a76bac98d674d5501d423e9569910a732977baeb3a50f86326710fc874a66206

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

4KB
MD5

5ddae141accb377a8e93b1cd3336d683
SHA1

764a599646237bcf8a252a389042ed2b9dcaada5
SHA256

1e3956c57206e1bb9bab9d8559456e8f0779cba7d9908ef37f5fd5c07c1d2b21
SHA512

eb9b9723454beffac57c325a120487e08060797db33aaacb1f654160a90beb939daecbe44506d72ba77d5494748821f24d175d14d5a4772fdbf36e2767acd092
SSDEEP

96:ZznRJ/ZlS7LlHJlOtY8Fi0R91FJS8d7M++3td5H5Csgfn:ZbRJ/PS7LhJQa8Fi0R91FJSkRAL5Csgf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b0b74c7cd7bc98a714813ea25e0b6b39826fe037d68e7d21434d3e74533e8ac7000000000e8000000002000020000000a4a737ed14ee2c0dbd879ccefcc873a9c4cfcb50975a25727d606d046bf0a3f69000000084ce6efa8213c1f771386350323481325bbebed3bb6046981b9cce0eccf41101c5f0347b47d5afe6cba30cf970c1e741431ac0efa21addafb7e6f83b35bf67662645ddac29f8bcd0cf0745b68af0e76b043e823b46c43048ca1bcc6bda5a19cee5496b4dd94524aad688d19dc7d962a3ab2a81cab984df6ed1f1707611fb7e005003de452e74d2f73eded0426ce3f2fa4000000093c3e208c25ee05bd15b615ef0d62027016fdf933adb011fbb4993fb6a4af4966ba863a3e190ebafd7b4887cf9f2dd30a5e0ec83a4c51bcdbc154e8ba0f065e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0028b359cc21db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435465741"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000fccf8650a893f8101cfa05dcdf48297c2775776c8916d2724b3a1dfc6f4a7bb6000000000e8000000002000020000000452185e71b64be13c36f10f6cb95c25b8adb0f9eeed16d9b433dc83391c3dd9420000000344c93331b908497028c0aaac16a197c3ff4ebf41b77269af516420643f825d3400000001fa375edd076e5062cabd1bc73cf37fcbf844c0726684077c3079ac46359d6baa25813218bb7396430ad338e7eafd5b0b38530b780086c3482fc3cc964ec069b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A74EB61-8DBF-11EF-8D9B-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1088	iexplore.exe
1088	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 1088 wrote to memory of 2344	1088	iexplore.exe	31
PID 1088 wrote to memory of 2344	1088	iexplore.exe	31
PID 1088 wrote to memory of 2344	1088	iexplore.exe	31
PID 1088 wrote to memory of 2344	1088	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1088 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b459ac75469e1d67fb49392c6b487eeb

SHA1
177904a1cecef32955de68826487154036b99e02

SHA256
3bb72d11b7b1af939d48d313fbaef62bac7ba46979fd7ac732d18caf3dad65c0

SHA512
4133b5e17e244f1b98f2f28f683b87dc2d4fbd715cb72b1ddec738e3449853093a1e3ebbfb02f4f335bad80209557de192d5636eb43d6718c957114bf045b5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b82055ddf64d80b928165926ed62bc6c

SHA1
e9015186511784b7e7bb7379da269a184aa93dcf

SHA256
3306b4e9a3b643f44a868e3cae159375ee02350cdf3569b3a600f89d0e52fe6a

SHA512
36e38d34c15d82d1e0de2298131c1ef00b509b856f5073b4a05ec1d4ff4d41aa7eb4283235f90047d61c175bb56b868966f60ef6d5a82328fa8e8ff8e3171c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
930549a79cd742618d1a74d3c4ea5328

SHA1
c5b875ed9f5ef734f648bf39b4690237a24799f7

SHA256
05fc8399ce4ada064b210c934e7e2489b48b6997580e3c5aa70680d7319bda0f

SHA512
7969432ba5b35b1d83fe7e07817bb49a3a7d14f59dba5786b6e2fa2e4be091b62a4db8b9ed4e43276b58563d8a2afb756a30ebb8a1a247eb6baac89bdf31f82b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f90481f0b93220adf931c1382de8e0e

SHA1
e68a6bf238cb0f6f14d00fa3e766d602bf08e62b

SHA256
66bf7117a00e580a186db1abba16a5ddc54fdc1d6c841d4a1a9cb7f75b832e15

SHA512
6f8e421d218b229272088bc94615840ddcf91c3844bb2b081d2a9b5f1cbe8e4caa83a12ee1905b7a3c8dba3e8f6cf692c51178876fad539efd84678240ef6920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d37f7b5a2841b4ce755757bed027e2

SHA1
dd18a5073bb581cae99f9315d2d1ef4d7dc5e026

SHA256
9e8f118ae7a3e0bad091334f7aeeb49001e820f2d0a34140b7ce7508b3861892

SHA512
c2ae28469a85db314891eca85316ba15d29c686eb6746269ca4ee444e55b355a7a41521236606bce49842e817e912be17b924b700fd390767b3dba4ed9eec8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a96946afd860f8c4779569a4a441ffae

SHA1
8154fe20a196ffc07beeffaf7153ae66fe679229

SHA256
e3141938443c2094668f2044b74d00e64e901f856bf17cb5223ce51f90eefb1f

SHA512
a958c149ac8a4cd8cf845d2e507feb8f28dad6d0c433b1df4f75a8c99679bcb03915c25d44fa5f158b975610913eee9dc1327041959b609c1f7aedd81e4f4ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae9d39fd4bb100527474305057640c76

SHA1
abe8b36a1d6e2539b5bc57c9b3f1d104635ad11c

SHA256
7484653b092d3c325849ccc25e453df91aa02b5b679579d198f4bad872d180a3

SHA512
1228d9b9b5f97507b4563cb41ebaa2302f7997c5cfe6a7142cf13e4396f85f4b8f1a6afcaeb5ccabe951f3a1c4c73dea89d71767a248c037d0e5628acc33393e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ead4118379d7ebc9f3eddbb1d438717

SHA1
01413162f16efad4739fcf5955b1834f5da646ae

SHA256
d3d70115ebae0770d80cbf63274c6bd3c0f66df151ef4c7f3de5369010d4b010

SHA512
8ef0222b5dfaae66a8e62bfff345f1affba3992f855c2f310e7ef3b31da4e2c79d630808f4e65933a322986039fa2f8466e8ddb736f766020eeb54481b032499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f883965a6f7ceee23927eff7d269eb1b

SHA1
90d2f7ad09f137a62e72efaabd3f46110812b81d

SHA256
6caf59c5d74ef5a9456ce09735863b61210d5ed0a6acc1a50d3ec2c10a85ee49

SHA512
f7caa6769c23d35cf3fcad0148606f8ff4b896fa91467ce1d83b5579d7704bbb17072df8b83875f5f2e2aba7fbbf6603d7f53fb554b1f24f2cebf811f4b0ee9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
742e318e827bc4ff3407f00d8758d628

SHA1
10d4ced58303b67abdd7a058db52f7557fa7e514

SHA256
73a9c8967a7972e29e5f1ec16833118be9a8eddc9f28f1e9bbf171c63446f7d4

SHA512
8c75d7fb220e9371f1d1ec8fcbf945ae6cd8a555418afa3195f7f11537b77232b6afc25a327092e11ea84c9e58acef59ce367980dc9a78c19ef9fe7172fa4630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e19d6508cd88b03885b868b2fc4893da

SHA1
5aa2105ff9b86a256af751876361d66f34e89d55

SHA256
e0284effd038badcbfc5103b58b98a4a368b3609ea0a7bd16335e968a2320c1d

SHA512
2a6cd2828f564c5fc96a421d08575c7dde3c094a17cefc6222bf059edf7b802af6020ee0b03921d620dd18a0f202d7dc17dd5db64016df4d0ca30b9500f3c102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b99b126c5447a391bfc04082f0e6f2b8

SHA1
1b5f6ce449ede8608aa15227894b6c38af871e09

SHA256
65c8b9bf3af484b5541bbbe5fe01befa3b698f3899216459cf216263a8cbad71

SHA512
0ca0402cf65fae4c1f164ed878b5e2992a09f3e67cc2e55fb7882a844923290466be1c693d1d805b375931d68faee757653fc71819f8b35b35e4754406663a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7aa7283018eaaacd57d62c8072613e5

SHA1
83ed018f4dd3851571f92929f50d396ea88767ee

SHA256
b7973c306811d013cd094c691ba2fbafeb4ab41aded5f7c78930b7b6572ec24f

SHA512
88cd332851392e6ac570b7b17c1b14daee72537eb40ffb966526055ed1ad47ad2d7e4d0a55f667ecd7fac49e154b26299c81bc403111a9ae4f69c244366e2060

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be9f0efed494f2c7117a180dac54ec9e

SHA1
1ef1235983e63ad7e1a45ea7ad50ca9ada86b572

SHA256
78b8e27bd15f02424f86212b28036e05a170b754c941f89219651b3fcfccf5ad

SHA512
6a01ee74eaa8601663a65714d7035623e85b40851d3dd373962eed6923dd65860ab08c4c2297b0b630f5e1cab8fea657f6e238f54bc31e4bc1f57214c2cd05c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADFE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE7E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit