e8203126779318f8d659d76f46043aaa293dc34f3b5e53e0e581987354489496d4ba23c17cc6c32fcfba3a486925ad389c7103bfc12a37547db6bfa9abc092

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2da63bd23f71dbba503e639b0a853ddb

SHA1
3a29511d932a4c991db615ca95b78d600a6a88ce

SHA256
24834cf7e86b28c79d1080ba4a9b91caede94e992025c1a6b0d6329c3411119b

SHA512
002ac9eba115f48b14adc011f5519fe2fa75905ba1dea3ff094dd081ab97a1b9d9b1ed7da27b49694036fff71cd8d2a4880dbf083e229c4d0c44c6dc6d615ee4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e69e9d8c96f8424c38f04034a1c345ea

SHA1
e5be056f88dce962cdacb0904f61d83aa0fbbfdb

SHA256
f9bcc0b3678f8f78a3039b27f22c1ac929dccb8af9a85d96cfe77361fa624637

SHA512
e30c4e32e56a0dfc71de0c8ad085fdb1cd66c4fb47179e01378b10f7b41d7a247c62816315e9d74c85a030393ec1031703946132479f916c32bb87eb043836e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80c60b32635c1a7a22071935a6680766

SHA1
3310cb5cd2fc0819ddf9ef0dbd6ed1cc6f8d0527

SHA256
1c1de39002a830bf60bd236034ef93f7b6a7de1f95c005cf9747b86ed85147b7

SHA512
07428c639072039867e9b022eec4c5fe74c7a43792694b31c275ff7dee129e6787b491271eda0874fd26f5cc9589773d63da200d92b46b4d403898712402dfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13775bca4bd28fe9906445e7cac0846d

SHA1
d1e6e21f719998d7178a755425695a19a1ba314c

SHA256
28d25f0dfc299b27dd86af38513fb11fbe736a7b3ceaefce759b9c0bf9c7bcb4

SHA512
cf0e260d6a3dafbd1a2516eddd8a0d35ba12a3330f020a8494da685821e875ee7593d60e01c5dd92219d5f67c1f17a25c6b9e1a9cc87f023af5ae40bf126538b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c3039726b8e8590eb5ec42dbe003feb

SHA1
ae52f15d24ff4e29c3e753fa6ad546fd178c081f

SHA256
5786d147f4b737675752bf57ed46dfabefd5c324ce8615305333178eefe04a89

SHA512
6301e82c5da607362bbc95e3692deab049c6576f4f8c8a982a1136da9f0b9672f59c0d3976df48d242ab0167be4e2c99602b60a05abe1350ebabf86a385a8b36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff44930f0ffa802d01b36c9e0933ebe

SHA1
f6e4737db8d167e79ad7fd783c67aa84e0268eb6

SHA256
70ed9fd5e8def5bc6126b96daf315613372e688db9f0684519bbc458256e5366

SHA512
a1698b3b7fe52e1d6bb4dd59a1d29268dcdd9cfcf6feed4d4fee52b4d6088ffa89ebfc56296dc50afd6fe900012ca9b9cee3a39b50f0ffe703c5a634065c58ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
744f4009a218a936ab502d270f8520c1

SHA1
5c5ce5677f00c7ebc511be32317687ca833c85f4

SHA256
8fe3a7561a4ac6f7ab1d783226e99a7af223be7b0332e8594551630440457237

SHA512
9405712436fbb7b5dc5582ab639662ed538039f792a4dc8a6a424cabc6bf4eee7d149802a02e64402a18e76062ed33dc8fbc51acf09235d1d9a7b2a1f57ff4a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b578aef9a3e4a39afdc8e7fea4c0d73a

SHA1
a5fc03a6fda09d46d9a713211106212fe4e1c22b

SHA256
5e98955cfc25d3de48c8ef5aae8f32e0a9622e699944539e50322774efa2323c

SHA512
073e2dfedfa8994915a902a37d2e5c0bbc7be76a4016664929eb1adc1f043758afaddb679eacc10b088cb61e2b8e230419a51ce11ee9a12de968af5362480280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3761359798a485dea32857cb8faa69b8

SHA1
1a5abbf35de4d44070da91db0463a018c341dbea

SHA256
1d2eaee005ccbfeadcec709fac8f8d1d9fc757559314724ebdfdcc07aa1ff746

SHA512
2e030125d22ab565eec47f235759352ec2532dadd48d7a6dea55b97eaf187eb9f73c0c0e36fe50a3fe73e85dc5168b9e06b9ed3f319a360c667ad2bf8813e921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74a3c483cfe3fb644af66c680f05e344

SHA1
817b45e94f80c727abfd3fe9bca6214b3db475c6

SHA256
7e6e6a1b151fb0e1f92e1b1b869cd182cb1a7611ab8530ebee968c523cba8657

SHA512
db306ebf8538cfb2fe4ccb73e3939eb6ddb8b7d75a542c41e917b93dc215dfd4be38ddb270ebfa1e2de751cc4d585077a41e73a2d21047fd10ea994341342d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
715577a159a82b986a901f07028ccc7e

SHA1
5f6b72b4012606691aa32f329f9db4c38bb80471

SHA256
8edbef940fe5a99fabb6c1efba6225666cd6529f68ed122a6e359015fd06ae66

SHA512
fe3f6b4e75353597b0e2643245592e2fb532488a92128e991e0f00f2e81bdbfb0148cf4886442ffd6c478efb06ab98196a8cb2753ce172a3c97b34660718c1e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26454a294099bab4da4a057c0c86e033

SHA1
710faec7726a2d64394ab7e539e7238247a9f920

SHA256
5319f4a0ed967930ae0b17776a77e11fb6438e503c4354a3f1d26e3c6aa2e981

SHA512
76366390651f23c4422e3c256299a939606b6228c81c91e8d3980a1e9498a0a2396158240d622e3550f5e45c749383d1ae7974941b9f317852c7a2b02f007543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a20577a9c2f6536f1a0e6a094ff8b168

SHA1
bcafd382bb4915577a4619aeba45a0b3aa8139e9

SHA256
a5fa0769818bc4712789b0b7403cadbfdfcdf6cf957df7a0ff2f8396616a14cb

SHA512
5044ca170885003ac92e067542266aeac9e482941acf3c2b06266964c67b1f496c327e5b9e52f176ca53640e1cdee7ea8409dec75953977945271c5d135f8ae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFCF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB08F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit