db9597cf2a22324f5354f378d6417c1f7bbaedd9fe0b8fe01fd9d491b810d629

Analysis

max time kernel
136s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

a2add16dc04b0de361f53cb9e08a5df7
SHA1

bb3db4e3b29086ee31713f67457a231ec0ac6fc9
SHA256

a766e237e9d060b4ea9e51f8967a06445eb4783a4498b27c9474e48985e5374f
SHA512

764663db2a9525a27ae1a13c2b73510d121f5fb2e44b265a4d2ee17abec13ed759bc9f3679c274550e3f4e207406b3cf58200153ff48c5470f9dd32d1f3b4021
SSDEEP

3072:SDEzWMT9iIK8yfkMY+BES09JXAnyrZalI+YQ:SDaHusMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D315181-7DED-11EF-9E7F-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433726311"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1852	iexplore.exe
1852	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2536	1852	iexplore.exe	31
PID 1852 wrote to memory of 2536	1852	iexplore.exe	31
PID 1852 wrote to memory of 2536	1852	iexplore.exe	31
PID 1852 wrote to memory of 2536	1852	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec907d7c7d0411bb885bf1898ed2712

SHA1
af95be31fff0ef903152e794f986fee47ddabb32

SHA256
e6e284bb2f44c183d070d152b741d02cc3584b6ffd232b5e46ec86905b57c6f3

SHA512
93d84ba0655cbaed6a78138bf542df99506cecf8bd6fe232b618f72d2db750b88d044b76864dad753b2781349f45676cc265a18326ed116fa49e0ca630cc9d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
810b8dca7a65a2a8ab1b480f4a443552

SHA1
5be975b9db46d6a2b8d1a5bb4342c88368525323

SHA256
6b19e1e50728ea16885b2c6e882cfe20356f9cf9c3e8ca41c2f322e1131d51b0

SHA512
2fce9fdfa69bd7e537c332687cbfe3c4d842b657a81149a534b2ae33f204c1bfe2413300b69467344ad5fa1af07755ac792ab0bb652812411fab2b8fd4c6ca32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445cde8182f14b9e8a7ee9d414fc0a31

SHA1
633f2dc5ae787f34b97773963a10dcff5c3874ef

SHA256
870b7a3f6d68c5596b212deb351292dd96317022322617cda660f774048ceec4

SHA512
bcab18e4fa0c55d8bfc1f0f6ac12f4b361d2001c621cbfb276131c079592795ce960f6439ccc06492f09a19346d98158afae26ca356a81bb096db36e93397df1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad9c32b85d8e0b0c424f4ec13d560eb6

SHA1
23ff08ba3e9124545d5f705b7741a8c6c4000a21

SHA256
c8220a5509de14f32c9bc7aaa10cae9ae79f9f9bd62a8c9d5631b2ea6edebffc

SHA512
2ab4f6ba4205b368d3d652c738fae1178748d7f662fd69119e36b5fb862ac26bb8ed9f818eaae518fac39b9c86e95775ee901f0b37de2bdccacffa462a793a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02fe27ddc31065f3623169616eff77e6

SHA1
2db018f5d8bcf84c64d80c6467587f6be73f7f76

SHA256
236697b4e26c25362ad7d1f152c9a09aa51421590b878c746b1c6ae19c2b2258

SHA512
4ed189a9f7335c51bd0acaea69c1a2e7b748d5e026591f0fe3bb3d228b22c5f51034fca78d60cf0cb240012cb0fd3af3f0b07df9541b68a3aeff9e45f7b4238b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccbe92b845bdecedfd1a5421b57f60f

SHA1
610e1ade1a23ed9abb877d98e2d42006f762a4bc

SHA256
8e94186e1f855ee3aad6f06a0af1064ab04bb195586cc13ef310c3a46c2d0bf2

SHA512
cc8ac2a60a38375c74b4dd35cda4a5726f0925bbcc22721de48f2dd2554ab7c47b65fca92d8f453648a5fcf33f91f871a351b5f0d6ac06b2b00e75fcf61c6347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b91c9faa3240004cc44e3636400fe610

SHA1
a269924d0e21becac1725ea67dd932b888a654fe

SHA256
71b63c41cea1c1ca2ec00ba238e52ffe21d9e5beb049836f3abecc1f8d4be6c5

SHA512
731557e050a251ac57a421429a5317ae1fc54bf3916e6ba0dbd9a5baef8308c7d7866f4f11b59aebab07ff83e966e32291505ccd71a23b6a23bdb3455f2b24c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d13aa942d228b456d1e59ebe9d09850

SHA1
09e63437127229041587a030b349294c206fe621

SHA256
fa2598519c6e517e13772a275870ee8b9cc70e9706b36048dd5d3360cbb1357d

SHA512
1cc30fd6ea38fc72a37a71aa55bb8264e087b1f31ecb7f52e3ce502624390aed6fb80307752898782e275345527a1b87841c62c3e797370a416b7facd61d2a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00316e88f69648cea8333fc2d16e2e9f

SHA1
5b7f8803b3cb374f0cd09a419a276fd951db6ad5

SHA256
44b26ca76b75dcb111f3266470efb3897e0244d5ced7f31e16520053aed3b4f4

SHA512
48f566afb95bdf55ef23d82fa8ce4281e0896405ec0db7c99d19073b6927db7bc49288f8f1997c11394a1f6e67179578d60b1eed6ca3bdbdcf0ad3e557f71b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d543674df8486bf70a1ae213ffa6239

SHA1
ca00f1b5eef2af55904fc2287850ecb88fcdbeb0

SHA256
16b5bf19b19a03fb502a7284624f3e6acef55e82b1b9da3463c8c564b3d533c2

SHA512
e44b5d8bcc4071816c1cbe47c14c99f06b26d44ed72a56a4270380221f410691fa90587b984bf0ae132c26137b9afcece2cedea242e4c6e5dc1f43e89a763add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dcb166481672602a00e7d4cc205e761

SHA1
34b875938ea51d4e6beed7c5488cc2026b9a0155

SHA256
48acc83bc3648a15091c77f2252992c72f8e7edb390295cf20543ed8cc98d082

SHA512
e6866febedf4306bcb4145be9b7ac276bd8a24c855d3aef34292aa8ad5b2de3cbdea05a34a6b08b30e620dd6154caa1f0f5abcd1f429b5403bc069e87d300152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a62f47688a785349110681ef737b7eb

SHA1
7e75202dcade8cdf2a6ad4219f956bd29b815e8d

SHA256
041f244e1239a2de41ecbfec33eb8e608bc2b8e0a92008c3b470b4815c155ed2

SHA512
8badc345eed08760fad84005f55daea958797d913652a068ac5fb12f62aeaea36dd6bc988ac7e23b459c4030b721712d2c0d5e51a529b84b1d2fe55dba7b61f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a0f06db4545a379f736478651ab3af

SHA1
0b69a4b9d10401213ca61e501065bb0b62982860

SHA256
c30f5c875f5b337830a20139fa6866a9df374bc4662809ff0cba23a421ef8491

SHA512
329c338b6c2554dbc81e5eee76a395a9607d7ae7b70dc465fde2770395077013a5798873628b82d77ad27d95ab79d9b0f02b9ee3ef51c7b4333b3770989d29f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2445c89e1bc5d261e16479d90dc6cc39

SHA1
57cbb33e0b8a58a685b09e2c8f691f03577b084e

SHA256
fb40183991ef78ebd5b5dc5137b36fbdc0d5cd49fa20891fe1c42b3fe8e9d25b

SHA512
6f0d03ea7b5ecc615de781280f6a6cea44cad5ad9a90f9bbb1f304981ae748fa26dd070681d3353d2a9d36aee1149fc5fe6262a7a51bb03270b6c01f7c916762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f92192b6d529f7e0ad6b171b57f2d8b9

SHA1
b91f1ed8394ac3f657471911e91c219ab7c55ad1

SHA256
224c2627b4a99f39e2ad0bbb50493791819726cfa4581c0d5a097b86a9b50d13

SHA512
f30171b964d346dc2ef59342638a72bb40029138586c3b17a99ad4b02c96348378929d05e8bf481d481bd0fa101fb6e97e94a170c2d319d0944ebfc6a5b6d16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88af74581f52b4717b03787152097d6b

SHA1
c2cd0ba76eba3cc11be554ee8776ed820cd1646d

SHA256
45aef1e9531efb2457ce04f518cf2fa7519689b0be0a3b251ac51c6a508d8004

SHA512
aa3fb89342f5a9ee7b785d2f390f4654079688e0f8b96497b8226289360e2ac261b983a03778dc7d806603bceeac8afb9da1507059bcd5fe1c06be5b1ea247e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eede2be099e57588b0a3f84fe8d082cc

SHA1
c9104c624418c0b6e10978e0579f7efed8356a00

SHA256
6029ac27e35659672f3bee427dcd40756182a9b65e56cd19c193c32f192047ee

SHA512
15145af64dbcb6b23741d2944ddc00f5e0d43260ff9a1294eb5fcd162d5484469b5a13978c190b439a76d6fdac1967465aff6616a70faac9cb6acd773507ac91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e9b5c7a72ead21b785ac7352ac5407e

SHA1
255e28e54a82680ece38bad2e0aeaed456e3c298

SHA256
cf50a74e6cb580abbe5b3ab5e77db0a1c93cbf32cb757381c1580ffb9ab72c9d

SHA512
f605fb522fca74f9fc981abacb746e85791067db69e21f38b140726e0f20e8ddde82c99b8d7c85dc653c20e6781906be14eac8d86d89c14bf6a06195ac3fb139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9406a5d9adff4d9da7700355f13e8e2

SHA1
2dfac651d69c3dedd479c2b1b198550950f473bc

SHA256
661f4be7f4e4e65f5821829c8f45712e1389308855e9a691b3408de34ed401e7

SHA512
8c56cc50024c6d0308f6b93392d28ab21048edfa8324b4f849afa717b86c2e1b5693810aad61d25574aecb15ba6b95430ad62919c777999465ce36b6a18a252e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE0DE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE17E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit