723fcabbd777bced1666936f019e278501d9a2bfcca9480bfe876746028a70e2

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

221KB
MD5

40c2b18016471efa9e8b0cab8daf4241
SHA1

0f951b7dd3e2c5615be3b0a621cdc5fe021b27db
SHA256

2509dc311cc5ce475d19209bbd4e117ad19c46b32c133e1f3b4d0e5d7c8fd584
SHA512

b1b9b8e00486a72375da096e4a267909fb535dd958687bf3d0eb873356db3f98a9deb1e3c97a315868272ca530a7b3094e5a3be6b17d24cd1b71dc110f8fbf4a
SSDEEP

3072:SfDa2ro0uJgYTu/yfkMY+BES09JXAnyrZalI+YQ:SfRo59sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432923823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D0EC251-76A1-11EF-8F1B-EAF933E40231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE
2896	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2896	1964	iexplore.exe	30
PID 1964 wrote to memory of 2896	1964	iexplore.exe	30
PID 1964 wrote to memory of 2896	1964	iexplore.exe	30
PID 1964 wrote to memory of 2896	1964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8064b47593586c2c688a30c26140c0f7

SHA1
8538d3df25d935db92c1cd43bee93e125df11b5c

SHA256
805b7719ff57e96e52050ea343ded3d56f5a178c61f8fb0838ab6e1675ab168a

SHA512
8dc303e09149b7e98b86c98bebef30c22ece3ce0fb8cd8f7a23efc85429a31b7bf9c514bfe6cd7577b627f5f757eb5a1e9c599ee2152a5dfd7458fdb9460bac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
981d507577103bbd28dd585add13f0cc

SHA1
660221046470f61ff35e8169cd3ed2285110a6d3

SHA256
95d93a11cfb4069c8391ba034861f07fd39319837464a7dd2c90ed7b55836096

SHA512
aa116971a6a01241adce3f53e56e5c2bc49b620d564261b0e2dcf3116cf92a845ae4687e3e718796a71412a48d3d668c0dadbe6088cd19c2b6621be884f7b99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90f79737ccd017eda528b802c7d5c3f4

SHA1
864f414fd904ebde753c4d1f6bec660dd27c5f0f

SHA256
eb83060ddad8ed24b4d1a574d0a1efde303ab4a8485475beb73b960ca6de4328

SHA512
1035e48f08a1b7585c16680885b46ceeed4860ba78213d1da766143189fae29ab06f26d57091f2723eb48697116f2b16a89a6c807d1452ce6b4eb7d5cf4dc1b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18226cdb9c6681a6f1af64b284394a9

SHA1
f61c4b4444bb3ccefeccfd22ce0b3aa6d6670975

SHA256
38df002bbf4529ab80b9946d04b6c67c6a585d213d076e93c9f3b4add1bea04c

SHA512
4503852408e954f2f9da3744b29ed675a3f44490d77329bcc444b829aa183263dde5894e7ada60aafd6b7a309eb0e1d0f7f0b794a86a08a976a98af1e63cba88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03fb616cb6faac74d75c97aeab4055e9

SHA1
4583c5ef8bca4badb4be3302a27a0d18b8e27cae

SHA256
4b12358af3ae680e5541d1aa4a750ad4ad3c694626a56456bbbd9bd107dc167c

SHA512
9e34830e2f3eabf9dc232e0f59782f8605e422bbeb2cd90b0aa4d3461f97edc382f6f7cb5b48beb9ccd1c334921ac564d8bf84e5fa05b43c3ed0fac886201571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f50f99fcd736e9bd529ee5f423d08ec

SHA1
6b1cb8da8c50f990ab216cf76e450b91aca67e17

SHA256
761180349da307e15575d57d3092d222ac83345bf37e27fac232c0cca55d0b04

SHA512
3048eb138a6df81928ab0d204ff24f8c164dec69f59c6189867220a6c33facbae67d9735f81f2616540ee13933058e62e8be008adfb61acb7a4373dd0f07799e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eacea84ba95aa1673d31736e4b4d2822

SHA1
1a0c7955b74c7578084ba72fc8664f202e4410aa

SHA256
8d088b5c17c7f90d42435c8db38736f6191beae8afbc90cf3517d0efb770cf94

SHA512
2ebfbbb41882610ad4037ad94300c89401d8118e49dc4da2b08d7048653193ddf38b67661908430f8bb1f33e9b34f20da78d37cb2b92e22806d111ea0069f4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76c481535da46180254e3ade24c607aa

SHA1
0e11e79416c9f33e228fddb6eaddd996660161d9

SHA256
40f19c631c5e5c28cfd6113364646912d5d1ac5f8a92854b0c90a2912e2f0001

SHA512
5dc624e4ad5185b02ef635e30c7d0248bad145c3fb8fcf65d4203e69fc2c52a1356d5ed2b29bac1f01585d49f93ac3fd92a8f940fc266a9126ac0eadbf4b43a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43495bc188770047c860f13c7778f6f7

SHA1
6f012e75d9964ffe3c885a5d6956538009da2e95

SHA256
ca05fbebc54678f6bd96d27c144b8132a153c6de0e1eb27c81243892f25f8bdf

SHA512
78ae1f04444db4fcaa943da0509f1a7eab06a018deef4091cd60947861e54462e6773474b0645ca26b3f0d950848b94832ad9d184841c8049ff5c97f326dabc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
559598761d89d3f10d1f6d16ed1d24f3

SHA1
acfcd62f75cd0e8a545c7319dc956f7e5f70201c

SHA256
1f7bb226bc17d5f4ffac048ec83bc69fa1c7c4d92b8c4160fbf6198767d96226

SHA512
d3d2a3f9dd95e7131958f189a09df35c5638d52f4fbd63d210f876a4f2129d5576ff378f5905180aff4bbf37786e6669eb562f541a60e7109e5f3b1bbe3a7cfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7479dcb6ed3dfdf483f77f97db0ad44

SHA1
bdb0c182d877246b43a5fc3d5f6c51688797be48

SHA256
6fdfc136c7a9aefd0540fbe55abd5d242d067221a6703a175c9969e374aa71d2

SHA512
37e93f3fd279228d726bd3431cc55565f436419ac94e7e39252b98ba298d1968ca1b9a76c7ed9eb0f4c47a3fc2533a883c050dda33671d777499924c2a76365c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aeb313e916c3787c9f3f74a2f38de6d

SHA1
b0ef04aabe3c6c09c5ba15165d87ee27d8fc9ea6

SHA256
e4f75a3d7c4003133b4dbe09bfef2f6e7f9dd9ba4dd4087887a14049d12709e3

SHA512
dfdc1443a2559a73cd03c765710dbb5f928d836d08f58a063121477f818a106657f7d4a68c4c8ec21141993f6e8b019909808fdda6518332ce4cc8654b279711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d910b955c9f32950179af18311a570

SHA1
c1e9d5d6f63f2ed6b8f10bdaaf6c92ad13a465c1

SHA256
c605dc0115e6d3964813583d882900ed87015f4e765910f4366acc4b032a73ba

SHA512
3836adfd7c9372e958a80f0813e57e08e01df1c3576e3674647e464f99133fa589ecad295f29726399e27a77960cd21cea683ec10792ff677dbee8643a720a60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d348e5f413c0a5471dc6c83a274bea5e

SHA1
b6dd98d7b09673c0e21f0e9f969d81199f87fd2e

SHA256
d547f506b9db58b2db2d28469029b57bf113581cf4b331b16a53d46b654a9086

SHA512
218c2fe1f0832a47e34ceb2a9fe5a3edd17274ca1a01d4d196c374e52b9b85445f55282c4d5e65fb3e25d807231ef575507e0a5098b78997c882892fd33250e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641dfeae49bd1a78abba9dd4bf18ef3e

SHA1
511d3ddd551ec9e17e5ae5dff5d2e436d781fd07

SHA256
109d41f8fc1f8b63436cdb668abcbb3f3fa254ad5b7859616880678d32dafa48

SHA512
e83874a6847079e4af32d0ab644470127a0b34371b4590568aad8c228b0eabe0891d6f652945f7ff825fa38f30ce6e957dc8cde585a6b4ab842a46fee4ee519b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88327485f701a983ecea9bcbb563692b

SHA1
71c9485079076273770f4f62f19841f112972719

SHA256
513c32498c482d191e91532a8264a2078490270326b1ae11a45cee460aec9816

SHA512
1da31cdcea214ef8bea78c09b16e6b5f07058f05e74d5bc2a1834c31d03a2d59f4d249ae15224ce5946c264246fba8236d5481f82063e0fd7ea4d550b9a73187

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
836c53e20d991557613e34e2716f9c76

SHA1
3fa89ae6394072556042c9d03f95c22963e12347

SHA256
2da97176196edeb7bedadcad71456db91ceb926b9db6a79d76c998b551c950bd

SHA512
9311a3c53882f124be897b9f3013db8f338b297bd88712ef51317a75f05eaaf02d27d62d66d83207ae1d85311687180dca07acccd9a938e00cadbdb6ae0dbee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c1b75a6255f88a90267eeff687fcf92

SHA1
da0e18954e779375926fbfd4f6eacacb4e169daa

SHA256
9746ed52491a8bd612ecf9561ca219eedb69e679c470565e8980723655c3c330

SHA512
4774374896a43d5e64cccc4926f1ce88a06bb7c688317874adac6ebb8381bff48307dc670c95d994bc554922142aecddc405a9a1c6888d3f8d074bd8e9f7d760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed635f1b105e1f9e0e39304fb6f69bc2

SHA1
c0c0a46f8587f38c91430d4bb63d86b272e5f354

SHA256
14f6247c3d89109f3f67de018db6bc85d4d643fa446470b53e7f820fdbe9044d

SHA512
320d02f86113aeb10cb602178b589026ef8447962bc4a6450a86c63594b1fe489e93069d948551f7a21eb11195bf9460436b9109734ea4a72e795cf90a797168

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEEF6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit