e9b48ffc3197d034421ed81c4a5af3b0f50709ace151e79f1517d81854eb56fa

Analysis

max time kernel
137s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

358722f28cfa023c5e0faff574b3c460
SHA1

37bb653b8ea2986eff8cf1bdedefa30b97a0aacd
SHA256

9ab42d8fac9cb1bcc702e6d46f1bed5572f04d062f6257fa8bc1af70c357ef22
SHA512

4bfbd881862ba4a3cb3bfd41757664fe9ff60c0969b12d1ef5d3713c20c3b61fc148f525af889b715c4a2de1c4fc1fdc042f872eaa0ffe0c29aafc975e4ef3aa
SSDEEP

3072:SXcd06iOYyBYiyfkMY+BES09JXAnyrZalI+YQ:SXoiRTnsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FE59BB1-7E57-11EF-A02E-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433771709"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2764	2320	iexplore.exe	30
PID 2320 wrote to memory of 2764	2320	iexplore.exe	30
PID 2320 wrote to memory of 2764	2320	iexplore.exe	30
PID 2320 wrote to memory of 2764	2320	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6d8b0c4b5dcdd504c4b0c2c85eebe5f

SHA1
d639937d86a060192e451c6c58e4b418b426f705

SHA256
1aac4162c7e8a85eac8ecaf79c2effa2f24e8bda54a576eea4608b1356bc2416

SHA512
05516627b8dba50f772db7c84b7b5a9eddde34f90df5e97e47fa74fafdb5b3947a98671242ab8c691a0b5b36e816e2612dc856f78aa167eaa340da1634117079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1557fedaf2b3838d5195f3242bd6f56f

SHA1
c654c86390f031dd1752396b557ca589bbdacd97

SHA256
a6f7118c97b3d238b8e22d85d1fa122c2ae797013e337756024b4f2394bb3a91

SHA512
3934f911e41cd32e9e8e58ded795570efbabf8c01be5ef082e74623bfdaa5535f8f4d647773011d6735ff7e43c585580824ce6859508d32cbd42af72be60492a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa00c04e3d4b28c544c1e38badc4768b

SHA1
78f9f538ad9c7a47ef77cc37422efdaae4fa49b7

SHA256
9280fbde3158274d9a901e1762589e929b3edcd550106c280904771d0bfc4ba2

SHA512
d8347898f9c9bb4eaad7b3fa1c8bfd176785c219534d9796b399c5128f76d41c08c01b61f2f49196bf1d5afa8d5aed30e26b7d5529bc2b83bd9a210d0745459b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d0ad32e4ddff7a81b5a4a1422e55f81

SHA1
bd84d5b1e55ee424a696e586c5ba4e882a098085

SHA256
2b4b684c40e999a250d905a3cb70f4b084b5945cd6a323af8c01fe86ac6c248a

SHA512
b305160135af095513a68f6cf26f5158a3eeb866cb40c2b2a3ed32ff1950f12779f0b69d8d79e4aaaef69952ed60599a958a4dbaeed2a9ae6f6698116bc5a534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a99f75bd23ab1a07c2bf91f652260c

SHA1
f67b5f5303817682693535d0d7afabc7c2fbf7d5

SHA256
1a7888d486ed9abfeae95de1922933affb0f1306a09a43ca7c2099e52b3aa4d2

SHA512
d1228620a0c121303d1f63a2cf2600341d4ac1f29208740fa01f9ad5a587853ea91c46285ba8867a6bd2d9b6ec1d5a66d92fb11afae966b089899639befc299c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eeaed87490f0f00d7f1f87738a7efdf

SHA1
518b7886c38be2d629757dd6c14de61c712d6b1a

SHA256
62bce2a32de5b967acec7f1329eb4fe460f42d07c7d46aa5cd246e42af5a964b

SHA512
6b3f2dda20d89e62bb746ce86fde715df0198f1d96a7ffa86ab5b72e1ff879d0d0f8271346a90c7ab3dfe5f77cc9a604c869ecfdfee719da740f9de1de73ed56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea55536edb57b9c75e1706f8d81eabd9

SHA1
08905d8d96d2176675ea4ff933a6952ce8fa4038

SHA256
e2fe763c5e0ddb351fae62a903953aae6cd18140d4b8b67c5958164b69fb196b

SHA512
7629c8a76291948080cad65e506ba7bf2a02f07ead35115eab6b59a913998959d41b5952dfa79fd00dc580e57bd58f81d9422455986c38144db18600515d9086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e57889b7aeb366dc1e5e5e39657cc6

SHA1
86670a5b996d9089b300392b53e31d6a2027d319

SHA256
26477afe2a888b64f5999b23a1144127d5e432e9badcbb080378a3eb410e4d8a

SHA512
e28734ac68240427e5c1419e6c315bc6e5605a2f682796fdd8af37baa06bd118c754db35ddbb6f96d33afc457695c9fa2f3a4ecd51a679803bfd56c928d94c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1b26de30f1ece58a4a453a61644fe39

SHA1
deb1463afb77a05708dcbc22af30f7ed60ebaa07

SHA256
3b96d0c5d2159509a9a8ee2aba8558bca693c8e72511a874c9588f877bd98e28

SHA512
fdd22b1dd80ce49b2f4911862414e1dea4a948232271bcd607613ac407bcb4e1d7ff7102063634cd786c376ae6d29d29dfd11fc7ac360b6f2b13bdac79910adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
399298b5c6e85ffcdeea6e453228b9e6

SHA1
860ab7c2e991c6be27059715d8654c049ae102df

SHA256
789bbf5ca5aacbef3c78be1a16f7c309ee1d5464ab2ae78cfb715be2b097da1e

SHA512
70546d5b84ccb8b02fe677cffeb4cf8fa8347b8b54a400034930033795c77056537d4f365d82b9715648020f9e5c56deb298cbee07e1f5009b526eed68747e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0127afdd1cfe072217ee7bff202d6d6a

SHA1
66a7a0058a0ac6c93893bdd2fa4126d72d257c4d

SHA256
090ae4d05d994349faef1f4c6806165947b0f8f8fb2d9801d74aed34439173de

SHA512
e83a281493f89bcf6bee6c9e9fbd0e010926545762c7e6dc97344ce6bc94209d37777fd6ed8239b99c0318475cb744039fa2e771bb556e7ccc587917f2ab8201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55188c2fb80c13918cea4f5f9829dd0a

SHA1
c0c486ad16270f6a81576cdf692bc8a168b7b127

SHA256
8e24cdd4af104c611c698ce2c9d8f04ed333ee2b774b4e5d894e9c460335cd1c

SHA512
e8213f2fe2167193f0af00f211256fe8e8723cbc0f149ec209b277fe734dec54cc981885161f14a04d069e808b34103260a300abb2bc5b9360e4b79ca703becd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ee90958126ac992c339dea8c96c6d5

SHA1
f01b8e48014adb08cab6d9e01a1f5045236bc805

SHA256
65bc5492dcd8b897533877d8b5798e8545638646801c03fa40fd2eb97032e5ad

SHA512
0878e5a23a861d71b5f90e04994ba5c71ba0ba0b851e93de4f9c08b72e17dcf12643c9a0322bc4914f851e7a25ddaa7c7d6b1fb21cc225d3a13db4edfe7efc03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
983cac5b1276b6d3a079a87d9dfebe48

SHA1
d0b9929a623cdb5f45ccf5598f352a0e3b591d96

SHA256
09c9fa900b7df3e847eec594e0ba56ee68fa4d7c53a6a9e2dc7dd0ac31f81c43

SHA512
3c84da3ebc31da345d4ca86fe9710f6fce6c10c3b9fdf3f6a4bb230b0fd5398f50c948c3ddbd5c4b759ae946cf2f87ba3d0ba230088475dc46e86f53e8bf9359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
950f82c7842f3acd16f0e03d165af4ee

SHA1
22399084ece7411f6e6ff485b3ee1ab48b6358ba

SHA256
baa87bccab62f48d9ea4006c76f5b667385366dd4c1dd03d7d45dd41712ee929

SHA512
5acfc0f437884da6754bd081ee13bfdb210c6cb82533fb51a64624718b1cc72c727bd730ec5469e49e4594ac563a22b2bdd2002d6c6190f1b03b7df4403a5d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab928F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9360.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit