c775258324a241e29494fabdf6ec05f6482920f8d8635a7346bdcd946c43550e

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

33992f38be014ba3c5d66fafefdd4f27
SHA1

67ba164403d865cca2f5f9fce2bec9f955b4d866
SHA256

d656ee7cef0e10b0c501ca44a72a53e084370f873d08a79865098cf7c46566d6
SHA512

8e1958844748dd40f1e883b5ef7c398fd93583e1568836393575abb5cd2641cbc2fbabdb6932e45c446eec33edcc0e0b2ddfa551b9391f406b05ac29eaf34817
SSDEEP

3072:SN3y9IpVBOjryfkMY+BES09JXAnyrZalI+YQ:SldUOsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBE4DDD1-7DB3-11EF-A3C4-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433701559"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE
856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 856	1744	iexplore.exe	28
PID 1744 wrote to memory of 856	1744	iexplore.exe	28
PID 1744 wrote to memory of 856	1744	iexplore.exe	28
PID 1744 wrote to memory of 856	1744	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f384a7d6970f73a221ba0b85a727cba

SHA1
16c24e22b5f331f76efecc7a933bc4988223f1c3

SHA256
36a848bd90148519a3daa0c4da9de61e5b27f3f7cce2ea252f9520bc3d14f3ac

SHA512
56f76c6123a29ff1b089643b4758017bc5a508cb09c3ca6ae55c66a6b6fa9645dbe796b7c9774a176efdd8f1b04bd4cc560b34a10f4669c0f9eac5563eaa9941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0951e9f4f57cdb97dbdfe434aa004fd

SHA1
dd52a509f1308c02ac13f9c7c7ebd03af5930805

SHA256
089cda941f55df7f5c9be642b60564148c466a103a8cf044e5a3d5d23a95a9ab

SHA512
494125287a427a6b1dc539fc34bda14c3ab14b926582c2153f82e3bbaa71c6f5faac9c60bd6170146ecd21799a733c0f784bd2172eae592ed452ead3f1e3395f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77971f873b6045d6f0b5fd91375930ad

SHA1
575c3e46b706237b253450be105c81c3fbf6aeab

SHA256
ec7862c6c58bba3b2433cb06f6b9d49479a42b2e1318ce7baca3c86c86ee507c

SHA512
e1c1356d6206e56269943388b840e7b0da04cb81d75e62528c7f087ab45a4be2b5a1b4010172b508736fd6c15259ec2b774c68ac8d0ec6799dcc3ccf1f9f6686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd969e9381bcdfdc03af811b78e0532c

SHA1
f6f72bee65c9479e619a3cdf9abbd3a2eefa73d3

SHA256
47fc3de020a4e810adeab3230339158861a9556505abc678841fb6417ff108bd

SHA512
efff94bc2ac977e4e645276446506e631eec74825ef4d4f03f8f90b77a4dea25193d0e5d697e2cc8aa2c37affdc50e3e44eb789018fe253303ab9e3050bd45ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51b5e795436e30684675f69c45b9998c

SHA1
3cbf3cf7d44c3179a6ede32e035c129fffef730c

SHA256
128ad0595d9fd1c0d2e8c7b1b87740d0da6d267b14dbb1aa6fdd8eb36dbe6421

SHA512
66202aafc1011d900779b1e61a0ba640301c075dd1d625adbbe167f8b76f9dfe625d2cae4841e69a8bdfcb318862fda7e9faf28dbec8b976259f113a8f6e2fba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a73542a4b3110e7e81756413b363df6a

SHA1
f7798a3d4a46ce3fdf97cd490961bfdbaab70659

SHA256
983840771ef78745729ee7cfe280b42c12ddd6693821cf5830c3ee881dcbc8e8

SHA512
037fd037cda153384e104931265712fd0ce3e7d8448181e3589126658442a93e3d793c65a0c067fe1fdb0cbd5131cdf058b599bb47910464997c9ad57764eb81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b7d223a4b50e0aa2a981d7ea56a58c

SHA1
55c02162545d73ac6ca956413451e5d1bca402fb

SHA256
5b5ddcff54fe69cd87abe92bd280e0c7e7b37d65b609e3dbbddddf68ee3ccc33

SHA512
e9b622408d782cd72ea03206f41199dc3533ed92232d757bd6b5aaa692602bd2e4d6da33c6ba08d05df619568b825f2aac6629bcfa0977551d8ba738c08d5a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49c0bbb784b83e263d1f3431d3898c45

SHA1
137642c6a75cd7902ccaa1649e3e73b1af17d759

SHA256
6f1e205845908f010122f3e336ffa13e7e5bd7fa85fbbce8f1dc8885b07801e9

SHA512
1cd03a9cae8c38362dd9ba5f8d539afecc643fc270fbb72f440d84e9ee19bcbb7b540a42f212750b89395d9a91d759a32f3d1b9c0c7e8b55b558574a603d7c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
868f632112b0d1b46f7b4a839ac8def0

SHA1
df51276dfa3684978176dc1a5e2dfc7fd66e820f

SHA256
6cdfd03fbebf16759696c00dae65ac6ad59cf38d3beaaa6e0388d9a5da8cd940

SHA512
e7e8b8219e200bfa3bf131534b428363a8ec783e384f023fd2d32dbef7225f86a5c34895ac0767216ffbc8077f38c7c6aca6b775bd751ef20063eaa157cf6706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e8640589e4cb256f0b95659fceba723

SHA1
89f034ed5baacbfbff7df1089152a824460e6445

SHA256
3130cbe687d635374c7b505e5883341812b73faab4eeda9cd3a963e310ee30de

SHA512
7249441a0db99f11924fbb27e2235ab93a05c5f0abc53da2458667f6934aceb1cad5f02c0331b805037ae0bea2b36b21a87f9a5c4717aa54fa930489e9f47af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6271e36fe162637dc77498d843a147c5

SHA1
8f4c269eae0ff576047d5786b58e6b071a91c4df

SHA256
242fd8b117bfd34732637e7905fdd26bad3a232f35c904d79429bd5f466be4c0

SHA512
31c2b7c1a0bebe8d31ad128901dd72ff2457f3d047a7103ab3bb112081a0ddfd1caff786bf62c40d6390816289f5381c58fc5c6790205da7d85a42b78157d93a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b0e6eae0840e927287eef2c8aaad2f

SHA1
4a33fa6164507e31eec607c7a09c621fae0a6430

SHA256
b77288b794f913763cc25814d8aa24eb3ed8d81c552e489321352ca57492c513

SHA512
cfe2be01e2e4a8063e0a5175300f9c509a07856e6254a2e748ff54b2fee74d15db1929bdd071e250a4195f3d6542331fa1de2f0df6c525453c8d52fa1385bf5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
458d048c647694496676a518270a67b0

SHA1
a57028f6a004c3f650ac7f636c2da27e88531656

SHA256
5eb458ae5f95fac0da540c22d3b149eb20310ad783fd4540df2fcd58e7652c94

SHA512
489582882e63c646ead6572cc8774eeeb511d4741a9bd5fcf17cf22d111b59c838030e6ff917ecf126d8784969be51bca65a2fcac8a2cc76aefcbccb36be6d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9898020347eeff46abfaa0c81bb537b

SHA1
9abb70e1e1935cde3e5331ab7ace224cd20d4942

SHA256
a74544928daf60568819a9903163ea0944fc517c0d1249dc6f387e97ba2147c6

SHA512
3e0c384245bde748be12542cd01ccfec7c62d3d7e8a7ee118940f8cd6f188366741f6bdf27def6b7af3bb52d48685075c986cabf2ac49942758fd12ed5b7d81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
459f9d3e1059e77fac0153eb98bb2a59

SHA1
bc6cf0f22d417aea2e355fdee1ac05478addaee5

SHA256
8972496cac79e5c8a21d59bb8007ec88206a15e469841cf028895dd2b24a16cf

SHA512
b656b959b080e2b9c8e8ec328bcdcbb07ca5367f283cde44865cbfea91caae0ae4248f67180d0f80b54a5bebd90a842486c2e04815b814c5a4880314e2c13e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85C3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8635.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit