3f3a2c1a16748eeccefc4d68666836acedd60b1ca0e2314576377ecd91d7ad84

Analysis

max time kernel
139s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/de/mkvpropedit.html
Size

49KB
MD5

4a21090ffdc15394ea53933b578400df
SHA1

ebdb278eb32d557eed111a36c802fe6e90e5d581
SHA256

d25bf511c60b104e2e7f1c93784add22df95a4fe0e82e2a2d77ec230c5569531
SHA512

578977fd2032aeea97cd68682709edc1363a85a3fed612ae52117565d8de2d4a116dee65eae0c56072d6a9a7c708f78fd1810da1b0b67062951a4e15719d1f31
SSDEEP

768:3SZWv40UiE3eEwA+gXKVyudHSS1IUGTmv:3Sx0WkggyuhSSiUGT+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000aacb7b0af4a6371d8e5eac20084090fc536c6895c7365b04cc9d22275cc6c8d9000000000e8000000002000020000000e62bf53ca7f11c13ffb2fc3545c861e5366f0af14d52756e0ae5dc86c6429efe90000000c4c38815771d08e662429cfea4a08c0b538619f29d7a9426e0070934a73ca8fc60b1860b51fbcde8b0a5fe0749d620b0efac093f5448afa34ab26c874c25e54851787063178b136a3235c1693dd13452cebf4a5986629cb1f7933d9cf7a930787dbc35c93e0169909b1d978a6983b8211eb8c6fb32308beb8f4d51a8db5eaf22cadc03f0b3011f1325dda2340996f752400000000a00325d922287b55cc2cf9c6e3a06cc0da682dffd608e51611b0bc60a45f70a4b3f9b0bf8349f8c5fb36c40459f819f998ab21ea96d1ed02219d71e0db41ec0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434943174"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5030741-88FE-11EF-ADEF-C2ED954A0B9C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000ac3344a809a9d72c23c20904cf6389dfcaac1e0e28e94a4e20188bbfbd8db949000000000e8000000002000020000000539a9f3647ade46ac094af1864b9d285387d58701cb7b31c11290795c95abee820000000b571196faec52a5f880398db02076a4bcd048462e10bfcff67afa756dcf7a4cc4000000065774c21c6ef61ceb67927d2fb522d0764d9e9766a46450e22d6dd96151dd6871458b39df28a427257851626b67f218f074a47cef7d6599812ee82a709a403f3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f3c7890b1ddb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2552	2708	iexplore.exe	30
PID 2708 wrote to memory of 2552	2708	iexplore.exe	30
PID 2708 wrote to memory of 2552	2708	iexplore.exe	30
PID 2708 wrote to memory of 2552	2708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\doc\de\mkvpropedit.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e482f825e25f2de87cab8bc946b4a3f1

SHA1
1fd3fa11f4f11d93ac275da35003b982f583f892

SHA256
29feef0e7c8c20e538da711f0284f34f2af9a417cf3a4b294455105a502c6dde

SHA512
02ba2bf4b5e3df79872c0063f22e9325c7f49608826537c0e4ba4e1565623a81fdaefa0c5f7c55491d35c3722efad45ac9cd71974e96fb8d5ece1f5b66df2cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2c5e5159331a8175b3de7526947641e

SHA1
74ba2187c4c7f3fe4eab582ebd16ee2220233876

SHA256
5c77ace317fac3a974f47283400d83459070f3d2db0fa4e914497aafb747f47c

SHA512
0995d8963eb914a7154cced6aaa294053c9701e6b4b41cebf2205ac651b57a2a4caa4aa2e11fb1deafe3d8d175a11368478c4d4fca22af37d2d5add3e74fd38c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1971faf4478dc24dcdc7369624aa2893

SHA1
07fac439ad647bd0b25806ee7fd736f1fb21298c

SHA256
7a36da577b2299868989c8f32b20ef8af78ba728f3cd43bdcc894159c2863bd2

SHA512
cd9ac42bb938ed01406c8bbe01a002c4043449efcb6a2d0a1718c5deb0788c4ede3f5f5393e8606b9dcbee52d0db608b878c23b14980572123e9a5b45e4e6152

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
742cdae99c2870d2cc670c0c40d72e3d

SHA1
5ea5fb476f21cc5d54cdc8a82cb18fbbbfec683a

SHA256
d707a836eaa4a4fffee8802bd3c6f9ccda1ba9227ea3f101ddf145f296d6e4b4

SHA512
eff6e1a83cb2e4a13608c2139d5b05a875bdd6aeb085db7eb52785b2bc07353d2322d02008779be51f4dd2024cd73c89f4900460e42d9dc2cf4cf65a4ead4c2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a5894f5741b99cb4292d4e665081db2

SHA1
c04cea02d3c58fa7588e3f9fbee67f953288d54e

SHA256
45f992fbef407d9cdb9e3c6555888dc0d738e8bfb72a86c76c6edfda4b1fcabe

SHA512
3d1fff189f4fb9ee9fc10a2d6815f1b88fec1c4f63f873e35007c0f34a49f9e3d9e3e604a34af93035f86d32564a4ce96547872688af1faf9554c43229148bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5878470e1c433a70a28e6baf7b5440

SHA1
6346d1007c2f1c1f6f10348a0d0a1288c6651226

SHA256
ccfd876537a5bf89286792969f22451c0d87809f20396bdf5cbfdf2426d3a849

SHA512
dbbb5eaf5ff03bbf83771d0687055c4ebaa2356069195aa55340754b13e3aa16f194d76b2df086977b6aebf6f68a0e5995df079ed74e03f795b94963c819013c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd4bd6e420cd71d47193ddb781b0f599

SHA1
f3acd896d9bf3cc740abbb9250583754f94c500d

SHA256
8bae3ea1d2f894ac2f7893b1de3fe8fceec35e3c3bb8cf4c07395c26173d5c6a

SHA512
591d2e8e692d9420040744392726162c15d4284f09dbb34119d601812da512ac156ab61fca0c9f9bdcb62e1a5a8fadbdd345c959dee6f473abec266081dcaa81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef0be6d3ad87d29246eec6d1f6191965

SHA1
a5065b275762ba22d8e9582d5a09e432814c0d1f

SHA256
02016919680ebe3bcf121c86b2b89e8ef7e6d5eab82800a21e3cccae82e05986

SHA512
fac0ac8f4034450503e76d0b3d5ce3f8ef6a1a9345372761e0e6d669d9b577aaeefd886b0c82ec566b1f36192b1954d1fb3b8dc704a793cd7fa728397bbcbe01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcde5bc6dd3012ec7efadfdbde8b03a9

SHA1
ff39338dbb9a18df525ca67514e758b10dede576

SHA256
65b502fef9278749121f68db6c2bd7a9543044967616740fdf5f28f06656c37c

SHA512
980922c25676eaec7002852bce269a83364bf62211c35f44251acbe2928f340621da2bf0eb1d552096e037bd0c9c54cf1a86ac289fd6e0b064cd566dd7f3943a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194252451ddbdf90edb6b5c8f28f0389

SHA1
5e31368ea57ae204ee527549a01b0af86a93e6bf

SHA256
d571a939d497fa3dbf34e5941d68c848e9448efeea1f54488b520abe83ffe4c0

SHA512
d3e8ab0a8f4ad547f518b18a18ae1711c8f26ef749c9eec839e31384402c0f7ee3d9b7074cde1dd94d4fca7f38ba3d5c23d0a8b0d477bd3679711d86e8468a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b362bd93d793a678b59a78b71b20404

SHA1
a971484292fdfa65b0f5473b6456871d36ad3265

SHA256
5aede4a2823d2d157c92e2fe433c8da2860661b7126acff97295aff852fb0731

SHA512
c4b11c6ed90e7636e757cbbfd0dec189ff184582edd1dc23fdc371dcd3f155f436cfa300824cbade6cca6aa84ddb0df746f3f07b327b5a495821d18285f7def1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff3c9bbeb92ecb8ee5690037f83db1cb

SHA1
aafe93618dea2c98b5091fee070efb2b8d4da0b5

SHA256
696305fe14521c259f92558d95d52bb2c653817bc470569e70cdfa41b1294adb

SHA512
12024ed4b64e43d1066a520e5c9353a22d323e37b37601c3de1a981ea41f9796f120e2af90e33ae918718bfa8ca52c9b200e3a17a3370f2cb862ef428c41d659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73be0fd23bd98c0bb6c90d77f06ce110

SHA1
a1a9208e8aaf75c82c0d7dcbafc4ddcb69023906

SHA256
18ff5ec65e91caf824f9475a3779a0358b59dc9e5ebaa50e7964f9a99ad14e75

SHA512
86095b1c364566d0012bedce8b589edb6edfcfb14f38b0d89a65db03bd9f4163f859368f17ed36680bf9eb0e2fa0cca3446aa3dce1d5a59c885a2fca3bf0efbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
279ee13dcec6c3b09f134a141001b8bb

SHA1
e34f6109515f0179104fd1f54a449ec862e146b9

SHA256
02037fb202cd62a208fee1c9a08fb2fa6c3f0cfa61e5ea7a11ccfc9cccd4d8ee

SHA512
6b70205ef54a6e1b36fccee3cc489cb68b1d279eedc98d1f36a39e6ec6b550089da6153ae177cb33ca46548c00914601c595f9f9e949d557a0d6fb5ac8f04b3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be13752ce2270ec882e253518852d4c0

SHA1
e969faf41bed211644bba2e18ac1bff0a0f202dc

SHA256
50ff661a886a46b73376ddd3112ee35741164fe2648b8a9ab776622b09cad078

SHA512
dbd086468bab88332b2988a5706b6e9d9f4fd64d3db666595f58eb801d5cf48d1376d466e6d12d19a9cd1f3ed6cb32d83b178284e4f164733fe36a61f9640765

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD30.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCDEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit