442c0032f357020f95d9587d85d1983f838e53475b18c79b61b76f790ff9d12a

Analysis

max time kernel
69s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Readme-说明.html
Size

777B
MD5

c958a387bcb4d4c4c36ed2dec01184e0
SHA1

910f0ed80eed8c34967b4c888fed20f776436fbb
SHA256

f99a90d3cb21afed0ad2fccc9bac2829d4f3ad8ef9041cca405117398c43c57d
SHA512

ee2a93c89c3474cd112d3585b1ba1d6d0cd48982562da0033d2570f2def91e1daa2ff83d41a6c1731c4595264f79be12ff596d76e2130e88051d268dc0ed99d4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBBB7DD1-805F-11EF-A0D9-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000fa69d59065a861a09f89be32959bca3e80de6254e1ba5d72d17a9c9c5ef0c694000000000e8000000002000020000000da17df57f977dacd479d89a4b61b52fb46fb04a92d91131078c25e39137d105690000000bba78bc57875f50d5caeabe7ddf262e671a3a58b430ba218da8b46020b71b249dae1114e8d01226f283407a7ad21d2698183128e5923123e0c079a628c23000595c98d7dd12d506a406ae53289eb4e2aac6389929ee9045f9dbfea73c2dd8133c166b358a7995786f27c51ef37fdac54ba64e51dd1e1e99041d5d5e6260fa9dd91660a23e6e2cab709759caf2aa3c3c4400000002c275bce4049098af77625131d7d0a82fb6e45138687a1a5b05c1149a2996d1eece611a5297f6d7d9acedf08adc4b8fe0072c52578eb9e9d89001e4ee8e2ee54	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e017d88b6c14db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000afa718621822a37f3beb5cd21672d5a4936c49b76dee2229ab476ef9fc12ac67000000000e8000000002000020000000d865add7eb4f10e92d739b8fdda465e4da386c49209bbf3662261e655ba935a6200000002e6d4d888d3ff3f75148c0b10ffe2c25f9c79823f7d23094ee4be690c9052fd740000000dc1d6371e27771279b7b36cdc39a3899f0900738979b7abe3bc9ace7756ba881be53abd603205c8bd34b825e70df0a10fd422fa6ef4129b52dc68c68f24ccbaa	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433995283"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1964	2720	iexplore.exe	29
PID 2720 wrote to memory of 1964	2720	iexplore.exe	29
PID 2720 wrote to memory of 1964	2720	iexplore.exe	29
PID 2720 wrote to memory of 1964	2720	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Readme-说明.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac224a7f1fb7f51e16b58a329e4d420

SHA1
3356a37a4a35c03f370d20f27dd7e05a3622db7c

SHA256
86f56eb983ba0823dffbebd3b72b00ab3a568b6cbe8619e13d13dcd1fcbdb45f

SHA512
551399bf0c4f84dcb1257aff0651c62b91f825d1289664d36ac394ef2ef9f2ffd7aaa9b9cec136c645618987d02307ab7fb39812f99915163c646cf1e5ea3112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb304b66f0611f3afdcd81783a8789c5

SHA1
a2e429eeb5ba8cd886f63463776bc988c9d9a0ed

SHA256
fb720df30fffec393601ca5510167abac54ac04df2f4a33b0b5f2839d4fec6fe

SHA512
605f8d1225fbdef98ab034699e30c32f631d7ed4ec51077af68229f0d8a1fd0683f632c085317b05b1564c90b7d97d8408f74741a4ea529011d86d215459e37d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace96bca507da308d888131135c21012

SHA1
8fc458492c3c711effd906d7b2e385e31bf3cedf

SHA256
2241c24b152f8de99f679b3eed56b1d2d47a9a3e16dd5eb7f4cf08686e9b2a8c

SHA512
13f6207cc5cba3c14ac52df5342e82de8e475ec5b268918cbc77d093f24a0019149141444fc125cd2e961dc35a07254a1f68f331183a2a450f2e91a3b84d1493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53e616b976c85703b016beaa6314dd20

SHA1
7c12fea8379093bae3eca411e1c715e72bea722f

SHA256
242f8b0c61b3be550fcea7ee1579913c24e6bac068dc2980f909c44ea8bcdd82

SHA512
d640fd929e524a4f4fc4cb1c57d3fe9e142355a1af0f49c238c592c4c5f453a0568753386917ab57deb09d50e68e2bb9d766efe96253222d933cad907f711085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85d8edb1b148c2568bfe39269bb72284

SHA1
0f158afe9cd5df82dfbef5d105d24c077960f958

SHA256
197061f37e445a719953ed04e5033ccb4bc36be935b30656d305d95ff7c89a85

SHA512
cc311ef49c42685970470c5965249c59812ea1461dd41a0625d3fe494ce22fa3ccf087038cccabc7c0707ec487c670b40e32751224da620e5855df874c5565b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
725a007bebea26ac521b2c01592ed0eb

SHA1
fee858f36cfeabb05c8f7249b7b58ddbdcbbc683

SHA256
1749656c703cdebe61b233909461431032c42872ec67ee0695c212b8beb61566

SHA512
0f4c19a2ec56ade4a1737ebe3751346a5b7ca1c4402803969a902378825e6bf89bd6d44ad6032e76538f897777b07b2a221cb95e164750752b5f015fff17332e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddbfdb3e2cff7b08096de32be699343a

SHA1
4a26076aa003f99e2bf6afe218a7a1dd7d77ba8b

SHA256
1518bbb08b5d3882d148983dd4620b87a27443bf3e2d84053aefd1ee305aa611

SHA512
282c460016e0788bc51416fe8133f784174a295a2c909af3ca13adbc9f9af4bbd4aab8e8677114bb8312c5338159fae38e9c6249ed3a101f6d079b5ad6a57c8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c8e5b3b592c4b6578dec20dafcf26d0

SHA1
0bb9c355a1058ae4f1243bf3d99afea2ba797efe

SHA256
ce8bc269689b77b1692342b333231e0f5cd8a05ba2cea8a45b60bbdd9f9bc569

SHA512
84874bfc3f35cf782d5743c8f51e2d5ef738f51ce0d59806474e2f2d1b8f58deb97b42c7923dd24cb34fa8dada6b5d36387d36695838d6534a94cc88ef768fb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5e601e0dc6ef9cf3729ecc18940c9d6

SHA1
7dbcb25de338dd35bb6a89545113c5f65644ce22

SHA256
193c65a7ee0b7823ada2c4d3f713765445755d06254f7ae240e31d096b50d6b3

SHA512
2aaf9c4f8b0679e0d01104669bbff839b526ba78ab24980e9f7ba070b514f3751742af4516efb33b3369cd7a96030a3a91d1d4fc4e436734eca1769e11ec5359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd805d4afaa14fb00c7fc3e5836c59a

SHA1
71c3aa42a80a6940d49cc4eef95435ac9b417f41

SHA256
2023c5ebeebe89f79ff52d9f21ac6078eb7d5810fa8cedcbaabf764d4c11d934

SHA512
3f5214448d7edcdeaef12f82ad1f4d181d11eefb2c479ac9b275d1d3cfaa3cf79751883be7511ce3a037922a5da4f0584b7ab8c60a3e020c164644af5795f30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd349cc6934a9325d1936a288533b6e

SHA1
942ebea48fc5b88f2a73d770fed192cb425c1ea5

SHA256
58cdec8800c735ef2c4e8ab3aed6f274c45ee00091e23a06215d1bb565188528

SHA512
57189248109f95553da1d187f756b24bfd9cf73a8c735f11c399814b66282fe978caed499a933f97217df8d6c04384317a4ee7e5fbaa6b0798b05d7b4c24a1bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDDC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit