3f3a2c1a16748eeccefc4d68666836acedd60b1ca0e2314576377ecd91d7ad84

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/de/mmg.html
Size

4KB
MD5

d444c9aac99fefd33a40c9d40f870278
SHA1

e21c36bb7327cad5b82d92a7b1f2e9e512e598ac
SHA256

465d5aecea9c4d6d95f15faba43ef5e544f763c08a2514194079090eefd7b86c
SHA512

55957f98d14eee0d281968f5a8880de14b63f1c9b910d8003c5e97c020de13bc3a943644cb683acb5bcbc6574f455566f025049682c4ba0adbac206f7c495597
SSDEEP

48:e/QqDoJMOQ3DfNrOeyK66yoK/pWapDSB+SB5jrm9SBC986BGl1S5zAlUS6Btq6:OpDGBuDf5epRpDSB+SB5PsSBKibzl6fh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000d98bfafdb6372b7e91b2634ad5539a83d4c4160b15cdeaca1f848831299e3e36000000000e8000000002000020000000a8686ef9423ba2850594003fce599543bffd1b4f344ba96510d2448bbb57d371200000005377453faedb11a96ad0901cf6f7a8badb1a85b3274eb43fad53c64ba1d3ee50400000007d4f5c4f4077870641c676cfef099808bd6272ccab0a984fcae457bed3cc8a7569f1de8052c5560f62b8e7548ffaae5a5e24800e88005679c73e548495218a14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6A86271-88FE-11EF-97FC-EA7747D117E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6066358b0b1ddb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000000805ef5c7170482e4e22c74b577b4b024ccfadb9f76c2d89cc785a16b61ef4dc000000000e8000000002000020000000dcdd57b1611c8054aa44e68b99d6b783efb40e5f90d6af24ca42f11e6d2d666890000000bd277247aec6bbab3b0873081554e9dde46b8c4d21df9d4f50d4ae6bdadc2c51508dd3ecfd335c5b0d7f7756241747eadbe2eeab3d24ec22dcca3cbdf769b68c47113b5160992a504a6832782adabdb94a83a724f07ad206ec5a0d8d19585b536d54ff831aa98c727f86b01a6a1f5a07f988d4aa6dad8e5e55e04fc907f84faab3184604cfda341499f23e9430a878184000000000c8d6448139c742204d75e677c7d779aade691819b2cb26d97b4715fcc469d34d394387c12a19d808f0e2f0ca1a71aeee96ebbb72d749802ad4e7f5b11e7b36	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434943172"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2668	2084	iexplore.exe	31
PID 2084 wrote to memory of 2668	2084	iexplore.exe	31
PID 2084 wrote to memory of 2668	2084	iexplore.exe	31
PID 2084 wrote to memory of 2668	2084	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\doc\de\mmg.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab24af816f2e56260bf3e32672656d2

SHA1
832ebde79faf028014deb025960ea2592c4f42ef

SHA256
8de80dc7acbd07add31b240bee782bd555ff2e0e02936d4a8d65aa3021e81949

SHA512
0c85228e3b1c6c1a38e212c6664c351e2cce79453b874747c9e0f1d98f3172e1bfb3dc58ef1b12a896b32714586518a330c88a6866c548ddcd7fc75d92b7f941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4960c9750d292629fdd370272301d0fd

SHA1
17cba59581e277be280d6720441fc0f5d3d07470

SHA256
a5f46968fb09047f8a79b766233620d19b7824337926c823e74116c8d9b6c7aa

SHA512
c49efc90c848d15c6472301a9c36fa0bebf8451d50a072aa3e68a4ae14818e2b22e9b89e7c7b5ce148d90bb815757f7740297a06e6397c88fc894e2ed4499a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e830eef2438cabe110f19fb3927700b5

SHA1
b24742075f7b2c1cb0ffead24d04adf3e03d2896

SHA256
c228444f1ef94a55681fb48d93536761054d32e15b3c84b0dcc94d14fb4a9fee

SHA512
1e0510f71510fd44821d3a0321a9d2206b1888b2efd6387926d8ae08a9cf539a929c24e9bc9267f0e533acc72968becb1a58c430472ee1fac069e439362163eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cab318b9b35427c2cecd85a8a8bebc3

SHA1
e2dfdbaefefc4f6f8dbc1d7d942036808aa411d4

SHA256
5957144033bfdef1027ce5ebbbe14133e8a75d9c253a1c9a070439f413c94db9

SHA512
f39a51af433361f0a592aa226dfbd462cf0aa54ed389668e1e98c8dc8c10f4f05a3a2c80f0aeb1b108c1eba563300fd2809097c00acff0e3c3fbddc4a8c8ed14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb5f6f0519f3b85af231ffc8f86e9bee

SHA1
686731cb5aa74da73d07b187287fcda48778d617

SHA256
fab794f57a41236107e0918a22261feaa84ea59738cbf4be482e64992bbcc448

SHA512
0c68cbd44172959dda3eb0d1646500a2a15f2d7b695cf8369c2d8ccdbf1489f57a463096e33c10838ae7ab876e94ac325e757e51d2adece0c61c87024f945a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89a7e3e561275ab5f07e944e3a40a1cb

SHA1
d0a2e7a03b8fe9ef15a46561721e652e6420f839

SHA256
dccf2185bffcc394fde27cf553ae4c4c207fe1049afbcf9dbfb2788e78e42c3d

SHA512
f834a05315ffd87fe618cd202ede7c8ad225eb6fe42dae8ca48489546baf7ee2354d663afee37d63763a6b3f9614c3719265b3c9e3d9732ede731800974e30a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e9705b7b1e4d515604b84830631e695

SHA1
4fec4527270aeb57a33c34b752d31f9e71b76389

SHA256
c60b025505b6a3fd9df52d9799ba6abc62c03d157925e4f9552ba74272fe9558

SHA512
848e76d0ac32e8bc86e36436c2e40631313b9b11ee87264fbc37f0ad18751d6b49458967ec9ef5f94d9c46d259435ac31fa85dda9b1ff9a0ca8aac4a6990ebd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cd162266b795bc389f8bcd01e00f445

SHA1
ede7953d29b343d44e22117459c6107c8d11cc3f

SHA256
2b88e4febe3681db843fe46b719f9a2de8d7f5cde13cfc723fafa03c832a5a8c

SHA512
20f1b6707e0ac9e6bfee436ca9a9b0c55aebd4441a6361217963d8bedec7f5d7839742fd5a7ff71ad27fa6f9c25b8e1bd66323038d4eced5dfec68817b117e05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b432e19053a32725f8c2f98daccb19a1

SHA1
853868204e31ed60fcb466c125a294dd411c1d81

SHA256
b26fa915828df126e91b9cb5dd48751a520134f6fc23288ec6bed7d547ed10c9

SHA512
17098733b6ccce8a8573f86bbebf82b9d432a5c51b9a67223ba5e252a9019070377b4035410469f5f3f7e69ff1c8bb0cdaa4b912831f00cd4ee69d0050801ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fcd74587d4fcc2d5bf19c4eda4cd236

SHA1
3723b891e6e2a48288f28c81c15141e4e493bbc7

SHA256
d52e34031fb8e02d91e0c9079cd38458c6f3ab145398bb0b1449eb027d764b4d

SHA512
8b8f77b6720781f5e7eff5bdd0fd3115b750b225e94441b1b0482c7ff1cb87b442dbfc34f5f9c1de01358d712bb3bb2fda8a8e498ef7f10a0902857a31d008d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
965aa86003546af0d7cd175784a92675

SHA1
2c3736b3cb80c57f5a11f7641298e1982083dc6f

SHA256
d0d876886616d04a13f374ef982703f3d8373f0344821deab674e2ad1857d780

SHA512
e2486c1fb6e70ab98ff7ed6bdc8dba41fa1a73caed199758538ec414af075b4730ecd438a1a8cd2f88f3d12e2a1337700c28cb88aae157a71d46722d5d6b45ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b8ee13b75c529da94eee590c55f284f

SHA1
2477a754a5668a26604875598602073a48f1fd5e

SHA256
2297b196c1c03a441b361b70d8b093f06a04b3a71e2d587bd4449055cf978841

SHA512
68d6440c743bbfb741fb7d9dea4d0dc0c877604ebb1b2b920704852d369f88ab619c03b87f3bb94cdb55028e467f0e944a4a93966c552b75c0a8c408162bf71a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c23801a3893aca1318c1241f67c6b9

SHA1
17c14b6ab7d6f8c7a6fb16a7777a9d31686b7d62

SHA256
827695ecd3f761ac3437d6760184f3e00ce2926c2f502717201009f237443e3a

SHA512
1eebe4fe90aea8755db350a9a2e74e7a711b671bc03ad523926a42d9b9fe762532b2ac8494e0b0189b63190f3d378517f1efcff461dc89cec7d1057954ccf1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d48eb52ff639078a7000b61b7b8ab39

SHA1
10c8c8215d6d21bd8581c0bbce9cf4e56781d8e1

SHA256
d2b17e1ed9a00bb041c5f7349c48219e0d6a363390a246c6bfee01dfd86ecc91

SHA512
fd2a507288bc2eede13bee87836f0148842089828bd3ae53361811177bf09e257d07013484cded2cc6f05f7e507598758f72c875ceda31d6dfec8f66c91f78ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03feb71e1cd7f1a05f5bf2b7e75fa1bb

SHA1
e2771d6728a4e630551c36985013acdf1c8b9876

SHA256
1f4e60f27a5b78a223595f768ac5f6e4e4fd1ae5e705e4e79a6ba6b95eea1be3

SHA512
8febd0c2bd29b53eec2dab958043fc7e9525904ab650a61544df4c13cbb1596e7e90f9cffd0cfda7d216763028cbb7b309073d58985d0f6fd7f59da8f3ff4404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98002132bb4f9bf2dfec0b7666739be9

SHA1
2cee5e55ead1d4b75f38863e9f797ae58fa0216f

SHA256
d01b8e3f50b181dd98a13b3ab96150374ac7e0da1ee9e64d278bdc1a20c85472

SHA512
e996931d911e1113ce2148650f442ceed955547874ff56e18f071705826f94ee2fa13e539ce832785b5823ef73c66bc8b7dbe07b2277f9bbde66980d87f9ff74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab428.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit