d10ad4d2c275249fb376dd900e28f8595884c3931c21cad990011ab1d016010f

Analysis

max time kernel
30s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

publish.htm
Size

8KB
MD5

bac3b5269b6f7c7722736c227f432578
SHA1

029c2b0e2b8e17dedd0bfbd6207c3c29feaf9cde
SHA256

d10ad4d2c275249fb376dd900e28f8595884c3931c21cad990011ab1d016010f
SHA512

f4c9299fee62deb32f39098dee6397b55d97f03e4921fb5d9b302b05de5b6adf5cd48213f20cf592e2b8659fa88ad513653cc305a3d439b304acb0eec2f57c49
SSDEEP

192:iovtf0B2ruPNGIfzTkjivop4QvJiL4DKzT3+cs4:isAGIsj2J0Ji5zTO74

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A290FB1-802A-11EF-B0EB-7699BFC84B14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007b7f63dbd2c122fbb2a8fec9a5b83714d75931c3eb05b1de6270fa5c99fd74dc000000000e800000000200002000000077e1d18b85ad0a1be06f8ffcfebe80fba531a4648bb9bb183dfe7398694a205a90000000479457543cf9b5276eb3cf94ae5d89c1877923156786c0eb302dcda63b40c7ca9628af802d03fa072bc8997734cad59f8e5cf0bbf2acb82e11a9209eaf1619f039f9ece9e0b24a0b04f06fa5d852c74d6d149c23cb9d00ea6269f7c46719effb2fa28851493750be356e2d4479b6bc7b7797bc5d472a74e49e706716d9c093c314163dca81aa9f0d68781bc851eddd9640000000fd22d31a85acb09bd5c70017bd673eef8e5b69cfceed716c252deed77b0a60600b897e06950517e522dfcbda36fea127c5b5bedd0b5d4734b70424b5516e1939	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000c47fa175e0334a26f34d299b8660ecbea3e0ae567669f762c071b0b97292e05000000000e8000000002000020000000660f6ef75451999d4709015d3055c5fca9850affad16ecfa4066e936fc0c3256200000000abc8522a33569c6d2397134c6d178e610f0e3a60e5010d243c361be98f9133640000000fd0a73828be5138e761358c15e59f4d0b503679fe0bceb7ab97590a3805edb5a5611b26031678a5bee8f25099291dfa9045d7f0381588e2d469837f1dd41d79c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5062b20e3714db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1936	2248	iexplore.exe	28
PID 2248 wrote to memory of 1936	2248	iexplore.exe	28
PID 2248 wrote to memory of 1936	2248	iexplore.exe	28
PID 2248 wrote to memory of 1936	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\publish.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b55279a758fc281bfb7fb6e92167fa42

SHA1
7a8bdd6054b4b4c81096e0faf571e62f5dbcc057

SHA256
51d8f5cd7044199a180694f47418568ad4b3eeabcddcd6a8d4c4f519d7908d3b

SHA512
673d88548ea89337536b76f76b4526b9f2d0100959f4f6a55444f6d6d9fcf46e81e2dc3c8e3674c957ef14d1ab0cbaf7198e56579bac9fe58aa7076f9a4d7085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffc370f5246bd2f5820fd5d7b3bc7580

SHA1
cc511bd872ca045ad0363b6baf0d5d6c06a3f7e9

SHA256
cf1c507f04414d63bcfbcefd698e04451e34bc8ab4c16a5051588876d08de725

SHA512
c743f42e5a3a4572653007528bdae5269cb3e9672d2db794c79b91273be6c5540136aa01520f7a3aa8a57c0de6f88ab4a11659643376707c42defc9df858c1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69277ae66b99ca960d0e7055f1a68239

SHA1
98f13939351a0d65b10df73002e9f46dc166e9da

SHA256
aaf087a303f7b14529d6cc14ca20fd940a19da1003ebc0cff27b1ec8fe589b5f

SHA512
00ae69f969d200b2f24e72dd4fa34adf554f3cc4c4dfa8a72ba93c16d0422d5022d21aa83edbeb0dc1b1d42fcf74b4b2d51e816f783749829e6c0a5205a5f961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee38e11bb699f872b915dc1a61105eb7

SHA1
64ce8259ec7068a26aa32fc36382b35279bd483a

SHA256
a6f0ffc0442828d15b9053060a8086436e106c4bb4681bf9af9eb461cc820e0a

SHA512
a93e1987bd073f082d2f99d4e840056b43afdf6e4c24d5159a871bd556c79324edac20214eb25a09942f44db10aff284d60a8f4b0034c6473a28126898a791e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
640009d48cf733bf45a7d62dccbd6ba7

SHA1
09760598eec265133f4163cc8e7582182acf96e9

SHA256
cde90a58bfbdec09859ac4b51b6bc7a10f3075022fbd4322e3dc2527dc37f69b

SHA512
f9810a566dc5cf24949d5dec03295e214e77481745128ea28ed17cc27fe89dac97b5808fe24e35a6b1d03c1ba178503a06dda20253414b3b03a2c36b6e36b1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11f151bf6cb2c3cc17ec7316c48c5184

SHA1
e3f032e1dbf75192e728e88516806b28b09f8b98

SHA256
478d95ccf93e5ba5e351af7d8ee3ba4509571bc4336598b2352d847a10e28ac2

SHA512
5af83810c38e2ee819c7a68196c16e57c81cb3fbe175f301e714c1488a079d74479ace041bc96f81edc7cba892bfbc24cc9f311015b6457dd298d53ef5492865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
945c4cc70c03778de1f878d4d76f718c

SHA1
5050b76b2d43fd5c828b639aaaafab1e522e88c0

SHA256
150b5399ce5f9fb7a9e8d0aa751d3fc62b53629c028ae4e5dff161db1414ce9c

SHA512
c0216e58830e26d5938a58ddf499363d38f675543acb853ba98d10c5126eb0892423f710b6a8006d4955106902721444af98252708bdef4c83b8ba856fa4fc32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32eaf496751b1761cdd66f085ae92d86

SHA1
707a8e9a59c0083cdac2018934d081ae85bd3b75

SHA256
00ba408de9f9bba9c0a7973aae949153a64cd25441a2ae29ae46bf272aa88636

SHA512
e709ca67479bd9ef3a35712480f2555522e2032b678a816c204f56d6046647653a51ac85f36270c3dc7d4f1b3efb20c7d71e94f1af6209650baa3d7c3329fe34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7875720f4e3f4a4bc7ce2ac8d4fd83ef

SHA1
80515741bf05a8c7cfa312e57a121640c3306c99

SHA256
8ba8bb60a1e43b9f24bd72d3debcda5a8e6c97f5aa49bb7d1d3746b7db60136d

SHA512
ff16150e6b651d6ea2e409c83258831b5b1bcd03265ef334df23cf8ab17934def969ca71f5ac4ac19fd25b334c52440e41db23eb33e4f6106c723a2c4fd5c7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef4c716adedcb497c9b9e82b74a87239

SHA1
ce5af23bf7c6d9f337f0c3c36f7d5736e14c5e1b

SHA256
a16a737b999ca5362026544f49dfcb154028036fa430d9dadf3b692c2f0b0758

SHA512
0dbd3d2c43cf737d91fae8284073ae9723de04e0dd984e731e91dac35bfb0b0a53cabad37064b81a5cae5033cab705fe89e9a6344082ca1874ccaab07a8ea2df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD8F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit