d4ddf54b49b369574bf0fba91e89de862ec062a70fd6bc22ac9bca28cb8acdd1

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

77543d3f81a76af9fed66b2a35136f23
SHA1

9d8822eac3c1936f16c192c1e97514be58973b4c
SHA256

6440bb58d8708eb1a600d6367eb779f842228d89ad3ef2db590c1adc7cbe1948
SHA512

711860eacbd97fca3f48314520a9d0c0076c8de331d9c5e3486b027e245217b9184709301b6309f9cdae6bed019493e4ff49360db9e917acfde1694d0fa655ca
SSDEEP

3072:S7UMutFLpjCyfkMY+BES09JXAnyrZalI+YQ:S7ErHsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890840"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41AE5FE1-7654-11EF-85C5-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2352	2532	iexplore.exe	31
PID 2532 wrote to memory of 2352	2532	iexplore.exe	31
PID 2532 wrote to memory of 2352	2532	iexplore.exe	31
PID 2532 wrote to memory of 2352	2532	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff01018497e3edb21fb2169928fe64d

SHA1
1aa57254fb727f4d8fee3bfb31251d1e47c2e8f5

SHA256
76dbee4bb04d533be51aaebe06add8bde0ad869468474a308a31c760419c66fa

SHA512
30170484fc7fed1dea4575dac81ec02f117566dfd1bea681aa825ee00472c09c2736b3946fc625c562ce810e11f4dba28e8219ad962d9221f4f422f89f345e3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57793fd4d8ba59c03356f7f57e521302

SHA1
e5d8e971772ad31ae73b9daddbccd47dffda7c7e

SHA256
06553b5a319e1b0eb7bbbf126795a91da29a05bce27f1f9d951d6aa118f250d7

SHA512
0ff718f63da00d833dd19560f7d433ec39210c341b6b2b0d1e1628931eeafe2764cd4c8681b66edfac67d119df6a4fbfbfc722f7796c90058908e72357493e0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b12aec8517dbbc9053aa8b78114794c

SHA1
754db2a8b72bc5fe76c37ef15337c3acd3fbd779

SHA256
7dddabc985ada016eeeffa80f722d4b86b305c108de466da6e6caf3ebe2d73f9

SHA512
d7aff2e97e8631bc1a7f187dd4c35ce16e5ce9f63b55742a19c8d8fcafa63a2fa77ee05dfc852d0b4a5cebfef69ec6de3b2d94bc5418d246e49ed1a9b9cd1b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cc4f497cfdb916fb58a52ab26d0932d

SHA1
6fae67800ba621f6a6dfb326a26e284c8cbf2086

SHA256
5ce807f67d3f6cc185d9f8acac00633a4b683c5e8890a97c3c47cee551014b2c

SHA512
863cea1333ed088a37e3637452800fe703d33d67e0690bb708b91792ca78bdbecbea9d94d1b1c83a3f615cfdc2e2471ec97958737bd312609c85570e92df2c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0944052669f60d4fae308f758bec283e

SHA1
4e4bfaf25c2c4e87707bf37d7739c10ba10dadd0

SHA256
51747515b13b0e725f5d4d71820329ccf13687f5d6401b2ee2ceea0dd320f669

SHA512
41bfe2772dec3a81104c8ab332244451e45404a00fd43334977e076639909d3a95001d1aefdceb89141909e38fc5ed7e59f3f7f9a71a16ed1c15efca05046509

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12401bb3dbc07d22f5ec836d58b59b14

SHA1
2adb5912099ba94943810bb46e86f6677c40ec1f

SHA256
45237ac545eedd85fbb3866135dd0cd95c655dafca33876867adc752c8cb3821

SHA512
9f46ecd4ad2ed488c0d7260e1400112bfc867883a14d57b92947d56a8082332f3d2bee65a45139003f8278e2ad023b61f04a5ad0c80cebc135062c0dd2293beb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebcccc2f800e944713bf93b42d21c61

SHA1
9ead7377a2a59e1eb47301990e0cfc127de706dd

SHA256
b72e26fd6979e735f2039704ba66afed0441b2d12beb3808e06f7552731f443e

SHA512
6c64050880d563e3f34c06264c116fe873399c8b9a7e05882a693653e69bd04ce00bf0f50c532082b1e783856d3f2162f6961b93545fd6da9f19daa7a6039363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b38db8710134f9da4269a6a9105d18a

SHA1
b73fee6acee2da76201d9f731093a3b920475d54

SHA256
2022812d0f0a683f1c4b61a1c17744b8242fc44609b8adbce6d48223cec2c20f

SHA512
07ff9c3267dd5749e6449bf1d3474d6d5578726a7db9725aaf42a3c20ed3671fdc12848febd0d5748a4d7c5eb04b01e2251c38f30cbd2faad8b766e632f244e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fd3582ee1fa22b5b218b702fdec6c24

SHA1
bdc1c3a56070df88843a6218d856b9641244fdb9

SHA256
aff9a447d08cc2a9d175b20142ca5a2d28766e0f879708f4499b653ec36b6dad

SHA512
e6683caf158abf11c86de7b16faa8150453b48cb1b2368031fbf5d454e3186a3d06b700414620a14abaa7be55d9add00671d354f47693e24f4629112fa5fa1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c20b7f500552a56c718a257f37536f72

SHA1
19e50d883705d32b69657eb562434f7f59e6d23a

SHA256
25d72a8684dac42a8872cafc68c8774d97161302d8dcfb53381c13ea024ef473

SHA512
8aa1494da7fa25381bdfc046533f0042a8fb77346487d1d409e510165c8d81cf369eb32e89f8b572d3dacc0857e087174a14b272a13bd5a9a781c456581ff7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77515078d859e07c1d2fcfdf8121e3c9

SHA1
87cc3e75e67374776e091e3beb4736706f3a3ad4

SHA256
ca150c7b37b2ba912674d93541d31291c26bf848b84547eda18de53ae6b82203

SHA512
9d53bde52f597ed9671dcc487987caa25fe4bcc03afe630dc3f19b10e4f952b77897824ac68cdc6f0af1325431aef689d4400fc049c6aa63faee6c39e6503db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394a4fd6e9d3308fc6894c882891ec50

SHA1
6fbf3aafe4a70de4b25a376fa1ced76cc1b5a65a

SHA256
a021ace046f530e02702d951ed019ee8c77236ea96080ebdce8ad7ea56005ede

SHA512
bc6385231394a94105eb319841b981d229106105e5454b3c9be49f1fc9072829971b7e7a860f3898839a2bfd24dd9b98fd8d462368c7c1c1cec645036e370a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2de92784ac437dd02d05a9d0394cc5a3

SHA1
c248e41d812b25e4450cacd0bc1eca00b15e97e4

SHA256
3f77e980c6b99576233d7bc856f96786745e36ad993cefe5a4c8d16fad7a55a1

SHA512
66daa9ecbcfdc2295300af9d64ac9a480b893c51c69029c7ee3716486f00bfffda59d74be75735fbbd164d1664486e017862feb9bbc4225329517a6432637a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d917c281e507fc880b1a1bd1381dcb8

SHA1
129bb0540442188b79011edaa7ae5f86bad32088

SHA256
8096c8d38307bcd562bfc878013b5a882a672519749509bc88bd5f8ecb44b527

SHA512
4a73a25213721de00b13680c3d816b37fd79ce64c8dbbed93730afd376488b4b0a566d9cec1a27b3187d07be69d877f9ed35ddb55727201ca2fc90bfe6734c23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a72ea64133a91209b741f59f12bffa12

SHA1
f6c2f83dfe8a8dfba294ba3e6e2d6be2485c5902

SHA256
7d8bdddde0702f4a6a861d8ef9e5ccab6609b3cdb7d482d9b5c16d6da4075fd7

SHA512
564fce0beaf0b08823e215b7fc3ace3025719889ebe35e299821e3db39cf75d2a9ba8680f78cc7a241bccd8c94b03b1d293cab19da2c1872ed4e2e61f5464f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1eb374b372d1e7277e41dfbcc337c23

SHA1
e722ae565f429cc36807b68d482f84d232f04f5d

SHA256
e6ce791c4876ae68f67cfdd5ef3037d41a2a0859785f418d53df504325cd5426

SHA512
37cc91c61aab7839ea22f406752e672e5d42aecaf88bb0bbe84c0aae3ef3052cc29628352623c9b3b1a187797a70221063a619f1f907727f9d50e140f787d9a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16fe0521572d4690ccd66113505aeb01

SHA1
ca009e70193d08fb7f015fda7933ad4648982cef

SHA256
e7d75e0ea3fff6dc12874f21e8fb0d2a6c823115ba2ca297797166f769678b1e

SHA512
27bd090636dc560904806f25cc735c7ea9b0b38c717e8d99ec8d6751aecb5e44dcc301c53132eb4009bafdb6b215fa69a2b0eef89dac58acaed4f235e002d74a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc348502e0f9c7ad81aecc6c42689d33

SHA1
d63874784203fc211db137067ccbfc35e24c2371

SHA256
9161e6fbab4279128e6faf1a25ba3b2ecd93ba048248c47bec9df12dd5f9adfb

SHA512
12b8238a52aab6589794d974ba94e1863059f5b3edb140b0eb965ee6c1bc2d2e9eb5576d6e96815ceafce890471e9fa189ae86ac3b0b1255b18e4bd3ba4894e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCEA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCF55.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit