40a9645bda60d02110386f884b8c7e3637e418a04f211949eb883af6d3414845

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40a9645bda60d02110386f884b8c7e3637e418a04f211949eb883af6d3414845.html
Size

1.2MB
MD5

fb3e2b414a9bc57864d40007c7706847
SHA1

86184ef8d9269c247bcdfb7e77e792d7a0632e71
SHA256

40a9645bda60d02110386f884b8c7e3637e418a04f211949eb883af6d3414845
SHA512

543a3a7d6138733359c05ca8f08f2615871905bdcda0d664af976a314a9b78081d7d1c56700b8c2e9e3dc0cc81d5603124b6275cccf3704eec0c2ef4ad002b5b
SSDEEP

6144:++slmEIFibiDokd29aD3GTf4j0F+la9UGEm:Jicm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000b69da76f167b9cace57fe01f9774f97f13ae2b062456ed056b3e2102360d1601000000000e80000000020000200000002d93196558adfcf112527eba1e81adb078b676a1c3863927d2ea2b6acaaec0f6900000001d2bc9fe6e3f834958479cb5ace5d3a9b9c278728f2093a6a3375ad399f9de0bf3ec7efb9f0fd749c6aaf8bacfe2a64ed8ac42f3e422a1479e4f6781299f3047fe19735ac1382059a1dc8f69d7d5dcaaa33f6f2a5f248cf17ce91f2298f408590796bcb14004aebfd37460e5a6c12ca74b215a8620fa8d4712f426aba98019a1505f306185c77f2192d9a1d1baad3d8c400000002d0b8ad89a5d3536060ed4218bd1131cec299f04beaaf8b020f2a90135bfb8b12ed840f496bf4937c20887b49a0fa8250dd10848f4a41c9f4297e4d4d09ea212	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434379457"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000eb3efba82de1acb5812f1558bf7774ccb418a0a822449fadb71a0af877b0b71f000000000e8000000002000020000000f92799e226b6fd4aee8e55e97005ff02399bbe247a8a9d54cd080340fbc855da200000001c690e5b273701eaa9d8c5a6e4ad77f0bbbc3642d65e1bd57a7221d1b8b65ec0400000002f5945bdae6e3250f4951466c0e3a79c39aa165c344e885649f11392bbc8c029f7d1e9ee504648af263047b5c3997c3ee145ea59af4bbb31ac7923e0565b3bae	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400e0d0beb17db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3689D621-83DE-11EF-BA28-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
632	iexplore.exe
632	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2316	632	iexplore.exe	30
PID 632 wrote to memory of 2316	632	iexplore.exe	30
PID 632 wrote to memory of 2316	632	iexplore.exe	30
PID 632 wrote to memory of 2316	632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40a9645bda60d02110386f884b8c7e3637e418a04f211949eb883af6d3414845.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b363de494738e277c714f42432243582

SHA1
091c0da1ee02302f570e7b805383ddcb35febbbd

SHA256
af9c162f6aeb263178d8d5b8c893ae222ad89bfca3b76a8ebd12f3cf00c40b15

SHA512
b1b936d5f80ec7c152ba706a8bd0cdd86bb29183074a68ff7fa8f76d98dfcef7eeb2075a3238e2d77273004b00eb477b9afafe7ae1ce4740075c97dd712ecbfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2034d4bba38995cc2a2826dd06e22265

SHA1
14f1e8434dd9fe0b6711d976688faaad05b41838

SHA256
80e513764f15f03c674053c662659073e2aa17b88dad4f8b367c9cf483cabb8f

SHA512
f70b6aa4ecdcbf8085fa68cb7edca85135ff572fe9f15f2a0e1b24134641a49af0e780669568309f75174d6bce2586db591f492a6dcc734c6618b261610a2399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6296bd1d0db32cbc6b515447d61b6a03

SHA1
84f23076bde45bde8a79cea6d7506e8eee2ef778

SHA256
5507bf2084cfe4556cf58e43f96cd851e7c33d04ef1095aedbae7c88b11e115c

SHA512
c30b2eaabbe9e15c5af8116ff97713a1e3e698bb4838ca751b5adf7f538cc1c09d509166c6c0fd3187a8c6d9e56058f5e23e717d836e18d866347ca3cd48aba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c44336e4928bdd1312766dd1fc13b15

SHA1
375282c0caf8c46faf84a483c1f7febd7953ebee

SHA256
82adb5c6b1fe48a17ab668de8e6cd30875a1a27d77c62326b56bbaa0cc882ee4

SHA512
707b653de9eaffadc154d8f54c31b7a77a4deaf53747b46ea174ca4986593d6b8341e33f2619bbbdf842041682b65fa88c159ec76aefe66beb735d80dcd9c204

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de7ba31781129def4593831e8ee6de0d

SHA1
4d9ec8acd8116fb3b47abb3e65fb2c883e6745d0

SHA256
7ca79fea203831b30fa10accf9001624432f380cf2fe3d0df3f9d7b6935d1433

SHA512
e906000bfce9a96192d1f304633be02971fba1f5623cc2f67221f5de2390b8b7a926bcee7ca4b229185db0fd034b2f0595e8454e40e4a84ee1979ef89dd1513d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fe6939fb1f81664378b99b5e5c1acd9

SHA1
f95e99d1fa819486fa08e10b180fb134e7ea2497

SHA256
3009c66107b807d8c46d6e04937f4eb092833b9cfeb9dd6c2d74ee10ac5d4f49

SHA512
88393ef039178596e1ef779ae92ec6b26eb605df30eb4ac8e3c84e36f5ab4bed738b25aa39fe1835843dedae736ad9cad3401beba9a8a285ad9b1b2af158fc4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dfaa4a01e9d88570f70b3ac5a391635

SHA1
fc5f72f39ccc26690110b02fec24abd7c00b23f8

SHA256
e60b30b23fb33198478cf682b0c45d6fc3c32527fec0d7bcc8aaf5752605d787

SHA512
2511d85abb80bb109f4cc34b5c234d61d36b918a605c2c8bfb1f3aa82d8a2054eedaec1f27239a3b514484710cb3a9e00f84e3b9f12e8be713af1f4521d3e4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac954425e5f70e7f5f50a7e2a18a0204

SHA1
db15c9cfb21c82f934db92967da5c2cff49c554f

SHA256
7c7dbe66c3109c9ef5b5cd9fe3a2044345affaa84eac985ea350c3c906140d9e

SHA512
26fcf945e9b5578e3eed225fde3ca76d812d524a4633a99fafa33462211187db84ca46be557f9c874e1ac0b2a5d2618135eea41c6edbadd3b2ef2237c2f49acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
715821cc62542836d84bf2593f7ac293

SHA1
bac2f50ea86ab01c513d866de161fd9a6444687c

SHA256
6bde2e95f4dc334e198af5d1b9334d8e70c9999d49c91c5de9f5690f804c150a

SHA512
db987d6cf77bbc619e7a073b55ba9300f3407e86b2cdb2b20540422a07e65e47b755ed0c13e98d2e7b28dd01a9e548639d2ed1f0e027db2f435cd7e8ef5a80e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f56050357692a17008ada4ecf93ed73

SHA1
a35102942775640b2ffe1ee98c9500618fd77d04

SHA256
140d6e023ec5c27506e1af9595b3c99f8f431ca9a54df4c83dd0f4d13e6e7cc7

SHA512
21461ca8032e26e93ed5e60393c3d76bb4192b752948212240fe76f73096f61f23fac5583c872cdf4005327abf111679847b34b02a62fd339834e45fcc0987d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf2b179e28442890bd2f7f7d550e98d7

SHA1
88dd956c34fc8bd31f3f71f590f187ff177818bb

SHA256
04539f9551a5456a9d7815be3930240331fad938a136e8d6a69a2a1619899391

SHA512
61f4fd978cc33319ab8a85c543b65f6d472b597d1c7a9a6fc0f7bc774ffacc0065b3a2572b24e0a2d785420235b89d0c9760930ee693e920c995c792df6c65b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC02.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit