d5a4aa1067086e0952b4787d207522011dd3f63a716d99d4fc717ec2bcfae8ae

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

98ad531fa39767acff8fe561f93b1ca4
SHA1

d2cdb8c8cef06cdde7a1e8523bf3f7b9bd59f701
SHA256

5b988ef28acc240df4a74c4ea58e4d966faf9bba5c25f2d1ced9d88dd66d1312
SHA512

f181bd519dff9074a900b4de88348e3898f332a265bfebc5d54af811159e1786b20980ad8b9c0c5b4fb01b082758a84e6e80e29a65b3c2110329f9d3f6030c7f
SSDEEP

3072:SZfag069fCc+5yfkMY+BES09JXAnyrZalI+YQ:SZS0dAcsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A6E8B01-7827-11EF-84E7-C278C12D1CB0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433091378"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2004	iexplore.exe
2004	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3052	2004	iexplore.exe	31
PID 2004 wrote to memory of 3052	2004	iexplore.exe	31
PID 2004 wrote to memory of 3052	2004	iexplore.exe	31
PID 2004 wrote to memory of 3052	2004	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bd381bfdc19a8dd8991b04113c3facb

SHA1
6833b49ff444ac4286c91843d83d031af8ab2d26

SHA256
c37d3811bbce20f21f53e2683eaef57c0f01302f0088348adea43f502bd6517f

SHA512
7d80b5b9d4da507ffe61e6d45411ceae9372e0d48237562e5bdc6ff52eed07d2aebffd1bfb5d5da1fe2fdaf6d91a02325162e3b8e4f0a5c7684a92ed2532caae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29ad1023aae26a43e7e62bab5363fe46

SHA1
4b47aecd459aecd28314c9f6a92ecfd3dfd04eaf

SHA256
93f6a70779a7b3df5549aa44ae785de00fd3cb5fb87469aba8b2ce535a604dfb

SHA512
efb3dac5ddefb90d3ace1a7b7922adf182a867db42c9bd95b14f2032741e7c31087be19c447890164917c37dff2a315c7f6ede2733efea7cd701e09ab4ea1693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3b6e392cd766b455189e1b24c4d7528

SHA1
7e16eeb52ff0166db9277aa5514a3cb9daad4c1a

SHA256
66d29abdd4d043292991736ac17d184f413d4f18ee84d50380506062b8028bf6

SHA512
519bbffed3cfd51886c959b6f10286a3d6ce536f50b8c7190a773b9236ff38e919f22a1181a8dbb658af64f80499a881de41b42a518a19f8e29798d2a7c6c183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de449da4318cf71e08234655ddb05d47

SHA1
33926f2f5a7a122aa514fa03c37bc2f2db89965c

SHA256
2dabe49a46383072c076248c69438657960616feb10e2fed12fa0665cd95b9f1

SHA512
120510cac683ffb66b9de40bfda702bf3c6a4017d8a9b6ef3c91d1fb4cc8d0fd202f1301f2084a3e70699746a7c556cc61d842f47612658fb44e624feb814c01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f824e4ce92ccac022d02a6b42c89414

SHA1
623fac7c88af854834b4e615802c26031c3567f0

SHA256
b63fe2ff0f4577a3f7902c40fdd0e159447f50d3530be684e2d9ac8686280063

SHA512
c308bc7d923b6b0616b0e2bd3c71cc5be0552800c4e3c9845e76ebfcc4b7506bfe80c2f4d5b47b558dc09a5ec3f694b97586ad2adf9d1fd534b441319c4a4a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74d6ed41c7a4c58f2e5a9c7450ed69ec

SHA1
abcb71d3f472db1ab36b3ed3e43e6b864994e3b2

SHA256
413ed9544834d3e72ba64a8b97bb358ddcf048e8851cd1e7a42945a8613665d6

SHA512
fbfdd4ee7db3a3e76f3fb57f961944ad4e2ce0b7766b49001812c9be4808e2f224f1bff90e73f50ccba80a4143c2e55d8d00ad24a1b691999384b669635262b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8c3147462238b343f4ecde161da00ee

SHA1
663f2e46dcae822e5da5d99b231db15e204ffc66

SHA256
09bbe14b7e07464d9dac8161f8ef23d7beef82d6544632fdcf88edf6a340ad58

SHA512
0b0e3e29f3838255e5fb705b18fe41a631c69fc85e1c3ab86a73b1fbd61d97cad45165aff754a1b0b4da0ab8c739c02df64efee51b38e44acb71982d87a84bf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce513755a345936ae9a4614763da0615

SHA1
fa9fe8020a02e1c62aefdd8b282e67142f69a5cc

SHA256
02eaf10fa809db1486279a504ffb5fefc76cb5bf25d3d1192575862dc01faa83

SHA512
0cb7e10052aa9bca2f8d0071ee3281f8d38ea858afa71fee91417a339726a3fbabf6b03bc154f4d7f99327a71c1cfc5f617c57e099d4ea426ef808059862ddee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80755393e6d4d05feb7586c3d7ff33a0

SHA1
ac63cf0d9de30e0d13f6abd5dc72b553a7c4b037

SHA256
f375105191643ce51f2e8638f1d8de2d121cdfa28c1b7e9c87f351bcbe398626

SHA512
b7eafb7be0937edb2a40a35ca39128812edc3064b4a8515ea248ad0cca17c312ade707c3e47527418bcefd30fc6fe05ea5ed2a3a29632d43471bea68457bec2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dee96924ebc7054afaeae344ed617bf

SHA1
0a69517c303e9f942b52d3d065a3d9887f14092c

SHA256
97f537cdfce2f4e6876ae508a4911f819c48fdb0a57fafd99734baee06cf8529

SHA512
a6defd6f7f8d0115c48d608296eae5f1fa24a23604b3eb143d1d61594c22371365514f1dd32dfb9b2d6b816007cdc37ca25191b2e615e0908ec35c11d4b32e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57475bee0dc545d8ce06d136f1d750be

SHA1
271a63241d674fe7c3b361dcda178fe66a2b1306

SHA256
f87510666b1be71c992ac757a23398ef0320de154893c3d7656ee9b283fd9db5

SHA512
b6f59701dbcc031b68ae7488a7b716573a69173a7fcc12c680f64704914f18cb2fec8dab7a4c993fc2816ae36ebb3383c495fdaee164eb1c603ae0b4592bd4ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD960.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD992.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit