hxxps://github[.]com/pankoza2-pl/MalwareDatabase-6/blob/main/Trojans/Windows%2011[.]zip

Resubmissions

13/10/2024, 17:27

241013-v1fj7stajn 8

13/10/2024, 17:23

241013-vx5d6asgqj 8

13/10/2024, 17:21

241013-vw7swsybmd 3

13/10/2024, 17:03

241013-vkn7easaqp 6

Analysis

max time kernel
51s
max time network
63s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/MalwareDatabase-6/blob/main/Trojans/Windows%2011.zip

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000007a494dce8bb64d4aff0b96ddd248efb2cb38af594edc0851040cbbd4f927b524000000000e8000000002000020000000143c82dab1bf5feb3e13d6692f859807df5099e40c79c79f77effd4a215ec444200000001978a709f2d3aabd27d0241b6a4cbc89ef02259aeec1a8a05cbf56b11fd4099e40000000a721bfdd02b615cdd4949ddff1083d486da0093984a89a6715021f4fad4601fb4f652af48900707455fcfb42e96e95b38700b902fcf1628ad84e889d62d1aa59	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000861d75e8dc352cfda6a9b7600d4a93e0c5d815c3376e84c74fe293a757389149000000000e8000000002000020000000b05789fefc2be215ca7217e304a5fb359337d1336c344d40b1fdd2dc7b161f6c90000000fe136162cf9c681b38a0770d67e5e057ddfe89f7e20b1e2721b18976e6bed8ba0eb4a5900bc5191830719b5deb02f311d936a5de4de54375910e74a7ada8bda463922cfd6b88db2c045ebf12c7cf046d846ca8a286a9fb90f84c3f102849aa99b47a22fd3a7f8eeceb7bb557ddb7a92e8e1e3320c5d1fea849a9b4d0f591f0caabaa3487829866a7f192ea6c4e9166f040000000161c651f68d467c0b1e218c17ca1f63a4b1c6a796a6755ea4827eb7b61da429270a7583720db11247fe84a1f81da0a0fad51563e7014ada0fe88768f99385d68	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E6E0F51-8987-11EF-BF50-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d1667c941ddb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 3032	2540	iexplore.exe	30
PID 2540 wrote to memory of 3032	2540	iexplore.exe	30
PID 2540 wrote to memory of 3032	2540	iexplore.exe	30
PID 2540 wrote to memory of 3032	2540	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/pankoza2-pl/MalwareDatabase-6/blob/main/Trojans/Windows%2011.zip
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
f10c7cf332957fd6d0fc766a08cf7deb

SHA1
f206c0e193673555c5dd1c37b30948bac874177f

SHA256
485a02ddd21a9d1e715c677a161645b04703eec8f95323834c768913746a717d

SHA512
83c3f48b0682983fb4bd3cce54bfb150947d3492bc776091897f9b43349fe901752e85d9f577ff28e5f215ba1a62aa4d6c69a110c4a6ffab2d1f680e8cab7cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad20862a69865536de5bc4a97c8c9e3b

SHA1
003834f71ab8a51a52cceb875bfab44509da521f

SHA256
355da8ce9c2e17ef1a8148e1183334dc904b42859c00819808ace20f57d20251

SHA512
bc67212b59caa928989c24e116d2680350ac16d46354766de8e3a3c311b721dc01cf73230345256573844e3e0d2860ad89e799d925fe29c19e8a1890bf81618b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f5065ddd362fc9b885113541db949b

SHA1
6bf595d3488286d820c9b0a95002f879e412e150

SHA256
763c14afb92621e95a8c27679ea870c410cd2988f560569c7968e147f65806b5

SHA512
0279217746dae7c7c5991bac7545fc5c60fa274b4cd8c1ddf14ae5590174e3770528b62ca98fa036e09e6b1755a8e4bdcf1b493c9b9a593e2c0abd7148c6a5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66fb37676834bbfb847b9b9bbe095e9

SHA1
d06e30d322f50ea383cbe1d890d212b091fdcdf4

SHA256
67d0248a61d7469f91e2111fc5558d8bcbbb33230c61f870b0d20ae2e4d18a4f

SHA512
b620b9a0a1b2bcfc9c16df85aa88d3fd38c6424a80c4e534523389fc96557eeffdb6b785ff6e3fd2271c6316dea7801402d5936838faf00b54729b96d6ce921c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b98df27b4fd2f3ed3a9d51211fbf95f3

SHA1
c80844a9eb04121e50ce45529200f394f9512f6d

SHA256
5b35ad8dadf188d8c32f22990cd748c96ead356722356464150c34aca0ffb2a4

SHA512
cf217a4b9a643a797685d986f09f4cbc7a9997dbf650fffcf01528dfea4c531497c90138e6fb75dbf1e1276790e8770ff1c9c3b6d4e9c567e760562897f0c58a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9951dd346ef71d08335a4c019352427

SHA1
def82715fe41c735164f493211ff42fc4cbfdb9c

SHA256
4147c256ebee4a8f7032f364820ceafe2afa54083ad89999fb7b932f7e2017fb

SHA512
ca9694054a97f8a22b59f68f3a2bb5dd49d403c3e4eafbc8355ca938cabfc8cbf7e944912c9668a511d05c68a12f5819e523f2c44b0d8e5b9e8b21d4089657fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
1KB

MD5
75321f330c6a72b6aaa92c047f6f86e7

SHA1
d195982d61f5aa37de69084f7231541689e16d71

SHA256
1dcacdadc070b0307e5e477785fdd6378104338b8c70bd61d71a516162a8678d

SHA512
e12f95d2c0ff19a6844d57b0660e063d1e6e7a751eb552b09dbf76cd287590b6f34e023bed283d4688ff5273e6e1222c6b73c6af28438d1a9d6db368de20d0e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\favicon[1].png

Filesize
958B

MD5
346e09471362f2907510a31812129cd2

SHA1
323b99430dd424604ae57a19a91f25376e209759

SHA256
74cf90ac2fe6624ab1056cacea11cf7ed4f8bef54bbb0e869638013bba45bc08

SHA512
a62b0fcc02e671d6037725cf67935f8ca1c875f764ce39fed267420935c0b7bad69ab50d3f9f8c628e9b3cff439885ee416989e31ceaa5d32ae596dd7e5fedbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD403.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD416.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit