b6807c223fa6b7d03b01b64acf2bbf16e5e46d25a5044ac62d6ea88d40eaf4a4

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

d8a72a9a84819e4b2641129bfc726e11
SHA1

0a19654e47420d4ad24b24796de25010676f9464
SHA256

d1631494a97f6442ef99b2696774ce49449633b3672f87e9d02f1780bd6920a8
SHA512

850823f6a9217c2aac9e149e27d6b42e0d35efbbc64f1748696d7c57b3b4ce0b486d8ccca5f67cf7326c1a427cc5b111fed9eaf4b43cd1dd545bac2ed596a08f
SSDEEP

3072:SwrubSkySZwouyfkMY+BES09JXAnyrZalI+YQ:S6h0LsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890563"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A306A11-7653-11EF-B467-D2C9064578DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE
1704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1704	2368	iexplore.exe	30
PID 2368 wrote to memory of 1704	2368	iexplore.exe	30
PID 2368 wrote to memory of 1704	2368	iexplore.exe	30
PID 2368 wrote to memory of 1704	2368	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3c06b20c2c6a7d5f5dc32fb0e989e2f

SHA1
d040c94000a873a68d7c097a0c4ac9cfc95ee4d3

SHA256
cef212eaacf02063fa304d08790a190ab8bfa91bd19aa16412a445e8f434d46e

SHA512
ace7634c83748bde4ae7af39799f269ce679f4360e371fc3532f53d81ea64101126ea7d1f6e2ca380eae22b544d6a5fdcc284b841c48552844a40c523d4dca0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80d7812cc5770a68b23f371bd57c6399

SHA1
620ab816843ebcaafeef9ba844ce0b5964e8b32a

SHA256
6dddc4453e9c22ff3f461284185cb78ce6750288052ea8578c4d069b55d9056c

SHA512
6dd32010a0a17a678ce0caf2e934145c86bd40dec247b9016482560e4899a9f01569851a46c9c5f2e4332fe95be511b62288807ae1fdf33a01ffb68af2526f8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d978149b556775eb34dddc66c6afe11

SHA1
bad50e277717930eb4a7041d304974e87f7445fe

SHA256
5c85519ac2eafc84f0949ce8568efa90d61e8b823b364e4a17ea8b4681eb51a1

SHA512
2e3554b279efc0fa486d1654efff89a35ed3de1fd1d301e55e73637fa350ddfda1730340063794168635ffe1d71002061ac5fc05218d5a94c7fd6799f632df66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdcbe938b9a7795516320caacd0fc3f8

SHA1
fc6c1dafa29a14ea8e32e0d276d5e3000b880cc7

SHA256
78689db4f47b4e2569074bb7162b852f61f6776eeca7fbeab79c3b09e64b3b99

SHA512
da23a9779f5313b2eba46e1797cc261715cde9df6303940447dc483200d3d66f44692a3dd3ae6b95002d0d807d4f440f753ee38513e1ca3691790b80d31cf1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e749de2429b70b916209234f730ea227

SHA1
8d2ff974c302b363adbbdf9ae42897ae5cc59c22

SHA256
85f7c9dd878ba805c5f6467a833126c2ca554f3ee6510d9dcb1b75f42d4d5062

SHA512
93ee37b945d14c3995c78fd2e37258eeee32de0e59f675e700bf32a14c45e1ed1e10c945687ca0574b319e8d7aaee1a06b0b58be74f6db7c44ddc8231f5c98b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f78f08f71304c413841823ca06722286

SHA1
d34d5d5b0494fce0340e6d8bb0d8d3bb846ab827

SHA256
30b1089f2d82bd4a16f7e121bce7e2f1b7e02ee9cc302300648fad70c73f0bdc

SHA512
adad3f5cb2b6c556acdb49168a0bf91b2fd88df1948f8983deab0413632e53af0ed24868e361fdeec3c91a33b73b74179e2cdd737918467d56e843def831c119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc5221f43c684c9cbca7420efe9f4710

SHA1
e3c5d2c01266b88a14043fcdd8392340816a6d38

SHA256
50b86a486dbfbd268a9e1b964042948996928308a4a21d34808930a965be3d06

SHA512
d6ad92ff40624e7753795df7a2dd2fe43365dca992c7fa84ce77edde9f5fa7a6d2281c6b231aa7abf5ce66ef2f896981c93789e332149c5e2e37138530a3a34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bd5a68471b9adf820809b850c638ad7

SHA1
420b90fbeb64dd0a7ed1158eb3474870b60fbf06

SHA256
da83584c49d728f2eb088dbf3c562f7534bdfcc0886d76d821dbe34e9a3ca432

SHA512
6328fa31f1aea37b931a32c906b8772f2ba130dfd9add3b577736c5baacb944399e3ea891bd8bf83e1e84b745d9b4de892f7f3ace08f3e39b4d755acab241c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c032fa56ddbf2f43468bdcd64d35506f

SHA1
0fa4fea87ee867d6f152184160c4f4195034387f

SHA256
c1f94cf6a6de83ba8c979bc7931fe75b8803129a7c2f070edde02229708d5553

SHA512
446127398d150578a178a22805361be16d8489f9c68ca9b42e7cce59f4aec80c7c62de3c1708b308d28f35e72e19df3b670ebaa8e3434fc3d82d02ccffe790de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986330b320f2c0db9b495e88392e35f9

SHA1
ca1b8d88ebbc0070db547d5c5f75358b6b05aeef

SHA256
6f30d1e7ad2ce0cf6795cbdb2980ca68303fb0837b6a0d8c39b2049bc0ebd00d

SHA512
ad2d3310275168590a96d3dca1d345712ab0d87d1db505ca300afca0e223bc116a4d89de0d76a9585781ee2ad035ae6b0ffd93e6653a2ad19c59b81d0d4260ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e61f36be7ee3555936b3d63d68185e3

SHA1
f34163c2faeb104474fab8e22bbb3c61cb49c879

SHA256
78b6bfd831a33d95670f2d1494e4fe655df89ddd1bf2baa113d4951f221a4d4f

SHA512
d09f604e3a4c47d4b4d733f8977bfb9e642827fe2f170ba391fe9576b72427f3c5fafcd7cb003ec86ce89ce11f01d7a01712d5de6674c375f1c061bfa1c05a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b814cdd57245a4a777dde5621646845

SHA1
7726d39faa3b68595a75f13a094132aab7137d78

SHA256
8b7b9c5bef4c5771cbc3a737cfa7a1216a25a1a84cccc840fc22e9428e2edbb4

SHA512
6d10e4ac81c0136c2b5080a415f277357561840632ce92cfbb5be9132143ac5c0b23eb42b89714a368533b4ee5902f6f7cae4278b8e2c8e6f160540d05c8aefe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB57C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB62A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit