ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

1KB
MD5

84238dfc8092e5d9c0dac8ef93371a07
SHA1

4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
SHA256

ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
SHA512

d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFFD5101-83C8-11EF-A0C2-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000dcf358aa78a14e1c3830e753ea458452bc015eb81b9f83537f09f05b30b8f393000000000e80000000020000200000000b60c36794dfeecfb41a20cb01356dce07fcbe5860db69ab16b5c9f6acc52b6420000000c7182835b8c5ae3e55494e87522e4ef337c6f98b52a652464b127e3b4962091a4000000010b0ac390ab073de668f09cd5722683085c54ead1eedd49743079d55b2c78ab52541887aec79b45125453f5f9ca014b04ac140885c3115f7cfc4a02d51fb5184	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000932e7386196fd5cc730c040423b81b69030b6746d70b8306c28e97832c7c9881000000000e8000000002000020000000e5392176e3f67feda8c4f782c94376fb3a9641a59530cc3c9aa3043f334f1fa790000000ce7c73e8b12a30b45677a276d2c3119a39a053bde9cab0669e7f0ba8995d976b95b213e74a43f0593915ce0a2e82ef93530efe8cfae6d8f20c9509f37d76442964f550b0992fa3e206da223c1912021f6ed4dd89f8e42b9643c0d2dd42c35acaab6ecb67c7feb2fd719aff5caaa7ee534526da98b5d809eaa4e3e6053bfb0260d05f354c01d7cecc45604cb4c049fc7c40000000e4b102089b366344770a951c00234c1f7ffb76b9e3ab8d62be73724b28bf5c7b2b9b7ee56d7e550bef58f2e1bd70b7d20a222586d28195155e0bbd6c87f9f538	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05776d4d517db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434370355"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2884	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2884	iexplore.exe
2884	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
2884	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3064	2884	iexplore.exe	30
PID 2884 wrote to memory of 3064	2884	iexplore.exe	30
PID 2884 wrote to memory of 3064	2884	iexplore.exe	30
PID 2884 wrote to memory of 3064	2884	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3f579508efdb354b4f0ad809eb354e1

SHA1
7523f936508d6c30953be7f7cfd84a4a40f0f40e

SHA256
8e670d878d6c0e466622b4107788977656971197e7b5ff0d6d749f32217f9390

SHA512
76fcdf9a34895b255858a0a7dd0e6d964f1182c5c41038da9d057b596371efca626526287c4b6ee4f2e078e8b03a3f8c66f8aee76e1042f9cbbeb74ac869a7e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3add921aa2d2bee87525466c2425b53

SHA1
f26f7e307635467bf9c1aeeaf6a0b4481c4f5578

SHA256
a25ee85011524a092b9bec4d410cd595166bd75a87a430fc391bd7346fe1a30b

SHA512
fc9c721305f6487ba310953f7062837f1f1865776037b80512d6cb91cef55e024245697440c88b3fe1748063b0049b82da1c8036695795eb737ef0887badd2fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cfc8fd4fdf4f8525ec42b9bfee72c25

SHA1
3e88ef5ce426ed8d8a44cf1f65a8f759e5219cae

SHA256
c68fc06bac406f4d86117c27fc23f73101e8a87a0dd3a9aef5dbd1ab37d90a05

SHA512
ffcca153e3a7b05204569afd04b6a62b11b0b183d2b38145bf3a29a3a49699bc59a77c4f05ca9490434f9ad3cfcbf77356acbe748d16258092aa719f3b12c079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001930633f67f1869c34ad5baadd7071

SHA1
fcb3aeaa4566c527e63828825a45cd35bb96f582

SHA256
3e92e9d4bf157cdb811796c2f751e659f9c1175d651b50bb908d1f288216fef8

SHA512
7760a858ecfd623fd0d5b5f977392870c8e3e7b66e91225993a338ccacd888bb9ac083cd364a4431cf6d28c9f815258cafbf55dd369cc9fd2706104e84a57dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ee4688bcbb490ad40ebd86a576a5c1

SHA1
62240537bf4fdc36031c01c3d23690684090de7a

SHA256
f3ffcf5b7a50246d0d9f7962eabb876a64dc1264be2611b23cbb8f850fc1cc41

SHA512
43e35ea9263a7b7a4b090cc9bd0ae7610743f7baa93fd8c011db450ab6324300d3811ceff8ca198430d46ba6596985c0b2ddf5774d05a7cd3df47eb46774bd5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890b05a63f859c75a3792d69b64d5f65

SHA1
3b7b4ba0bf6f50a403d46e747143c73c6b9bd1ab

SHA256
9f042da3502889bc65a48373e7a37e90d59a1380e53b020870d85e6c04d48ce3

SHA512
2f45298c5408fe2dc14740dad47dc5e040aa1d741223cc8248531440f225a932fd4b44863dec19f23dee03cdad68d964f8ea7f5bc67e8a5fb5a5c246b7d8d829

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a035c6249152f0d1325cdc6377c546c8

SHA1
1d75cb631969326d1c375a3115de4c455215925c

SHA256
b0fbf165a7365249d662544fe788980d1019c68e93ab5799809c5b92927179d4

SHA512
15ed2a50071e6e4962016b7cc5222063fd1e858b131d2b51afc063dc422ddbefeabf816c0a0f197bd4436f5c8f1d25aa57eba14ac549edaef92f898b4c077433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d787b3eef297f498a7c460473ab30667

SHA1
1be0dcb13b81252a7205679c4f95e99f5d3214c3

SHA256
a6cd53921c02d0b65ec4db38545f3ba6dbf6ce23197ab17f5baf5890bfeec70f

SHA512
bcabb644cd1f525cfb67e95829152b02d14717da70adf4f71fe5d2a82874fee764f1204e7ba5ba2a066af72007c952e27f901f5cac15d1b4edc57a602c38f011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17243fd28a3b49736933081860bebec4

SHA1
198d8586d0772ebd13d32682f6dbf0d2896b21a7

SHA256
98afd2adbe160ca1cbd9daef34a1720f276738adf3dc8dde5c849f73935a83dd

SHA512
fceb0d04f4892704135a2ec3dc12fdd226871419c4b3ff5118bde329c73bff160f2eaf6850d75ab1720c68417df91167ad1a76410b72599df2b54107eb568314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
300ea171141891f56460ec0371492363

SHA1
c926b4b32560801f43381e356f494db510826b24

SHA256
b7395177b67f886127a42616edc52c866e962b6deb2a1f96856fea8f96868e13

SHA512
545d561d1b1e19fe874ddaa5558d7785a68805f6bd8ca609804350adeb2f9f6dd6a0d60f49913764e3a76f04126971bdabaa7cba7dbbe1fbf8ae2aacb5431b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8d9bbf2905e341fbca04a560bc403c1

SHA1
e8458f7b0ce67391df0ea01ec783b00d288d1d18

SHA256
42927cf1b16d6da45a2c82efd7f5616231d17063d767cce61cede18879aefc84

SHA512
68ed1f148b25b6fdaaec0bf944cb766526f756322a102d880759946cca4453fd2f2f2680f4ece83890a172c53e005b70d67551da3fcbc66a86c5a1d4e992a03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
654c67e8ac618a63770be2aedeb20571

SHA1
db077e9c0c51b0a10f83745be8bd694afbd9ef96

SHA256
947c40a85b42af6e6da73c20f02cff7110bdbd727beddecc98483e113dbbf75e

SHA512
14357c6dba6d5af09a1041b67147bff61c1b1d8c07ee70d09384130dffcac7ed57a56a8d9f810b7596ebf5e56a895b27fb5bff83371cdac2507ced7a108521e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f41782d8cca69b50a966de571fa79cc2

SHA1
3864ac2a525da3f3885fb9a515bd6ac7831cc003

SHA256
91c81e769d37a8cabdd1ab23fd917256e259524d10c1a5e803aee4e3e825a078

SHA512
416b428a4398a1e7758ccfe281f6b81bc768984424b76a7e652a74220cc0cc301870481caf9d46c176eb06fb85c41f9a1b6737d12945bfc95243de43a90a06df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A61.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B00.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit