2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-10-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s.gif
Size

43B
MD5

fc94fb0c3ed8a8f909dbc7630a0987ff
SHA1

56d45f8a17f5078a20af9962c992ca4678450765
SHA256

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
SHA512

c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{869655F1-8C01-11EF-B729-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e90b5b0e20db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000837a9d90f2b4b7937033e85a883ef11d70b6000e2c88e8c2c4534549a0e9a9cf000000000e80000000020000200000000d3df78b1033d3bdce9bf080b9988d7ade4649881a515e84978ccdafce8b9ee390000000d24b2e75cb34dd102d47ae8a32f1246ec4f8e0943d665966259566e96140e221e20dd4a4c33bc776121a55c9047d0a15a3090b10001d4c0d93ca0969e37ac737a37e1f8fca85b841761da9c3d4e185212d408da796c62c7347849acd95f8530a6d21d3c7426068ca6f6ee57a36134fbd206ba12bf8dc63c03a1bbd09f68cd8f750d6bc6b5d43b07bfae0a7c693eae10340000000a2b7f40455f23abbfd5a93ad9e07dbafff7818f2d7789bdc45e072d6b4a355d3305ecdb0e36188265f83677cfef446e2a2c4157cb72474b2e70ead481e8e095b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435274233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000380ddd2a5634fb3c44a472a531edbed923297a2b4c25dbffc03dd5739f789d95000000000e80000000020000200000008552fd8ce03a0879bb7defc9d78ffc704abc6d9c117ecbf528cc45d3b27d52ae20000000c6524202b8415d999e91c67144ed345651fbba07e371cbe0d712e524cd8546884000000067b9a47c850846f751b651241e8694c640df2c632b88385973bc483c808aefb9710187ccd1dd908b9797f39f658d2c3edf0a055daec79bb5567fce7ff71b26e4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1764	2672	iexplore.exe	30
PID 2672 wrote to memory of 1764	2672	iexplore.exe	30
PID 2672 wrote to memory of 1764	2672	iexplore.exe	30
PID 2672 wrote to memory of 1764	2672	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\s.gif
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af372f24505860e705c913760464a1d5

SHA1
9ab93626d490daafe4c17b2135ad700542d0e79f

SHA256
66b572a8f0010a591b2a469a45d9c7d32d31765145d818e09713ebdf90bd8d03

SHA512
5716f52114ed0e6be2c092448a35961d2e51bd45f60f41259cf95c502ebe0813b054c5f9200efba37364ec2a18594d9c7a5058cdf474c23b5a72fe5db7471648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df261454267d6ddad53c9ba0f051837

SHA1
86183c614b87d4544b68e263d5c38d04048390f1

SHA256
3ca3cb9a09ef5c7bbaea4640adbebae1961037fcacf93befe607d177c2da821c

SHA512
d1b2d3781bbdedb05da4f4934ae4b807b4bc85dc56e888cf53811819add0eda42741ddf8950d17fa8c21cc58f20fced90c664a62e285b2a8209b98f4a0d8a8ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47211207f6532fa7185b978310607d08

SHA1
74f7012aff4cfc72e727508f548b444421d9857b

SHA256
731cf166299ed875f5714d10e9c3118d74b55dca907304596f0e3c7eca501ba8

SHA512
2ad9f8922ab90ed4131e7ff41d528137ae64831f94ea70544c2e69797f6f45cca1ee5b4acc27b5f6baf1d9bead95d042ab870a47ff8a730dab22298b91b05100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77e89c52aa684b701ada51b949445d6d

SHA1
73cd4a5f11c7517c23364c4bd5bc40000694222d

SHA256
ccde9636ca351b073e4982cfac6952901fe9a299a63c47307fbfbbb58ae5f7d5

SHA512
d4f552936d2de585350937561f704992980cc64680c8fbfc04d897fb97aa59f610d393256b78fd22afd78c2750bee0149e9bb12a8990f32daef87017e90ca293

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a279fe92dbf3e51ccc95a747bd7c964

SHA1
a45c138fdbdf5f68035857579cd356a96f5b64c3

SHA256
fdbc7aa66595d059b7d7f785079c5da4c39550f300417d8e71eae8fc8d7db2ad

SHA512
5fd1d475d1af159aebe8333ac4edab4b02874b4740f4d685a0483c4535188a55c2252797187e66b8e9d8e1f4295a0bccae5280b1d7a9673dd11200cb59a7d877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
152c1de2f49f527f9d56f261f1d04cbe

SHA1
1035ff473f655bd16c87eb12f5de5fbf7ba7dcc6

SHA256
25cfd3fe8fc0296f89f20bf2d1cfe8e4a15c22e27f6adf323e288f7602f8ce9e

SHA512
6c0969186dc05a7980f9222c7840ec6f44e2f62762ea28a38fd2d0f64199ca46d57bda813baf41ab2c5cec1a3a413fa024328c71df693d93575e2fc9976dcf7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34439fba5e9fd6321faa1946883f7aa0

SHA1
299add395f1744fd77ce1b775a02702e25d610ce

SHA256
8bdc513d509abf8daa2bedf6bf77fe97639f853183519685d2f43c6b3bc14f1e

SHA512
566c13b44cfc225c93809df4e56b5eb311c245af99fc001f6934235099cc2e0f78dad0db95ed81b4d433188c76391618c4bf3e0909e2d405cf5c90eff4f683c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da58fb310b50afb0e2b32049460d6099

SHA1
92813a8d29f0bffe34dd01f180acac03bb549322

SHA256
9039c451dec1d8491e19ae54eb1ae58563b395c307e20602bc7aa019185f76ac

SHA512
1e426fb599a3808a03ff1850bdb21d54a76905f696364b81f59b80a7226e0c6bacb4d2a695432eb67eb326a4631426edd5b63ab54367cc687705ab6f9b6a5407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a460e1c24a9fa1f0ac0e658e68afda49

SHA1
5711bcd14c07c224799e224b4c6ec813360f52f0

SHA256
05dfa78c6d6f4ed00b3e3d26281060c8e16051b5001c2a9221011046e25ce316

SHA512
eaf8aa81156e48219bbb7c6e98fd12631973d06c4cc78db2e0c77ba2c1e4c48af471098cf62e8ef54a033977e2f2a913a9e1455b416e84ac50ed865b7521cf24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe8dfb20f2174ff896cdade6dea03855

SHA1
fb73d14538546ada2529be944967e31c9e998df1

SHA256
b17ddf9f560725cf6e9ef9b67e6d8631d3be72ce08b9ace494e651ef1ad3c6cd

SHA512
9a3ff1fdae3983e4f387f885cb8854dc3c0b06ddce92bfbddca6a56f4b6d7529bf21d4aca3161afacff424bc2e5220ca433b5f720e7ced013aed9815d1a69b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e618131df432816939af8d8702bcfe1e

SHA1
22dabcac256b7747c5df7f996a9cbcd67ae2fc70

SHA256
3da9d097947cf9856157f7822cd92b2ab3690a1b930ef641b588b6ca0116eb8f

SHA512
71e955541c88bf10c59e9cedfea7e5fe57fd12c90f8363ae279e4eb9f4b12bc45365d7ac79cb433bc162e56bea50611c58811ff800d1bf3b88f881ff6191934a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a851880063426a7e38d90ab9719dfaa

SHA1
d4dd4d66365d0980a9d231971540af46038e9c5d

SHA256
2e70136c0736fbf6950a8c5bd47098369fd27f3c7d494bf541afb03d944298eb

SHA512
4a7cd83bec4e2aa81b68846fd08f80dc090eb8b829a06daedfe1bac4293ac24690e785ba284003b8e6f33906205e87ab3f9522ffebda25e5a993f5424dd2597d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d6d766060234b0cd7b0ed10cdc71850

SHA1
c5c7fef574ac2dbd0c028556b1670785c6aee2e6

SHA256
dda292322ead83e8a51bff70cc5796b3295871e490ed9849ff08baa92602bd15

SHA512
4b29d2797d2847d7db77a7ddfa271496fd3a03b7265c55c8d2ab59e12adbc967389daf572e77a8a735455098ed6be1f355c52e3e43c0138fb7bcad8280f0bd54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
866b04cfc505a354812e2b4d12fb6ccf

SHA1
db5c0557fa414210a29317e6d13a33a36073a82b

SHA256
cb19326e38aeaaf2716ddc67d29ee5b1c84afcaecaf9858a03ee883efbef1700

SHA512
7eede844ba70ffd2bbe9a71320b2fd3b9e8b786f5b973a2424c1d09a390825bb3dc5d094f6b59e83c27c9ec5d801862d09988f4862cc10ea7543e61c2e8542b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC4B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC558.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit