6a18ce647262b0fa400cb530deea4932297895aa1277bbd55fe71e1a208b57db

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cuberbot/static/index.html
Size

937B
MD5

a1254882167df0747708dbfd56dc46a9
SHA1

ca307e68935e6839110ca074747c33d9979016ee
SHA256

9d8adbb523ae6e797968aaa5d4f2b384470d9e9f1846a62e5f68da4372fcb7af
SHA512

8133444253174d5535545f333eaf2a2d2e259eac7af2abd474257cefad255476a77c3fc01e6299c5c33d1169ebcee0d0f7304ae76287acb2dd06d4a8153b13cd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000008fb3632e5f34b5cec7cba9e9c9644a2eb6a4588fe2fe38056eb996715f07a794000000000e8000000002000020000000b1f2243d5ec45eb09d930096ffbe26699f63746ba5d768f318f2758b8d16cff320000000645856e1cb04b25d6bf95942b223143a07d13dbc0a607906c066d93a85ce354440000000269410a6f9ac0bb67d0c06b36d085e28601fc451bf6710f4a8c7257995ae4bc4038360a3e6622a842d94c2fa37e135b37fc1f8d9b1cb971efee94a31673c8964	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1055a99e3a13db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000bdc53abc293f29d96b557bc5bdaa50a2d67654a36de550a4d6a47ba1de37ea7f000000000e8000000002000020000000918f41a06d38ab4779573626de1684bbfa221abd97483d0382b3c703e7fde917900000003f0cc27285dd32947043db4fcde14719a2532aad7851bb8a1e23020ea297cf367ad01f71bcfc463d6ec034575155799478410d30938ad82d57333b3d045d3791391e29ae6ac118cdb9130aecde3046460ff0fdb42f25c5d77e204a34c0745e76cfa7fd2a01ec7010a1ed04591865c7a5768810b45c6b7d3b824ba8c746323ed781af5e0a1bd128892a841442d8a7804240000000f5fb2148805a541c643907f00873b9a62756bfb64502d956ede06d2e390be4147ec37412dc7ddd94c2f0f1afbc95eac110645d0b0697360feebd293d4c89c80f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA373BC1-7F2D-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433863880"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE
1632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 1632	2948	iexplore.exe	30
PID 2948 wrote to memory of 1632	2948	iexplore.exe	30
PID 2948 wrote to memory of 1632	2948	iexplore.exe	30
PID 2948 wrote to memory of 1632	2948	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cuberbot\static\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ffec1e295ca64eaac21a5b34173648d

SHA1
7dbc18865eacece6cd9fa9f5a19114c0931b3a7b

SHA256
3371b20d24d0351497e18de3aae2b17b85e5b4bef4626764658f4c0e8ffe8bea

SHA512
d74b3a5c3e4da5622a7915580614ac9a1486c4b8eeefe4d5fe1eee34b58a6775fde7edce07d404cc37f0fbd3c888f1e9900e47fcf93b0605d1fb72a3ecae0d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6456d98611fa9a8f6a12a2868b8b1fd

SHA1
e862dd6e347f08f6dd850f4c1cbab50a0590fce6

SHA256
bfa0b1ae8baed354fcb7b458f5b3a09eb7a2dd2ad811f55743b047995670cb46

SHA512
1c12e7dbb4c7dc90a1c76f948558dc1ff81e316bb1693edb4756daf43dd21f3bb5b2b0e40b793a17ff5903b1c9080e5813d52cb94832d8d92935ddc9c65a5773

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
714c40169eeb7fbc4315110fc0d549e7

SHA1
734e8080cec6d01cada1858387219a233e804c9e

SHA256
1185d7f4011b1ce2fd3ad5a1660383ab9a7c9a7e331381c3f4c3ded63d853f52

SHA512
7efb2eac371ad7e3c7635e26e7c3a0815b749e2b918bcde65e9862eec2fce840d50f5ad530075323105a342cff48573c344c35ee959014412842aa8995b7deec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3089869e477b6b66bb9dac7c433e9c7c

SHA1
fef6eb1fb799796d2054e33fd5d24a1e9a43efc2

SHA256
904097c880f520e067ad6bb5eac22f8c982b338dd4d784721da735fa942ac208

SHA512
f199986977ca3d447005a96a9f97adabb7e14208ce72be3a34b7e6bfdb12a5563ec8c59bc537a2f39adb789e304fee64e493f86dc1872e89936902349d657a94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bb1263134ad207b2b67e34a13f49a6b

SHA1
cb50ed74933992d3ac8db19aac268c99f587fed9

SHA256
7a994ca45629cdd544ce8971a675249ce28777b6f494431cd850db6a4b4fbdf1

SHA512
b3fbfafa1d19973aa80b1a6ef0c245d2f48c8ebc451784f2a7b52d7ef261ea7708084a6c4c79b108b0442a9de94939eabcd774c3be24a0d531631fa3c2a34361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055a7fb649256ad40576d5e0279dfdd7

SHA1
15b5661689296f05aaba3247084ebf67b0ccf612

SHA256
91981a6d0c17059b5069589ee47168a0f1501e88eecbc8f3d331d1294897d0b8

SHA512
efb6f23f8ce33994adfa777c4317df3a3381068936d7ad75d1a78491a8ca9a55c71724b5e4e47af227180a50cc04d78335f4ecb653491b00aff0cdd8ea45d212

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8f3757d8f29ac9a67c84d5b59dcee8

SHA1
58c947a383b2298b2029bc75e7b7d43d0127de9c

SHA256
cc79bd9c37076bbea18665b8244e40d3c2166201dc8eb515677decde92c0e561

SHA512
ecbc5d7b3ab7ed97ea411ec84ae2235fe004a3de5b17f81063680d5d3d9830ea63f54d4e7ed9ec3ff8258842a3537b6e28ff69d7304a69cd67a74e4bf0e0400a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
592005d587c4ccc97278cd4e767bdade

SHA1
ae3302c78c21870b94061b476e0e2a50031e8d3f

SHA256
28f0dc4032afac46f1efd6c993dec69f8b03547e93909c2a4c08a187cd0d282e

SHA512
82550b1d70f9713179cfa6e5eedb59926961226e7d0b3e4907c32505ac6e382949badfc70261058aa94c4026ef50296d40be3bdd49b417d6f046b9f39bf47363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9f90f8a48a315a8aa5d57949cca69d

SHA1
0b766ffd4950482f99d9202bf60789a4e8d8b252

SHA256
04e2c4ba8c31b7030a5727b21011a423a7860dae7f35cae7089cdd30429bb114

SHA512
00ddb581cdb57ae4d74e1fd8ba8d97cd19a56939d2320aec95d23840a5eadfbb0157d8241e85b794828a4852256a58497d53ad6ea2c870f96df0313e2906e631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68b682f160b9bb5ff74692e878f59add

SHA1
1fc6b4b20be48f2b8c7c920d3f8f15d556f4e268

SHA256
30f30705365ce39b55ff360e18e97d97431048b9a47224268e6d7f967e3a4864

SHA512
8597a6992b8ca4e44e6043c18e2a3888ed1fca7bfc727c0d5d6bfbf0242095fa300c42348ea77e538a097721977446c8992fd1d0b3d22751a5fba8f07b30cbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ade76e099c5f3716b12468ffd4baaaf

SHA1
21dac044e078b9f5fc29ad1cd4acc7c5bbe8125b

SHA256
8a0af1000c7f615a943f018606dff4c0b10ba7bb98cb0459a3cfad015c62f10d

SHA512
9723b8c9cbc01934acf498f18cab00282dafedc7f70e47d9fccae838a0717987be9b54e7f1859c6871db97460ed099c451a9c2ab17feeb84eb346d56ca059596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2ee04db6b5089a628ffe51c1bed9c59

SHA1
65af663f175f78015f9157a904b72ce725f5faaa

SHA256
9c5ba8b70eefbf7deeb614b1c2e57a38574fbb8ee6553e8bcd462d4ed340535d

SHA512
6244934183247da6f503cb198a8d9ccb0a71b5870262e10775e3b81ecb34163c4ef48d5b0c89401883c2eb6905347bc6d81c42117288df62ea998f2f08103316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ed71f407f1afc72ffcc4684f4edbf84

SHA1
59b4bc0276aec2a3bd5088d8bcbc000790fb5382

SHA256
64b9a90d5a5aece2f5ebe9614bfc6de47d714ab8da0168a5057f8a01b8abdc4e

SHA512
428acfbe7effd23cf9886a32610aa6a056a1eea2658775f645517a1b9bd0a021fa1771b88714a6584ee3b3df391a3c773a8a24216cc1864efdc2694299abc3a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3872d18c5008580d7f8b6fa9e6aa4743

SHA1
a7a09fab32a0c3faaaaf54e7ee4d723c09331e8d

SHA256
b119699a77091dfe2192ef0c2c38c8fa934d599412a446e2baa0f7714c08a86c

SHA512
80eda825757df45667a5e046d6b1651fba89f143f6e39dd81fd76e13034469c1bd45289e912dbf4e86ab8b3f7fdb298d4c054b3a92b6c1aaf653d0d61a4a0480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d05ec6943a32113ee8dcd2a1c6da6e8

SHA1
232ce463c4a27ce5dcc28b3c0394ee58691ae56b

SHA256
73cc36b24392052ad5a4d10d0ff267e2caac1906b479ea9cce205f64c63c27cf

SHA512
31ebf9feaa87c0cb2fc842948f380c4072f7ad9eef39cf6db7893bf8ce3680457b309bc4077fc6d7f1d735b793ebad0d71ca18ab77f3461a93545b2a458de0fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE621.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit