a262709e7106b38268ab03e8f2daa4c36dc29c30412548ed9dc070e3cc1e36a2

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/IntegratedOffer-Truste.html
Size

9KB
MD5

5951e0e6dce014feb870dbd45ffd301b
SHA1

f34ef36abf7004a8646e5e7e468ff21cab5730bc
SHA256

38cc5d151c99170fea208df9e9184c67e31486788e44194e01234f98948247e8
SHA512

0a37624751e09cc25f924e622f53f1e32624669045ad20d43f592a660e878f5b8cf42c400371f99ef2dda069152873439db7dbf3ef20881afa08ec241b0a39fd
SSDEEP

96:dsEkV5dynO/34r5kGk1wqJqQ149JOnQlVewEe399xkEEl93s5SzZCBskp:v65InW34kGka874OqnHrxbEl93fMBN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bfd1bafd19db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000824615042602ceab7129c67215f747ea1e6749f05a36da0b64b4b4e76020bc70000000000e8000000002000020000000acb9eab6314047f4cd6b28f65aabfb0dc35550e0dc703c03549c5da7d7c9434c20000000af4a25908741067bae117b9186e939f722d3f2cadade51336e0d30444c7d810240000000e495c972a101957c7ef1c03dd68e09d7190f96e367da03461985572fd33eb1d1cce11d785dea480d3add2c5473ed531300f067af794afb13856296878d04c057	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6487441-85F0-11EF-8BDE-523A95B0E536} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000719d63bef3d8f6b61401bd692881a17a547a01b5bff1ace40001619194484a3a000000000e8000000002000020000000360a80b9e5c2386d050af74673000622a2634e2a1e6d644ac100ed15c0649f7a900000004698e49bd1d854876178b13de83c4f96a572d141d639315b0cdf54c1aa275def299345a817020ae1eaf4efee0dfd592b8d1e9071afaeb394ceaa631bf3324a95aaf4e34fde86c4b1b20cda94461af97d7177b8d338e9bd516959326b908cdf28007581a9b984a4651ba067e3fdff61207f698eddc78d98d95ef70c0dec27ccbf3e1142ee329fd210817336e69392164c400000002c26403c38444ebbb5b0026c97deea75c1055c2ef134af9ff8f4f32547b0360fdf4a4c766910dd7081f24ee3ff2395d1b58cae7b4d0987b0acfd457902b07164	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434607384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2744	2860	iexplore.exe	30
PID 2860 wrote to memory of 2744	2860	iexplore.exe	30
PID 2860 wrote to memory of 2744	2860	iexplore.exe	30
PID 2860 wrote to memory of 2744	2860	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\IntegratedOffer-Truste.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c973f8adcf6d9db985b485f2cb3db94

SHA1
e89d2002886265088aba7a57196db8fb1cdd85e5

SHA256
7967f1021aab5325c01a172ba19272f1fa530ce6d6af5ce4cb1eb4ac4af769b5

SHA512
08083b34ca5cfda2a655f98d42cba57f7f7de3219a4dc2ec2834a73cbacc9ae25d2339e6de589a3adc72a3d06313bc6749f36ddca60e351294948c0732adf629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98105f7d9e168357ac097c407cc97045

SHA1
dd72f40ff891349ff2e7b96774ce948df2c04e20

SHA256
762d941351f37b19d345992046536b869bb0d00019a1ebe2e0d4a21d3546978a

SHA512
456748a9bdf5524f3ef44eb82127cdebc405c3b40472cbe6ab4c4ecae19548a5b9a189da680a47f2f97402f5516651482eba2b1e817b006505903466d572a390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1609b6c228baa3850c9ddaeca49140f3

SHA1
7775085931e0e90b21df55d22fb105547395c5b6

SHA256
6eca236eede744be5125f07fe70b7822912735a0a3c5d26cfcba78eb32e2f5a2

SHA512
0bad0ca525354ea6c48134f8c277eb08e7fd970888e740b381103b24cd64792157e209e77904b68bc21b8ccf23cf189cfbfa148486b60853db6fdd89011fb507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1be705778f007b3a337aac5a50e825e

SHA1
0050c9acf2deb29684d7c0f8179eabbed09f4d25

SHA256
6f891b18033462cb146af27676505953fb4fa240a43761a28f3f6310b0856daa

SHA512
9b5a126d7e1e24803f8a81d745d8e781006de72ac378776928c484da64b415c964ea0f95cd48f0a11fbf387d5d7e950c72be595c9718b7c7fd70ce182f81c5e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df30e6d15c261b0735808f1a81463310

SHA1
0202d1ad46cd5f7453154ce0c828f569dca4c2d2

SHA256
4b4b0eb09fa12d3bdd88004adcdf560732587435902a7f3cce48873ddb1826fd

SHA512
8cb74f70b12b47974f1e3f6cb0ccd992b653e4446ab872afbeb0fa9f43c5b18b5f734aeddb8f03ff11396b8bd6dd586fc74ec0d0cf18228ed2e9c98a19a58e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad01a8f9fb22fb544b155e5a48556644

SHA1
4eaef8958fb1b52a063e687a63dae99d3052f9d6

SHA256
08135cbe51b6d5e2437cf155036b01c4d86928f5a49a959f3738526183193c8f

SHA512
d92dfc0d9862b5858c6d503c46b8ba71456a1a14aa84459ad2e2ec9add26c530a9e5137fc1768489c34beac42ad8dbb9439b2d94ec9ac15cfd778ee83c1ddc45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8b47c64254e3b2ef2e9c496bb2c4964

SHA1
cbe3c149ef7aee2448fe11ee5930ee194b41574f

SHA256
6e776d9b4b50a499e00cd50b1841fa393de3a11b828efc244048dea3b874762b

SHA512
0e2dc37727b6fb138e5c9a21d5f66f610c5036882dc65711bd6e791c0c84a1f617d618945492227b7274f607b0230e6c11e7fb2766d4473e64dbed57240b6573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c17dae254926ce072c3a8b12fdee66a1

SHA1
710ec6e0f0c68f4820e3c62642706d2003c38eb6

SHA256
8464fd1e175629a06c673fa708ef7076270e11b177420d9110165dfcfbc71313

SHA512
6f18d9cf7b50b0b6fef964aad5f39946dbc6e7fbe4ae2268dacea565e8cfe75f2925d1ed18a34bb954a0f1fe9916a9ddb95851b7ddca9e6f3e0f25e473fa49ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12ff56723a6fdad8a87fe50507384140

SHA1
46adc491d7945e43222f6dd26225e76712c06611

SHA256
bd3a6c3381e84f99b74d10d3fc3c10a04af8bb60c2871aab975ef18c85b34589

SHA512
c9fe836b64786e3b25a33d47d8edbec0ab6401182f3571d3e02ea048bcb8e2f149d418e1634c8b3a69f28e058091b6f507ef05bd1353e5c0d66f0027add9d136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5e6b2cae6afa9ed4b15c36cd1201057

SHA1
26a724dd13f6f4a431c7b01d460ecfaec9adbeb0

SHA256
9c7c66833eed2b288d5d2eaa1ba3b349b635b0fd48f7b598cdfe524b4ef6b024

SHA512
ed9e90ade60d66f903e5f566d024bf04123b055c1592fc09ee8f3bd8fa2eb3848a9451b5d4c45bb318e743a08706a7f581f85f925264c40b0ecceb4b70133e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bc3453bdf91dc757985e39becfd07c4

SHA1
4b2322a4274a31341e66dfb98c836d607d4e762b

SHA256
e1117c1898c837c6d55ff9092efb3b2bea944a9a6333798f55ca2fd0051f2a79

SHA512
be538aab25f413f335f31cf2210a1fc5c3bb1be069d7d1845553c1643d4292bc8eea2bc4f4ffef4ada2c961a1c4fde0c2ceef4815699feae09c888fdead3f27e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab85C6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8636.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit