5219f7c44533b422bb083855401a3beb2b55e29b03cc739f18540bdcf361f31d

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

3KB
MD5

14dc2d0739d7d3ba8841eec04d972de3
SHA1

a06134835ab0187f2c07ddda9921423abd3c75ee
SHA256

e10911e8a866c7fa6ca293a85dffb72acc0431af1fd64ca843679395278e5621
SHA512

dbe4ca26e18a474abb235f42077d0c7511b6f91478ad1a83b714851bd9881a59cdd2a29d72341a6ac13590359269737b3ca34b1aaaa5dd174968e3c318a63e68

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0DB3DA1-8A9D-11EF-8D81-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000b38b540b22c583a0de36a4c8c8eca1ed485e84fc1c2f5d72944655d97f94c23d000000000e80000000020000200000000c43e71b4fb5ab1ef4adba437d8610696d7f8dd1bf944856c0c3264415b4a71c9000000086ab24f049003dc57807dba9775acba0d352e51a865f2dc8f284c05a1b89d182073fd90aad68b7fec8499630ad69c1db7d74f6827256260fa59590ae7cb3b241b125fb10e170e8828030af45878a1792fffcc766085745035aa1f784648c73afa281979ae31da8349715e0af2f72d27d7fc199138118f59e78f55a44a8d127ef45e5d4bf5a04f4071acff11d53420b2c400000001252636886d045689e9caf0dd6f73993ea8aa05b2cec2a9d073d88859639514dc7dff756299659ff9427ad4afc53259e2e9bf967594325b4938640e95e8cecc4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435121375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000001cb276ccee4121e4798ce3230c5325424ab9e9125545866397eb699d7031f2ba000000000e8000000002000020000000995e9f82de709aa3da56c07aaf0b84cb96bd21843e64c346bf813d9ef86f821c20000000afcef260864d7bda74573e39fb9abdace8f60cf70877ebc9deb77f8e867a696140000000c5f6105d07aadc97fddb0516dbfc54f71e6c7fcecc0968a197db2a3047b7a8e634e49750bc4f013599941a753c96db53e627975a55f51f28f3f253eaa0dc4537	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e54e75aa1edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2816	2660	iexplore.exe	30
PID 2660 wrote to memory of 2816	2660	iexplore.exe	30
PID 2660 wrote to memory of 2816	2660	iexplore.exe	30
PID 2660 wrote to memory of 2816	2660	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c45e02e662927a6e58df235ddb888448

SHA1
a9ab3dfbab55c33a5df5ad598bc831a5dd2675d0

SHA256
cc0752f4262ea97f0cd4142574965a244368970e27cae132e83585174f66c134

SHA512
5b9c82e68c877493ba83846deed7dd9d0f98fcb558a554675becc1c6d1e00ec71f641929e2b09107ce99fc4641bbfaf853d63ce9fb246a8c179231c96af190ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73b3422a3f58fca26e93864aae9a2f44

SHA1
b346207f012a781b5ed8c5afafee7d98455f2441

SHA256
bcd139844c248c90db9ed8fa4bff1d935b93427f94b15fb9b081f0069e5620b7

SHA512
a50e5c04ab3bf087a223a4ba2f4c8330a260c8849ec0ca76de5bb3e0ac793046191d02f2eabce7900eef8f00117849e33bebdf3835f4a6803e58eca4d5f64200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65483f4c9575fe58ab26f6f4c66b15f7

SHA1
25f4a61a61275bac14d091b607ffed87a240976c

SHA256
0fe1ec24335941213ceac131804590dae217442ee09c9fe53e78a6fa9d27ac11

SHA512
dd3d78ca76b3b40af99438c5131c5f8f63428602384c150000597cd1b7d4323f7007fea51562bad7d52b71fff703ea1697c0776f5c7c78952c3953b89201aba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
634ad6405563a4e31b3215ba5f6b0840

SHA1
be974c3f9e2e8da51f9442c57ef67ac0f11d8b51

SHA256
22d71c9279db82a64304dce273c7a3ba51fe0819341dd463b9d27bc942dda980

SHA512
2c32a2bea7c8fd87a4287d2dcaea88e246c870bed4c2e47c36bb52d6521ed2c5a5f4a5f44f74fac1a849b883ab10f2cb28a606abc46b0f5a538933282cca4b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e043435be60e3ceb91950c242a529ed6

SHA1
b57acd7144ab3d6e266dda16727ebd52f4d42655

SHA256
e062d51989e6cd0d0113026764815b157aac909f2129fa4f1ff86e5231706b84

SHA512
59a09dbd1d9a83f4e082cec8b99ad0e88dade40564109a38dfb9918c2d6ea385dda2631e9c8e66e14c9fa622dd1e8b8bd526b9a6472de4c74b28e6115f88e632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a3528a20fa99910fecb4c51cbab973f

SHA1
d49b42d5e2eb68347cecb68dc4721207aef78c29

SHA256
2c973a5187bf5312e97a3fa5d981ce020322d42a44870d2212cc7d026ac2e43b

SHA512
35023dc81394651f5d398d6be4030c73a9bd5185397a25707123a2e7481756469c7f5c3c1475c84da470ede873165d3427a1e272387086ed9c61173c7d0250c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29816ed73ee634ea6be0c54d55ce7b95

SHA1
a3c9d8f1eefb47e069f03a1e6b8a682565763386

SHA256
ea40e954dc96f19c0df4e083c2aa948b98a1a1039bf8b0a0c4cee363060be4e6

SHA512
936c0c83ec52f532f09837e00efec46c6820e66519a2e86df7cdf120665faac05b73067948318f57431c112ed513aacbc72da89c1e8e64fc164a60cb9a66f973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7d60a5e66078d466cf380828c3641e6

SHA1
f56a92143d18ec11f57acec19c287c0d915e7b40

SHA256
88d1aad24e23764209c07559ca0450d505dade744e4dedd657d4e37f446458aa

SHA512
6a4029980330bc702eee256603544eed2161e975320f6bef1b52c1120015143ee7a145fc449cad1340483d981271b967d79c8ccfea8e18ad9b600433839e77fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de1167db45ea0983cd19982ba95f9960

SHA1
b05cfa2488378f528b905550f57fe51c3b9a7ed0

SHA256
b52b1c8696b56200816203545201fc7191903640d17e6ef104e65f77dbed433d

SHA512
b5c5b6457e261c2ddf35385eef6f3e0289e43f6f38af30db385c4d44e9f29a7a16ffaa7e64e9f4290b408a305d0ae6601f0f70b6ca0e8dc96f135bcfe8841dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990ee2c84bf06e648e4dad09457a071a

SHA1
14231813db4a258012a46b92bc08beb5b5616f14

SHA256
ec7426bebeec97d9737451d0d159e90e5c835d9b2ccdba653675213b2984b5c7

SHA512
3d7d870c03758bea8729e1837f08d3971656b93ac88640a9f7a5937e406f868d23730420ad560d1bbba023c33c24a7ac22d57e32dad3b3df5ed3da0375b761ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
129e1c2fa1a188887b75046c026fa2e2

SHA1
a20ae09a99bbad5670fdaa42b329996ed7c4f72b

SHA256
fa689e85c6e271d370759b764e96cb2dd712dc74a940f517b99bb417205d3312

SHA512
84e0f7619d6d508d0614f4e364167e8d617c424d7ea25c787b5403d2b6bc7504248fb52309282cbc7e7164d44cc7f8baa5a3a89b348c2ff474caeb3b06d2ef6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab699.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar718.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit