fe45f8f55da4eee172af73b8f1527c7362b9f8459f39250b82738bdf0ce8b7cb

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

1c62303343d34053413bdf8410c423d2
SHA1

492fd425875f8f9bef8c7e51e4eed18bbb101b0e
SHA256

e8e915a04bdd33468f1a600cb264c22b21cb5fb18741133f15c46044eb70a2cf
SHA512

34606cd9f56f14ce74674b0ec06614f2f3aa7b6ad1553faf2040067be3a33f855347122cd7c1f7cce6f210146b37bd05a84d06480ade2b8085350c6a00d96ed1
SSDEEP

3072:Sv/iDbsFndKS/uyfkMY+BES09JXAnyrZalI+YQ:SvywdzsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433449031"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E57402C1-7B67-11EF-ABA3-46BBF83CD43C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 3032	2144	iexplore.exe	31
PID 2144 wrote to memory of 3032	2144	iexplore.exe	31
PID 2144 wrote to memory of 3032	2144	iexplore.exe	31
PID 2144 wrote to memory of 3032	2144	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a16cd77c3da10cb05eca28063178791

SHA1
bbc397288d1e58b608b499101b96cf77cd675511

SHA256
3855cbcf6314f1d49ed208aa6d03fc19923b48973436dda14af5837f6838da15

SHA512
28a82f962d539d41365f738dba95a2400110676f06b12528cf20b56efe6e7a0b4f0246563563c3be6da769e43458512b8b8e625a19071f64c51c69a792b9a013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de2e3972afe0bf01dbfd073cb38d4e61

SHA1
c7ece4b26022d366591bf896976039079c0a055f

SHA256
c0d55a8030d82f5ee3fd88e9c79758fa200b0b025ef2c31e7231c08fb47cbbc5

SHA512
83518e7ceff19639b4b0970313bd7ca05808186806f2c926f9326791974b4c958582b73e8f22ea1934f0a148e4ab670efa475d9bca1f17af5dfb5a21b3b9491e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd12b4cfde674a0d87db17112079d2c3

SHA1
463ca568361dbcd014bd33f393e40a346704df75

SHA256
93ab64b78bc49fa565bc38e540d7d7521466dece613366b475315aa691356a61

SHA512
4fd793bf63cc8a80066bda1cc2e214dadd1e13520ac96d01fce57420a9f03db01db1b6d0fd97744ca6e338b290a4f69ae85890be22dfa6b51a24276281a44c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
407cffff20c2ff4040f4fc927944edb9

SHA1
cdc14fbb1d5bb70033c73a984abdb3f66469429c

SHA256
023a105cd8a99da0d78712aab61375df964e70d00b2ed9e4fa0d85a956d271e7

SHA512
8a58169a78c6b08a0598fc79f706b503af6faf050c9f15c561d48cd087d42b1dde26ddb2c6312b90e49252a2abdd2af78628e2c57c4e12f1b26f296a4ebf1658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0be7f03ef263c9aa70a5ca15f138182

SHA1
caed5cbf98a3e0c8ff627c5578357849d62afc40

SHA256
03372444d8eb4fb8f9a65cc3f26fe04262bb54ccafb225522c0d744f71d3da3e

SHA512
5f891d03d677695a73c4a10fbde5ff6678666e494fd31d9b358a2769661e208cb66a102d324eb04d4c27c28dc18a29638029c35b97d53ef18e79a7993df8ce82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8d152030af29046fc356aa453640f87

SHA1
ce9e6340ba9e47dee6c549ad2b4af5d1a4111155

SHA256
42747638e7e8f032e0af14a4760fab62535b883ea4e1eb29950551064b8e58ab

SHA512
3af1e59a8d0ae778b80e2cbad38a4f201019ca07e477d357fcc51102e38ff5cfed8cfbf760f2743845f9e0fdf05dd21820789d02b8c4d7fdb9511b0b608db864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce52b71dc59aa02c870f3a5727f04c0b

SHA1
a0757dac64fb9445c5fb5c2c3e329a5e350305d3

SHA256
842303d7fbfbc4a0bc969cd4030a9f56fad53114f1f26cbabbff545638395432

SHA512
b462d384721c340678ca61d46a858f707ae2cf6be60fd6f26f52bed2f64a9d06011d3333a8ee36adc0da96fedb5bd0a853c13bbd4881b6adcfcbed11345d9497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe991171f846ec6cb51813654d6378a

SHA1
862042982a2e90d00568f11077acaf5861d6681a

SHA256
4d3fb73b0285c922d16e0b136ea02801bb2d2c14ed085e5db0bfb22b3d208d91

SHA512
e2702f9500ab0c6ffc99b02d187bbfc545b1415d61d91af946ae5830b5b6c64049eea30da957fab275ea26dd827dc83ef6ffe31e5c2249fb17492ded3fafef01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ec36ad5d0e0d11b004284ef6c24ef46

SHA1
565392ecddd192934b0851325d7a8b0be77e1791

SHA256
310d49dac90d65ed5ecdc5d0939ca995fcd5392b4eb28dd1959995f70bd30000

SHA512
163a79d5ded726bd78b34c386ed0c3e5434771f4222560b1380cb3a8b2b316f6738935d231df0f35a8d55bfaaa4e1e320c524af19de3f0c36d98f742d3852276

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDCC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE2D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit