Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:08
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240910-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
26ab09c95dfcedaea9e0f80f739f9a55
-
SHA1
c7f0dfa7f692c278812a285312c56050f84e3407
-
SHA256
e0149b8a8aa9b3ecdb85e92c034527ccbbfe71f866978dab53f9bd311e59a8be
-
SHA512
01f28d1b9caa43cb8a0fd198c4daa86c65714ca6c1e8ab29bf7c927c1be9eb14f31690fb0a8bc979ca1dd115e4b6889184e009c96cd91068ad33afe7e1f4a131
-
SSDEEP
3072:SNzalrBIzoyfkMY+BES09JXAnyrZalI+YQ:SNzOrSZsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91260CA1-764D-11EF-AE16-46BBF83CD43C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ef63f56386ee58addf50e7e8aa7fd09b39c89effc85c0e14922358d8c8627a34000000000e80000000020000200000008ded0a3504ceddb136852ae12fd57638224d11a551b3ab7eb7ee785f687f212620000000033df5e8f20102d37ae2fb7c47327c1a2e36a1bd036ddc5cb22bb884291003b340000000fb9490dc2d786cbfa5c10e40fb50866063f9dbdd8a91f7024f23e8b179319b2f08fdbd779bde747129eba6dda28a158a3aac1e19135771cf1f63bb259c3c748f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ae41a95a0adb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432887968" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000001c76eed90cede56f29766f449969c659636fd1e3487b04fb8900c8f0d2da8fe8000000000e8000000002000020000000a01c22101303e83d0a97839b92e475793c8517c37ca713651403f34a0661bc1090000000d8c7dc995ebc5a45f31d2cb5ce6657eaec90de604637ff57fd2287ee56f00a5ee155c0dc93c44e88dc8c0f63e44387c65d43890418c650b1913371b1d6163a54f1a51177af36a598d73f7145eb11789f6fccb12ab7a4fde6c6d98a5be19bff3e03f3ef1424189674771c336352a41c654fe116054fcf326dd2e89b225524c03e0bd957e48907c599aeb84be243b564e440000000fef0155a1050475c1a0a60ee286550129747da338e27eaa74dd2b54ca1017a26e1fff57e172fc8f33aadd2f21a2d3a8dd62ad5a8303f21892231d3c73225cdd5 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2828 2932 iexplore.exe 30 PID 2932 wrote to memory of 2828 2932 iexplore.exe 30 PID 2932 wrote to memory of 2828 2932 iexplore.exe 30 PID 2932 wrote to memory of 2828 2932 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c73c5e09b84d0e349fb9ab3778fb326b
SHA10fe052e0c9db0ce2e31dfc0a8d5f4eda0bb496b8
SHA2562a585fed8c2cf83f3c9f01438b9630e810f6b465d7fc07b420a27405e5e32673
SHA5127bb9cff335adeac81e8d32e3325b3db635909178780684df2805b62855ba26279f13ecca6a261a8123ce03e67eb0991449b5e4e5326b631ac0861727896cefb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e702eb61194096ddcdada53252d8ace9
SHA1c9fe4d05f7b938b073ac86547200c059e33fb93a
SHA2566c1b0e4c3e78bec8ebdca07cc35afbf5f09a8a79f8dd86c902d8d4621811d047
SHA512f5a5a5ebd30d6d82bde4e7fb46fdced13d0116616e784921b7ad669995f9cf5b89eee7b9d2692293b7c88d5b8a69ce10b6249a8627b5e6fabf85d7f29884bf51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f26bd4f6ab680a3d4c260d0eaec5dac0
SHA1ecfc85e39579a196dc3b2869eafbe104a9b445c9
SHA256c8d42136bc18675e4a61da493e37e0efe85c50c0d19be7ea83fd7c480287e70f
SHA51277fa4884eab621e2ef7d4773a08244fe76964d142df823284f94a0aa567cea661cc3eeef8e0a5d7405e918b0e875a03dd24fb563948bb5e5796ece84ab015872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5252aeddd945f9abf0d7a498a8e670a99
SHA12941c66b0506850a3f3727bb30ca35d2595e7da1
SHA2567b6f43349a4b997caf3bcb2fb058711c2c4eaefe5d3c9daa8e5f5d7ceb9b2dcf
SHA512c2e1c148467d0122f182ceb77f329e7becf5f1b760bab61b7bdfd54074fde65a0c0732621ba1ec4768f7dfbed0ba7ea678ca2589f53a57a19423e04671da1143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5812918bf4f81173d64d7be31758a397c
SHA134b45eab86ba01d60981923f32bc5154126b34e5
SHA256e6a7a689ad3258b8aedda00fb5212c74d8929b0a2792d7231a1c6008cd8d16d1
SHA512e8fa4a5d412587974ed85ce2869f882a14f4ff573556d58f36352fa602bff24dcad3e658d12326b0aaf1f3551de9852505cefa71a9689f1796a4da439897b66c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ab0b8e35e96a6ed9c80041d3ec650015
SHA1ea797969dd17c2983f20af48d617f62852a8f1fc
SHA256436716b22120693083094088dde6a0a8e03f4f7850b8067e4e10b5c7f658a2ca
SHA5122029e58c44de925ac922e92cf53ca8827666fb21c9ccb68ec7d8e669570fc51dcbacc369b5a3da28810c9674a0ea4ba4f4159af70278654e99354f0fac86d640
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51f97c184c5d8963f3c24e6b069369419
SHA1d575a5ddf3ea22345b4ea6894e7f9ec43db1f4ce
SHA25653c622bf5b92b00dd9caf2317118517377425a44df06a602c90acbde83694a2d
SHA5120030bd8fa9b50c4673eaa8f735145195e25cb751cd40f7ab8018d4dd6c8851768919de40a35a181f5ef0cbbc7af15e198255fec13a062ae576ecc8d6005f6c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51bab2dec0b53092825b1272a6901bf75
SHA1612d039503d4086db6f3bb314edee8e23b8aab90
SHA2561e880b89233463da5ce7f346fa2c3f253de9e27cfa89f8ba3d433b114aa17f53
SHA5120894d37d1edd1d93bd695d21cc5e49991dc799dc8fc56d95f813ff22ae5b1327c8fc6a4059577c3fedefbe996c4a9eaccbf367e5a55b7f86ea7e3e979d58ee52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f30a1360f2dc7ad0936bf7c868557a68
SHA1d35a2f7dd7468ea652edbdcd5cc0ce09363f183b
SHA256e79fa54f3cb6f54e9331da1c2b8ac6360b6ee9818f3c91a6ba5704b990649ae8
SHA5120622389129c70104a718eeae8925cc87122d4cbc6623a9924d7126675ffb98700067e6b49ad5b0d2ce9fa64caa2fd72ac9fb11485717eafd3fe72c2b28aaf8dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fa35a7c5bc8c65c256b70d7c7855baac
SHA19379cfe5af6a7c87c23968e5dd3cd11f6ffa7b11
SHA25614056a5081fce041721b9a375ccd5058c901fd84c6c3ec94894d226852485d0d
SHA512da75c68fe292ed831a20c5cba72fa13886590047f749552978c3375eb705a8db438898f8422b21ab2c90fa1dce62b4be5afe2f2a4c0d5169d697f826bd3cbaa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f50cb39550f0c61b1753e1a1b643f4c
SHA1ada5f1cab13600c753540e1590918ffbecc195f3
SHA256c0ac3c52c40f8891f424c335357976b2f7d1fa910b3558161af949c4a8801453
SHA51243a9b18a23a2d46b8f84da05874f258b57764a9855913fe9245fb549bab651c08dfb5ba350cb1cc1a06d577cd552987db1fa03ca5c69a287fb5f51edc4aa4ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a562fadf9034bff3c6d9399d40ac404
SHA19285f947d1c59d0ae2b3cabdcb27b970b63018e3
SHA2568dc52134b59173abce98c8fcdcf7e87a73e739a8c3a5a1bc7c902f095d1697d9
SHA5120398618bfd586dfebd6a54414b583586b7a5c6b01ece915a2ac3673312676bff463cd9c6116bdde3d3fd50958c9b3ed30e7f73c7f1b21a8c747885a2bdbe3f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fdd0c14dad7bf110434bfd5b62a50b79
SHA11497282a27c71f7ab94d1b3c29ccbf833ef11292
SHA256ea7a340ed18d4f1080490e527f597371a01a7e19e8d3562eabdcc753dff4e4f3
SHA512139543588a120face96f4b1273a988934f41830b45201340590a7e2e5dcbb5cc892a9544ae15b8fab64c756ad5cbeea088b9206b69ac2b38d8cca646e6aadb11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d02fa211a757a6a119fa0b0cb2e93d0d
SHA12297ffaa1f14d8071c6c3e987c661c192445bb45
SHA25666f8209b069ca7a02c9e32bb501387e7e45e6cc1b04c2487aaa6b6cf92028f2b
SHA512d29a176c917c58a86c6e1eebd2dd7a7e20f5871a33bde7ecac114c5cb05cc994725c6c12351abeca5c3da2d61b884f29c3c0cba0a81f21de3b9dcc37190940f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552dd8da4ac9978b39f82617f6c103610
SHA1acc4aa6944273cd5e1390806363b73a67557be0c
SHA256f02d1c0015ffdd48c906f1cdf79c46f0e9cff024ae3fee867de6c50153eac6d7
SHA5120632e66442c77fb2ab6cf130db606494cfc391ac33bfe439b9bc703c0f3e0340440345aa8c959c10193fbabbf23cb45449695df07b945567c62c98d1b6756e34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53753b2ae0f443f3f6cc3e54dfbb4c24e
SHA16f39dd1c19e2ed6ae955fb8ecd00b8fe92ba95df
SHA25602a55e4d2cc9f129063662b778269278d5817dd7dc6f056a2e55b912e9020143
SHA51249c09b881f135eb47c516a979152a1f63f444e4fbcb47ce01ad54170cc8927486d7a10e64dbdc2a1b6afceddc637c1cd1b0bddde4b1cf4ac2360db29d731c679
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b