06134f55d8dfd5860281ef05391393e5264d62666639d53a87eaa213fdc9c606

Analysis

max time kernel
239s
max time network
241s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06134f55d8dfd5860281ef05391393e5264d62666639d53a87eaa213fdc9c606.html
Size

4KB
MD5

b89fa624408b2644781591a3819d0be1
SHA1

73559e532fd735cb5dd83cff26871464ba8a7172
SHA256

06134f55d8dfd5860281ef05391393e5264d62666639d53a87eaa213fdc9c606
SHA512

bb7b517d7d4cd41530d9d9c007bbe41c8a8c41c980aeab1db7ac375025716381459ea10f41015be267e8c1fa9a32e2f5126beb7613d02e4ef2c67f89cb5fc120
SSDEEP

96:1j9jwIjYjUDK/D5DMF+k1LxvJADh/pRs+rRb9PaQxJbGD:1j9jhjYjIK/Vo+kFRADh/pm+r19ieJGD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434156500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000003c7234b1fa7cd9e2ac61e82d0c8b3b71ea98cd6a6930f9c2fe18c6fbc932a85b000000000e8000000002000020000000c9b4bd235a870cf410a36cb713901a58b26de36c0c04e51cea520b084aacaa9820000000ff9ead5bf741e59bebac8d825f99765de48f95ba97cda5f45870ad72f53b53e240000000bc99d964fd8e98ffc25f376c8dc06a257fac515e8dbfb7a35150f57109a8f836dee98c315e4a564ccf021cc8217a246dbbd63735fa93b86dee5930ab9b488708	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a091b7eae315db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{163CF4A1-81D7-11EF-9816-E6BB832D1259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004a5b8098c48ae66229f5ed749a13a1be0bcdd63b10f84dd0f3a4d1bba298f126000000000e80000000020000200000001c60b36ef9954520ca3f46ff9f545f018a0884fb632450e9836ba8b07418d16f9000000046f874466b2f8aa13ba7df8e020345be64a53622e671eba9359f9d91c249f7139f60d323051be0ad7ba7267a7d9f00bd8d4c7c888ae1c445a48be4f48198729a69ad8fc8c87b9bb7d76c496a334f2c6bfbfb4e41b203f332fc50af6ad69b09be5a7dc58734188cb66fddc924f8a554230f2095c59e16752dcf8be6147269b1d4b90fccecbcebc5c9f3cc91b53fafdd8e400000009adeb5ff989df8014b96b9e3a57ff61fbbd8e5a835fe75d126cfdce7e1cd28319aa10385511a5af3ca98cfe8eda40e062fdbe7fef30aa2a7bf792f51779911de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2064	2684	iexplore.exe	30
PID 2684 wrote to memory of 2064	2684	iexplore.exe	30
PID 2684 wrote to memory of 2064	2684	iexplore.exe	30
PID 2684 wrote to memory of 2064	2684	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06134f55d8dfd5860281ef05391393e5264d62666639d53a87eaa213fdc9c606.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d664ede2d002e993d8cf472e8fb4b076

SHA1
e7811bc70289d88ec1010dbbc1cf9d92f755514e

SHA256
39f49b29f03e3f5549c273536feb4f4db1c6ca8e3bf0d8869446b6a8f489f9c7

SHA512
c828f7343a80fe6c83ab43cb0c2e9b07b75557ca0c3359788f6bd012a64e554d9a94e5076fd51395c2e85e5a01a59c1965b37574bfe250e28230e07724be3012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6697790c6d1afc49197ad90d40bee419

SHA1
d416965f381431095b5a6f14a46afd16ef05bb9c

SHA256
216649ed86eac020f15a2b49b9f661b3ade5ef056d358055b05ee3c78bc5b61c

SHA512
729bce8e09a217d07156893751d10eebea1fe9afd1e08c161e50e7abb067f7e57317f90059b0e1efdcc53089347812fa6aebd6a353d86319ee63fc572ed8fd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
696dfdb07ab55d5b31018965bbfa64b2

SHA1
91c9852ee018ce0149e660162923fcdc472d9bf5

SHA256
d40ed8f57a58b908e6879535b6c821abeaaa5be53fa4cede38c97dec95f8e5d0

SHA512
17c920bf4408b08f26128a00997a63707b3834aaf401e3ca0dea73bc2217ee72bb8ede4869ec8702834e966c756fac51971ae54f81b4a4008b2a2a9060274829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebac25e50dc86b8eb496e8a263927c1d

SHA1
7186e287a2b4af95703b0c206dc47892aae4685f

SHA256
c89505639e27b32680556a1270a247f9f39aace422fd4ed1d308620f172c2a25

SHA512
12141ddb623232ea775cab3deda196c59a4d1547a88dc00a6335a317e1cdb04ab4520210b445a36e650ded59d54dfa902543eb3c34e3607e839d27a2506f11c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4126f185a1044e3a242001b1add0fb9

SHA1
bb6512b3018aed503e78bd6e665476a737ab23a5

SHA256
956c6aa6444ada8498cd793f7cb4b332c50b579ad377032312fab871e45218f6

SHA512
eec1271f00b83acb89ac909f01a206d2d95a486065e6ca242bf638d7ec0d56bd20a6b22db6c820e8442a6da3a262a1697a83e249ce321c52cecb7e6bde892d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF5C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit