745f72e63fa1a409a6d489c8d44f614a9e5d4d9ffdd2d05aaeb9dcda99116c33

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

funneltraining.html
Size

1KB
MD5

a904fef887dbe0cd741c9b90f59552ba
SHA1

291d2b40099d2d3c4081835b3b99ebebc0651f4f
SHA256

d860ed3a2d2359729fc4ca3f2ac04489ae2eecb3733e26659975da13acbb7721
SHA512

bce6f918fbd88d93e06554d8d2b3f84d8dbba6c1e02bc2abc68f89976f2e6db5c289b8a994db926889570afc04f16f9d98d457dd265b3508e898ef8e75b66201

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434218422"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46857B11-8267-11EF-AF9A-46D787DB8171} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000065c1a78408c78463f8512b76be8dc4031c58c459c522d0bf29675f221a3b6fa6000000000e8000000002000020000000d93a6ef043bab9ded9cb3798c80498bc4f28a64da2f0ffa2db9c34fb54e73de1200000006237f81f3b6ffed8db560ed0db118e29f8197a632ac4c81e648d57f301c7a88f40000000cb4906bb85ce022551c391ab3f106fd68e25296f8959fc63596e027188819b11b499d77f711a1b47413e385f1bfa45c4c0c6a1df045511db849622cad1b58b0f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00260c1b7416db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000023aa42611d2d4be9e7b77474a657e7985a59d55c3c2c82cc3eeb3bc296d2c310000000000e8000000002000020000000a11d3940d09f0eccfecb9cc2c6846c0eb1b1380dc7020d7cd65e4a87df40c87590000000b7b73c0bfd8972d7447fd6852f822dd5cd6100b7e15759e233455bc4b4e38c9be1924e710ceb966d12c517eaad033b9cb0791c18389054b9b0e8fade404f5b06ee303e4b8ac9372f0737dfdb34f152d5d2b1d9ea039ce23ce6427b6469833a862a67af08fe00877fe320f9cfb6a3511e98b344d3b325bf4e429b92ea648f8b51d237f91a5ae17432817d7baf39b8357540000000578c4635c5a8661cae2ce293a9c0a306b659890d2dd9065050237a45e214556e7f40d6d3d33deb87e0991e322806ca78b584ac4a759885d0aeb0ac36f7fdb67e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2420	2104	iexplore.exe	30
PID 2104 wrote to memory of 2420	2104	iexplore.exe	30
PID 2104 wrote to memory of 2420	2104	iexplore.exe	30
PID 2104 wrote to memory of 2420	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\funneltraining.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b285743b2f2833b0cdd35caffda38b75

SHA1
974525cadb7238f6cbcfe83c6d6ba0c0d91bb8d2

SHA256
e9558b468d2855c733aebd204501c84471f18b3f9ba005e9318813b4657cf04b

SHA512
90dfeaffb79c968f9fa9e3e467f5be706522eaa622085e42acc182655f53a59bbde10a97be52201f6a46b3303f52a7a6c6b72909e4fc748325425eb3ade6fa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f66c217a943fc60d053ed9847886a5a

SHA1
7fa287ca0ff8c41cac53ef7e267425da23a47b82

SHA256
f0605c66cc7e0864cc82fb258b9d3b7ab6da663b151cd911f6268ad315e49570

SHA512
32c26bc1ab31c05475a78343e08cc8dc8f9bc2926d4e2fc6a4aeb3d0716652076420245febf47d0038197b874fb92c271d8351b7377560b20f6651e6016c7698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db224391283c11a6823397e32bff4b3

SHA1
59899a054853649149366181828d9d3dffb1db1b

SHA256
1f4821ca5f617943aede1d96fad0e06a70321ece0a22dc64dd0959c90b955779

SHA512
6a2e066cbbd090d025bb2ea39de24c12833b67e47bdde2569133d033bd88c364b944c2de39424f0ddeca0185e0d78a99ef84f6d23dd57abcbf805da1e0118ad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68f42460b658157f4308b435da7854b

SHA1
b4d2eda5de3a2f5d2cdb6b1fae78f39dd5e0ee2c

SHA256
f67eccdc5fef127520ccd9ff7cff4c59c5d4da3dbe2fc9837be1b759ad0f1577

SHA512
9462185182e3dc1b0d7b9e745bb1b569e423239c057d37f001b7757ee4d2d5c3612e7a5bd3c3c4eca655966966be2e8d4008217e2ac08423e0e0523105287e16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86ebec1cf7a63445b494d973abbbcde9

SHA1
3656161617ae01a2b3299f2df6a67c096322f68d

SHA256
16579e76a88d27ea76590a0e412411495752cd327426fac6fe759ae30c85d4b9

SHA512
938d6ac2c32ef9c02daf9db700a43d9cd0043f8b093cfb7261fa36b271c610436ed263c267de0fca509b693ebf74cc5e1f3cc25d6ac7a5188449343a5c9e83df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3be37cab9711b7b40f2ea89cad048af8

SHA1
048c4f201bd955d3e86eb4d1e1ad683bfd506677

SHA256
2cdbd45cd472886b61b0133b53607aeb5ef0764dd9d9edaff0be39942db44152

SHA512
cc319be9cc86d8a072adc1c409afb53ae138fed7f7d5f64247c479b6ce39c02151aee3fa72442ddbaa1c2691c5990057ccec617f22d8128b1eefab4b3ca3652c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acde55915d71efe2f0dad6818880262d

SHA1
5330466bc865fc8244ed571b4f3bd1f2deb4943c

SHA256
7267e54a8f583aae740f7500e40a598befd370f7426cbf4f7ab3695010f93b40

SHA512
81f74c1072944abc451f0d7718fb0eb1c2bb59f059c975eb955b26f60fc086cb20c776f5302629571e0f1fb2bfd7a94eddd4d443ead8ec774c71420cdc5bbdc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cf9f8ec31f727f06b8adff9c2aa4540

SHA1
1d14c907054a05028bd31bf33acd15ceac5e45c9

SHA256
da30ed077a1928e158790c5aa9c5a38866c92c6e431ba7855f0ca548d7d32055

SHA512
8d1cd13c67ac5bef526b657d53eefce3099da2aac7df4a8b25918387f6e0576665ab0594cd58e8bcf9e116c57d0817d9ab9c0befe1fc2918fe14e636c5d63221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dc85836bb9dce1df402ef37278a3c41

SHA1
a22c7d21b0854ae27e455726df98b032917cc198

SHA256
5c632c2d1adb33a401cab355b5091730896e2a37bba436405428f6b1ec84340b

SHA512
91d3edf74d724659604b2b405b3182e545f14822139e2cfedccdfdea90b78f01ada5250386d8bdb2fe568cc5f070835e165057bd802ce256abb96d0acc28838d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a562c4320c4664a5636febc2ae3a3dc

SHA1
acd185edff88db205d2c83329152278daa0c7e98

SHA256
0be15c04d13eb4599c280b0f99043b873624c1905d9e23486ad3cc3f159270d6

SHA512
7631246cb058303c3be676f14e8cf727f9b746f6e5442e062d842b9a0cc3074e0758469cd8547af8ba55d4df1d560598363a97c591722f08f3c32cc3b704ffa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf13feee15cf364180afa6c1d44dd925

SHA1
ebef58655d4c8882f7aebeb07fbb302548b8243c

SHA256
1322ad23b488a46d835ac2408c611afd5e150a95ba32b5ac3b6f9240052db0c9

SHA512
d7bbd66bcdc776ecb24901736969312a3f92cd943ee0abb9612ffaed64b58cd9a502119fed6f0e93e13c3cc24d321e45235aaa833fb39ae4e3b4013ec7b65976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f230a5b85646fcab56516f815505d87b

SHA1
c62b85ada400be1c1b78733027babf434fc38541

SHA256
c2506148173aa3ef668be0603882350aac48aba8cf373259b8334530291711c5

SHA512
7895fc503d4751d908c88ad01432cad2fe7c5e63e8d6b55dbc75c1f7e68f97b61f4f34fcad1e09a97d827714c3a2f136f10399b3d2a6c3c65ad088706c99b5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
557f3234585f01f79835fe3d5a7fe18f

SHA1
e41f7cfd4498ccffe8b8443c42c50a5ef94ac2b1

SHA256
4d78d3ce8b639cc84181382f2cdf624dfb9b90984a5c06a62a705a3af3a20616

SHA512
7e2fc5758bdd79144584183805f8e3bd79d0b2bfb26138873e833e71e22466ab46f1df92b2a0ed14c34c112eabbc585e9b0b2fdfbe1255e2d2cffa47c9366ca2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
defbd3434de67101cd59f9fb3cf875b2

SHA1
d9e6c9140cc36367b4b5a4000b275d8ccabf91d7

SHA256
d7d203140e7f276e81125a8f43e916c6d79545140916d69b66b3388ab2b94670

SHA512
10109ec6c9005479b0a90ccf01a1fa14e73ab7649cef58f5d4fda8a289128115befda4a39551fd802c87e4bb0999dd3fdccc48b55b3357e699bed2a7ead5b77c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c328106542640627f7b66b16aa2dedb

SHA1
524221f244bbe377fabd552368d46f72628c4235

SHA256
59f863648c93c0a5ea0c4254b4eac8cafcb107fbb6e8a333ca4b8014b48421da

SHA512
3fbe389fab9f20619fa849c86bcaf52974f3a6534bd1911d825383f2a2e6c2b832a70ffea3cb1ab20b66e245675e8dc15e697f08ddc12f70b40a4467cced9932

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD135.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1E5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit