Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
dbf96b372530bfdba5b4586bd2dbb641
-
SHA1
080d2272065940926e8bb1e407c4ef5f31f2cc6e
-
SHA256
162736aba44fe337fed559603de0c712c5c94cd8e90d2286d976d8fa1e02126b
-
SHA512
edb8b9e2c44716f35bf0d99b78de25c7dc8baf89c733b59dbacbadaece3263907664785317f36e1f6e10d0d79709e01a094946ab5b7ecbb372474bbc078f59a0
-
SSDEEP
3072:SnXUJeyagfD7GOLAk2W6RqcHAN8Vrb+DH+WYltudBJWWAQoNyfkMY+BES09JXAnZ:SOBKYsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432919488" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F54553A1-7696-11EF-9EEF-FA57F1690589} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1976 iexplore.exe 1976 iexplore.exe 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE 2784 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2784 1976 iexplore.exe 30 PID 1976 wrote to memory of 2784 1976 iexplore.exe 30 PID 1976 wrote to memory of 2784 1976 iexplore.exe 30 PID 1976 wrote to memory of 2784 1976 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538a7c5f21ca7d13033a93899ad176959
SHA11509cb9cfb577943d1a3dacd3f0628e8026e1f83
SHA25605fd485a0d1f3c0bc885fd6139c099d9d2c0bad8257aee173693c201a34eb3f2
SHA512d7815ebbde0b9d07901ac319626080532357ee9692b5a441d7ad6fce4fab7c6c18260debe6711ba6e074c11702eb64ba9b4826c6d60ede56d1a826bb65a7a1df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51add4f10cac2894233024f3ff835abfc
SHA1e7071c6c4862ea7b4f8aaf3b86c24fa71a342a90
SHA25691c0f42ee23d53843f59c112c8e558a402dd8db0fa6fd06571c2d98a7e3d7146
SHA5124b943b093328a6e5593c5ade47c4350015685cac473e9a82810c201836ade4fec20ed23b0fdb1d283702324143a6e181fad3053e7fa90454819d797ea97df706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6c0a158dda06f281726c96cfadf621f
SHA127abc5670dd31fe02d6a17f12b36b3c7b281d573
SHA25684abcbb9acff2308bf6c3ad74fd8751324c27e420a32f08f6bf69ef51578a20d
SHA51265e2c95c228a11591c4df0fdb7606180cfa551376793cd63dcb29b7b22757668f6044a92911b11a03be05190d129157a22ec637dd46223242bf7f35170734983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52cc19cdb1989f381e350a11cb209ecf4
SHA131b5888cfd711cff5f68b96404be897c6099daab
SHA2560493339d929259e60164edba54c3acd8010274fc780ceffd8df4f17599eb9aea
SHA51248440d3d1f8ba61dc7e5f44aec418d1e9643dfd9ebbb977988c2b87648aba10885f0f7fa963b3f440c3a01b7b97c067465e49cfb9edcc9be02b5d6238ef572a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d050b6bdce243456b92a38fa329ef3ca
SHA14165ce6e64ed07e373349135c6aff1b96f19a127
SHA2565f77a7f92873e514e13a251d464f65d8cd27a2791a0238df8123561ee02ce201
SHA51208dd6659265119a6815a46837db8099afd2b58b68a80b1df80ab305035b955e25c9d558c8374197f13d4f0aee7d9ac7f115ed4d252ca9143c650f3297bf06f92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5496934b56371fc81b4c1f8ab9565bbde
SHA1535a2e206a7155a19ad64dde3a1f0e5ba4eb7bfb
SHA25627c7229ac0b95ede2dfa98e3b73ef1843960b9aa1cd66c1aa36e2eaf8564603e
SHA51299d958984cc7e36aa8df482ce2ccead5ae8dff40581fd76fa9094d91455a3a0173a1cdda72967e187ae6cc9e42d250e255ee847f3c27cb4caa24d84981f41315
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53fdd5b67e928e41b43dfb9b1469d3d1a
SHA1f211643e905f2937f5efc7f74290670e4604ee55
SHA2565dff929cec8e188b4487635e1e092edf4b42c438bbabfcf8e2e9993fb4dfb8ac
SHA51282e70c5896b631e024c7600f8b48d146c28ca547ba36d650188d60186fb659f0d63dee16f9de2b4db61194b1cd6b2cffa9fc1224148c19d9dc25eca1c449e1a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c82cf9a8a0ccbf4af8d4d7b461f516f7
SHA11787b8153808ab51a64bddd2c0e26b58facde4e4
SHA256982463fc6e0f07cc0b7b8cc49355eef0553deafd8fc2fa16e230055ef55c195a
SHA51222434e4e0301f290d78fcb44fc3ac31e2eecf065967ceefe62650f1ce45a209ab0075f49415aaaf00e6179ecd2d3c00cec7618879f99932cce2c9c9f288ec6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52585cb144c1bb237aa1ac9acb5a4edfe
SHA1c4ead40b9deb808851a42b6e5525e15c95cfacfc
SHA2564223dc1311c769e69857f70bdd587d1031827bb99a5158327d17b17710479ad0
SHA512e5953813225d24b07bf5b98d48b40adb686a8f02f063b3ff54378fff9d6e00296f81b7928ffa4f452ebda62d6a9f3c150a6d327e5213ef8c06c1c4013ecf4a9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505fc4be231ac1e995ffef379945e989c
SHA17b3bb67714a172871aed77ccf33acc47ffc19098
SHA256fdb3ff56bf314c9bf9effde8a79504d60f7c59a62a9160734c1e814ad8c3f6c3
SHA512002af3b751e4ab4ee36a0425f411638586c1d3cf735af8a1f15dbe03dcd85ef278c24c02ecc46e7b93c8fcbc5910d76b4e8000bf75506994a073b65030cff816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD553526a1b455bfb4bc2e3eadec3f54045
SHA1effbc1e05ed5fde460acb96e351c90e9e000c973
SHA2564f42109de6d1ae17f90975c0867f398a4a724c304fbab6fdfebbb35221fd5d1f
SHA512d03bd6b5c32b91e6e75b6ccdfb8c727bf585d22f10e9f5d35fc028bfe9774d5b188c516eec07722c9d43bd4106bfd52d178a1d1e357e5074afe91f7fd8268c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56e9e072a0d47fec1ef7f28662c0afad5
SHA1833176326fcc1b00c1429be6aa3c4b56520ab4ea
SHA2568bdee1273733dbc2372de1b194b4c4df516c2630f09706c6ac8217812b7881d3
SHA5120f11443981741cb6bd3c3363e1849fc7923f446e90516acc12ede176a8d4abff55851ca640615e2bd187fc5cd8be895e45b062d09d6145c2bf83c5eb33d942f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521f758108455845ff22255d50426ca81
SHA13ce70f4f6cc230131693c1c406770357419f07ea
SHA2561bddd9c2385af56dd61fd1955bfd9eab751ac47477457c54214f7c04402bd0da
SHA5127eb9ac0560d7ad3776dfb04f2844c3ff23ab185104f1662b802d3fd94b90cfd69a4111a6ec6e43d15217466eac006e22e9318c6462ea3685461cf6983299aaa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59e416cd4c5b32653ea504d5872f53102
SHA19ac320bb4f402aacb5fbeaaebbe7400b431b858c
SHA256582276c1bdba925c0ecaed5f15726091c045b9265f91fdb371531e299a440669
SHA51273f0e6b54a060a007677937e6987a4125921872d2b4883a0f7e0e8715b134e3cc6d91cd9d5959ea8586c9c20bfded098758fc879f4087470e3b00628f6000abb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf7085beee3283d55b66ada6171f2d5c
SHA165d2b5f8c8f2fe7c6021924da04dae734db84f56
SHA25668fd4b7089928b4c2092131ca61d47461c369612780fa674f3f8a6e84594e163
SHA51201af22aa0d1ce9d3505c20a85216b15f13622d5016af2497e91fabd9948ee4c69eec76d0598775bbe7c30fb9fe79e7c8494dafc646484875d5bd4f140ea0b631
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1dc77ea61b35e46d33463336695e6ae
SHA12a5aa2a67fedb3631076207d2301745bef6fc15e
SHA256895540f381740b2c528db4414af0e2155d0425e09312e0dc62f9ba31c25b67fc
SHA512d89256ab6f5fd0e7459218b64bcd5d134e1e3aa6c26fbf2b5b7ba403a9ae89f841a8803d8205591267fa7d15c73344ac54e85b7ab3c0243aac9c2cd9d43c8db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c1686dc46dfd4395366d90d1d1c7e6d
SHA1e2d0a108652e236519c9179521b55ae68c81f3ce
SHA2569868eb2d97087412ce0598df097c0ed3311feaa9766996c6a6c781993d8d3062
SHA51271d5b0729e451409e7f635a72b469ee5afa8aacec24f2b01f3ee70e99959fd2c6dfa4b246fc14ae38a77abfffa808033d8ff69055015751d71c395b02ac5ace0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c6ddf4620b091c30193c9989582bd104
SHA1ab4729af94d522e17ebd66963d4237f8dc6cfb0a
SHA256557b46d5f112620d81353a4467a6d03cfb35937c85f808bd385e1095ec9fcdcc
SHA5120940d89f306c845d3155bd95b077f8cfb16e59228e9f1fa9412a5a489327dbbbb13737266bb7d5fc1654fef62a5512277b2b32b19687a53273aba3568ea50318
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD544944aa575349fb6dc53f7bb33c098c4
SHA19a217abc2ba22c1df2a0faf39cee83340837efef
SHA256550a0828403756f090ccb537c35079822bbe96332a0d9c6737a2f2b802737a40
SHA512f32c73524a65d93c241a344e3510a437254f414717f82481987edb11e69635dc7a732e78d86e23573fe636596c5948d697e87ab02ab2bcd441b0297a1a0bd5df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5101b238f09be475170c7df255ad55864
SHA14d7b3d72da1112062f4847329eaaae6aa5d7afac
SHA256f282262012ee6a980436831647421a1d5aca543fb09fdc0306794d680e38802f
SHA51250d4922a47972d4fb2cc1ef844d4e82ac1dbbe7d5dbd5903c5b1b81b647d0292f80ca2b75a439c348c8884b403d9d6704f553a885892201c906e0cb82970a887
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b