a76bac98d674d5501d423e9569910a732977baeb3a50f86326710fc874a66206

Analysis

max time kernel
141s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

3KB
MD5

e9c0e5414b847b8e3706709cfefd0e43
SHA1

882484283af5fabab3527c6c549129b847b86e85
SHA256

c44a16ab709f1eb785eab59e792329f774975ffeb5ce123148a5e55c634b8269
SHA512

d2cd992f5f6897f25e2e488633e528497a88194218acab69a9c01d62459bfa61b8746f070edf13549e6f0299736885ef86ac59351256d0491ed7c0eee005b2b8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435401462"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC5C4591-8D29-11EF-BFE2-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000034139b956b04266370441b943384f751c3b419080d2248601213837e5be6da26000000000e8000000002000020000000f514a4b15df72ed85e430219d7b519dc4211f677c14f839c6dcdd5471161dd0420000000e59a15560c1a3633a5b9b946fdd961c1eaa12af92670565b78a46e6ad49db4c840000000e750ec57d5a45ce11fe0d004011c0cd64c48099832e2f26663af564f0c4f35ec2e72fa100c2a71efbd1ba9aeef08792e497cb2983d699f5d38bb5249593241c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d4faa93621db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000f1a1c1e821deed88c3daa171dfef00c46cabeeb2226e608b9ec9297527cad2e0000000000e8000000002000020000000d505cfbb62156a97ef250457b911d96f81bc726aa09cd03d1132b38d6db7aae9900000007cd62e928c571bd622fa35756911dc6279dc4af4bcac70c874691581c3394965d653bde9ab830f1b615df7024141a1c6a3a5c2f8236345a9b948702cf812b8ffebb76fca6414be8c72c177291d8f963e45d125ed11aafc4d29ac46a111179676f17c58aedca545be09f647fb3b477d331dbdad66256fd61260073a5963bf3777a0ec6a64ef574801748483672114223f40000000e59d6e21870e99559061db70487ebc9ba70dbb46f5505f9eda92075473c6fea5d77f25787afd40949eaf28b2e23027a4fca601e18f6ba9ddb3aa6d3dab399aad	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1580 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1580 iexplore.exe
1580 iexplore.exe
2876 IEXPLORE.EXE
2876 IEXPLORE.EXE
2876 IEXPLORE.EXE
2876 IEXPLORE.EXE

pid	process
1580	iexplore.exe

pid	process
1580	iexplore.exe
1580	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1580 wrote to memory of 2876	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 2876	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 2876	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 2876	1580	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df72f5a3715ab8c74118b2a7d230fd2

SHA1
cbf418955eb33c7c6cbc710ab8169e7b29a59023

SHA256
c6f60ddbb4dc05417eca4eb4780b394a1f9a0a0810b8e78d6f6feab0a263440c

SHA512
abb644b0f6be34bf9e1e5d1dd38cf0673b22ca6afaa05a3fcf6f0152a8ab5164ebd5983542ca58bd33666ee35f25cb24db15f3237459b8510be989173a0892c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98ac9281473f31cb33ffd5d06b61e468

SHA1
4531e12e4a73459b979eade6841afe951e8c49d1

SHA256
e6005d1aa7c75bf7fe76d8ec11331acf7fece5ef440ad36393e86237c59f2294

SHA512
7ecacd687626845e14e37bbc49c084cffe6ad1048bfb6e679ad39fc7bbe5df1e3dcd6e944c6de55364d7604926fd3767955be4b71daf31f2c5cde49ead6fcb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cda9299fd00aa3210cb9c5c450445f9b

SHA1
9356b191a6897e483f02b6a1218679dfb919158e

SHA256
4d3d9972df3cbe6e737c3d33a6d6718ad5e387b52532c09de068248df3d49894

SHA512
3da73724c444f325556fb8d2e1f67a3d71dde37b83a3da19c96697e2bf7c24f6a7f52f0cd255b25143f5abb4826f2860149c10aae06183ef30318e887b0e5af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33f56a7e53678ec5c775118a8c00a638

SHA1
3fc54e2c6d42c37edb3bcba081188f1cfb149498

SHA256
be2fe325d51797be35f8b700ce82c4670dbd7d228e773b78c9ffcde4fdde9d65

SHA512
b953020169c94547895258d84d5acd0fe8ffb9fa756ad1a89ed2f5e2c96c03a2e4260f2201b3d9f574933c0c3a88b20f59329fbd733fb9f3e995abefca869b47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b960e355e6fa890d93a7080565ded9c

SHA1
4e29315e5d9facaec50e630ab682d92feff5e0b3

SHA256
3ce52223286cb3f8f768aaddcd6737333418cfa95df0a2739b6cf17dfa23e4b4

SHA512
e1e33ad0f562a613fac922ef954ae7cb3af80c3c788113e5e5853d2fdbcbffc16da56baa47875a08865c6b7e22547960b540a05fd3947b9974df99eeb82ff4bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c407ef41f8888acaf7a9cfb4b11763ec

SHA1
3b742e241d0b8654b9dd575c270d2d85b72060d9

SHA256
b3cca3dcbb9b9c576648c016581fe72a37c07aefb02bbf8b8154657bb114c310

SHA512
b084fc76550938b8538dba359a3611de7db9adb1fc74a5546e06e27a430645d3fae2bbb02dadb874ea1d937fe98b1506c540bfe41815c0446b5d16022d1e9df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13beaed1c44ffee8b3ba0b68546a3003

SHA1
96595892740069d98a62f218e976c8c688b3369a

SHA256
dd3adf5ca7d09ba5b3c47884a5fc89d2d9eeb47acc4fa6824b3759aff6ec30f1

SHA512
b734d89ed6bd891e5101de6c57bfdc550187d199d0646d889ed8d10211be02f2b3fab88d5654fa5747da93143363ddd27f39f9ec15f6ed7666186dcb54946bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff779c7958e319a24a7f0d72f79f145c

SHA1
4b6b88e59a2bd6f97f781ac16092329a274fdc3a

SHA256
b84cd3f78e45fee6e12487a884e3467d0a0d7904fdeac81fcc6f82f072589546

SHA512
1cc0e6e5bc44f82d4a8d406e5d7358a8a6c4798082bf0cc4dba79d58a490bc114c78b8b265e1edaf32a364fb21ea443102d431ad58d209d3e1f2e91b71232887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffd3175ea3d6d803f5013a4cd4863c9b

SHA1
9a08764dabe938cd95cdf17799784e6cdfdaf269

SHA256
ab2c226a2e947c20e3ebe73856b573cf0611e940636d05fc7d10b229227947c5

SHA512
1af6777869dff7029120d6c1ea2c2ee76dd48b0bc8aa4c5690a1bc42c255b82b235e5fcef16e7ba18222ae56407b7599496621de5371db16dd8278fd1aa23b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e84e044c64ba8bd1eea04caf9de41c60

SHA1
7af894832a3730d20439ebbf1856c0ee347d9bca

SHA256
c82403351fcf3ef43792e67f77c0e8380dca781cfdb03c8fa397ba00148ec076

SHA512
1d922bb801392807d9f2b1f79b45a2585e7f061d194105bf8666c2b2537f17604dad73fea6bc56abf51e5bdcd423baba6657cad73705457079a906a6c8fbcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC104.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit