Resubmissions

22/10/2024, 19:51

241022-yk8gtstckl 7

22/10/2024, 19:48

241022-yjkpdatbnk 7

21/10/2024, 21:25

241021-z9xx3axema 7

Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2024, 19:48

General

  • Target

    $PLUGINSDIR/app/index.html

  • Size

    20KB

  • MD5

    423d2e2f7e21b856cb5f3ee3dcbfa5a0

  • SHA1

    eda0e357387913daf57a0c683c34b4b8a5d7baf7

  • SHA256

    cd59efa2fe7cbe222d03a946c34eaacdb3761e922763952d7be4555addf8572c

  • SHA512

    c403307549af9bf7cfd34295a8b1020e7b7489d104b5fdaf4320b495f85977134796774dbf4f20f8fd0b2d1f2188b881a1cc35cec56aa64a3dc84bf1c2d21b4b

  • SSDEEP

    192:DgNb/cVDYmPkhHmY74deqmtRCtmK8WQI9gHcMlxh8Bi9LJFHab4rmgJnc5t/93jp:ENs+XaMr9n2uLy05SN1

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1932

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

          Filesize

          1KB

          MD5

          55540a230bdab55187a841cfe1aa1545

          SHA1

          363e4734f757bdeb89868efe94907774a327695e

          SHA256

          d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

          SHA512

          c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

          Filesize

          914B

          MD5

          e4a68ac854ac5242460afd72481b2a44

          SHA1

          df3c24f9bfd666761b268073fe06d1cc8d4f82a4

          SHA256

          cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

          SHA512

          5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          1KB

          MD5

          a266bb7dcc38a562631361bbf61dd11b

          SHA1

          3b1efd3a66ea28b16697394703a72ca340a05bd5

          SHA256

          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

          SHA512

          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

          Filesize

          230B

          MD5

          c155f09e51f103984000b4cd65219a07

          SHA1

          19bf3c5ae3f4123433764430728ea3f2073de713

          SHA256

          c69207f5e8231adaaf8eb65a562038f6534404d638e6d94da480c7b1aca2d765

          SHA512

          11912c65a9cf304ee911750449ac73715cec7e31b4bd000c3d9075e28e472ed2b33f75cbd1b6b9f1f38f20045d37beb6140e8bf60e9d5984cb5f4816a79eb348

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

          Filesize

          252B

          MD5

          5916ddc36881fe0bae3772031ad7718e

          SHA1

          9cc1e4c32a8b6b39bf0a557ec5abde177be52b19

          SHA256

          8b097b581361c3d547fff800332d18db83c7e7cca191da51ba0a20e0135940a0

          SHA512

          a0942f9501749a8215e2ed1a0168f5e0bae6751d72efa1aebf66978202489a899c260299e5ff2bfa38b83de2a71e09f042fc5867150cbbaf8fd37fa9002ede11

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          ed37eb9866796832df79e41d68ef6036

          SHA1

          2ad382b1a5bc10c2dd9639a58fcc8e762ea56b26

          SHA256

          aaedaaa2eac8ad18690ba3b674f7e0fb00699394584a9d766eb5fb9499662c1c

          SHA512

          765cf9ca9aa6cc2cd8981a3091bd7ff08104b75fe27a80343e424586e142c41efc9aaf0f585e64a7ee985e522f9fb308b2e5bd6922b946b54d3352276e54f493

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          8eebdce791337f6115b95388d4b839f7

          SHA1

          72439b21906ec5b6f60470ea916c0ec0de09e44a

          SHA256

          af8cef0a13f9eeb586dc8d440671c8fa267d50c0f4978813b2bdb333d49abf05

          SHA512

          7f742f4fac508ecf7a1257a1cc8ca88114da162633c0fb2c3e241895f53d7dd2dd853622086e9b18132ba0026042ae458978904a25a21732abec0c8aa7941aa4

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          b51ee3376455ca8d7ca8e32560b4a710

          SHA1

          3e428d4616aefd008ebc51891f722b713631c258

          SHA256

          63e2dcb2ebbed1facc3fe1e7e9487b09e327636ff76489b3c654ae6ead86888c

          SHA512

          b0467b5896549cfdca860aba3da3b61ab21f174edd8e6d89c89da608759cca435ea4b7329da9eef71a03674856c4163817eb2d87307b5efb509730db70c8d8d7

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          dcb10e7a4065aca8ea6a839ec971af74

          SHA1

          4da1b1ed095df1a2c509cb30e13a1d520fcd4d8e

          SHA256

          f8132927923ad94a7a0e747d846d3c71c88b9a4e238829ac8b9540b8cb55632c

          SHA512

          e9d0b061617cb361b28faf656d6a54baac661a2165593441fbebe12b63ca21aef3d1a1d5e73d502f79769fcd7a29891b1d2a4be8263df04beaa505ebc72129ca

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          4b5213b5f8e61c0f93e0b829205a8a51

          SHA1

          0f888abfb45eba209fc924621e6f936f942ee0e7

          SHA256

          fd7bcde0e7f0d49b3c1fb047db3e0493e96e2c8ddb031a4762fc0d0ff33d895b

          SHA512

          2446ec566bf66d53d158aa1fbb0d47eeb43c0b669d9b95b37bc31fa4e81f0ea51383d577e6d911731dd7cca19c22322da2202f4293c6a4fe3e1f42f8196130e2

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          f0554d8c667d0e116717e661a87879f3

          SHA1

          776b35c5f4ad5c55ba477d4d00fa2c624a7989a8

          SHA256

          d55416488dea8df83bb5f52756656cb212fc5274818060b07e6e4e2ae64da7cd

          SHA512

          1e73f2199ad412f949fd30993378c07fbc22ce1e17031cb478b4686e801470e60a387278b60c79e048eebf741a3e779d68858fafc317a3955e8c9b331b81da98

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          5ea231fcd149626a33cabe8ebaab5a09

          SHA1

          c371f6f1060e88b5a73bc1fb0edefac266d42617

          SHA256

          ddc97e052c6e693adda0c2d58729e321dda364501745efea5b77362c778d887f

          SHA512

          fc8e641aa28191e111c59b496b2ed6332cd97ed1168574848706bd3fcf8952f7fd0e062d750aa34fe947f12d9c57a9be7c278b6c0b4782f2e42fe5b804903521

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          952dd367bb8f6647584a8496c0f81131

          SHA1

          a5b1dc83e0f1e1578e5c7f10f81aab61004f1ce8

          SHA256

          4ad3b9f42b6df978039ff42481b408bc11b140261bc1c8edae9b66b8f58f73c8

          SHA512

          afb5900002a4fc0fba7a0c9a121797239030cafb477b80f56d0da159d4357b2b2b5acb06a8294dc6ca041e8465dc2a870e8af7b4b1ac7ec1c4d0326989a45dc3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          f1c526499a7d7befe217b8cffb7cd46d

          SHA1

          6821018ccd1bde0d74de1ae392d4b872647a3e13

          SHA256

          4e2b4ec8f986ee51fab74a68aae4f2d982faa2bb0f011cc6ab680404c5ed89ef

          SHA512

          030bef363c433f3bde6b3ab90ce5f2bb6afdcf5fba9227412aee8fee9b74317a5b8339ef6c57ee59d94962e71980341fd1560f046275623a73f452abfd7d7ed8

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          47b9c543661e427bd52791939e988264

          SHA1

          503a8f303be415a06b14fcbf81ee1ec544152a52

          SHA256

          71586618d3f5e29a9e2c8d9e249d8695432d9a2dec6bcb4cc13bd83b0755212b

          SHA512

          507b947b2b0e94265884769430362aea5a4870fd5ea2938e7a92adce1a9641b3c508407fcc9e4e88e8ee365bac2c6525195077ed709ddbcb346f2addfd05ade3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          5c45dce74afb3d4230cfff6ea47a9d89

          SHA1

          9800f3cb77e4878077bcc0ff2ed6c129d982420b

          SHA256

          b1f537351b0cf37dfa2fd368c1df01f37fc63222669a3e3d620d2a5bffa1945a

          SHA512

          aac1526610b262d304e3755d70bdfcdae3604e27fd63665951c2af8c6689d46be9569dee8ecd04d9c1e21e05a3c394779b2a8bd7ae27f9986d39beeb931956da

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          f8fae7172cfafd599aff8d2f100b9d2f

          SHA1

          44f47d500e55df7286f6b172c117b9a66754a9d7

          SHA256

          7c76c60919bcecd4b5680a1c438249c8438e48d4463ec0e86dc6ffaf8bdec776

          SHA512

          0bc9c502a9ee02903db4c164685fabdc14908e8f764e9a984e4cd7c30b0ee1c93073c905fecd71de51ba73945a4aa6630faff88f41d92a70e24d31c493c941fb

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          48eef34b42c5decfc49367faa3657a66

          SHA1

          4a2547d050273ea2d04e2a3a3f71b04ed35eddd0

          SHA256

          d18875d83f24ebaf3723960b7df5dbee4c357c40f9feda620309dc51e7771ee0

          SHA512

          274290f2823b6004797f86625dca45418c3ada79e874551aa0f4437cc17217a7f4e4da34e6c0d3bfb957e7b08f8ba4ccfa5977ccb39bf6a84c33116a600058f3

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          44168f2a2f39a06f7aec040fb6ee89ed

          SHA1

          3b0b7ff9b7d88f49c0eca7b5257aadf05cf35ea2

          SHA256

          d125f9952780d5243bd6d0bad1db66097f385161ac9d71d8a4eac2b5ae5b4fd0

          SHA512

          b51f8238b534ba571865f44ffefcab5fac24b061e583588f10ddaf396e2bdf6f0fe90c1a4f9db8d498289f8470ac471456b5d46b4a6688bcb1017373f563b78e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          64458291dbbc87ce0c3b8b6a78d4f6f1

          SHA1

          3995aa0478e46826818da86f1e919caa83fac53d

          SHA256

          a5b0e140e5480014b39fc26898709c80b5be829a63063bbd4374c69210adadfc

          SHA512

          b3eb7b1c3ecad2e68b120b12c1ce2903eaf61eae68d473a6dbebb6348dd95201410c4f1d73fcf0a1c23b3abd9911c63dd94ea1a6ffcbed54fcb60dc22db63efa

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          1449f3d6e73205da5068fc2f0e71013f

          SHA1

          94cc5f0cc3180fb9cefa9dd8d0c7c2d187ed2a82

          SHA256

          0636f128bd73da132653641dadf40ac9dde47d15c0b747028707560ba4f155f9

          SHA512

          c1c23896a6fa8a2f8e76c50e0922d1bfa4e7bb89c8fd08237127c4d787cabe1d5ec7b17041cb82a44d33503ccaea5d337deed7527da93c9e71dc7a0cdb9f1a82

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          8d319daebc015d691bb861613a0d67d4

          SHA1

          e588f733d682f8f1443b49e87d7773157fe05f62

          SHA256

          23a4ec7a649e50986ef8fe9b5e235b43657a268c50d8163572b25100c0c04dcb

          SHA512

          fd8e8dd17d5105ffca32b7388c076c53b6a1fffbd5f59b46959155d31d88fa7b1519f8003f082ef24350562ca03e071b5dbb422752d64f0ab5607593af61edd1

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          875ec2882e6b187ac01d691ace64edfc

          SHA1

          1e6ac07022c4b87895ad31ecb04dabcea0f7b55d

          SHA256

          babfcca9d2fd5e50fb2a8fdfc1dfae3480bc21a7954aed4eb62742a46550ffcf

          SHA512

          4bde03053603edb50c01936bd20a56a02f682a54959cd14f2b63c022914a6c6cdacfc88453b95eb974e31e258ddf3249a85326aa119c100346eb2bf842654662

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          b3369cd9c6d561b658dc4ec4742bb0be

          SHA1

          75de6e0a9c190bd5d21e2722cc6dedc91bd94dbb

          SHA256

          95de9c471c3e1c2076098027b5189eb69b7d5898b5eca80a28874fbb10736623

          SHA512

          3b7226cb1e34c4150cf39821dfaae830c716345a803275acd36b869a4f3abff2e5815db6cf28670d8c214a592391ec5776c2aa78952f84c297f873eb3d10143b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          682b84a51eed4d562ef818f0c9210f4a

          SHA1

          25efc3961b7a93d074ea333c67a6e1773b8107b7

          SHA256

          8d899b7fa59aba938fe771581f01b3732a3fa935b25dc03cc3b813f29669dbbc

          SHA512

          ba890424ad827371610bef19c18650d3535bd0972e9991c038ec2fad44ff07fbca69c1c548225af868a62e369b7274e16bc8db9834db38b4719200770dbb6935

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          4e28cc30b92607d43ca0045a4956b6b8

          SHA1

          d963071da8232142c00f03c7fe5eea645cc40d3d

          SHA256

          76fc25e7aee102ba6ca3fe5c16070aaab90001373104ee78ffa32c5127af82d1

          SHA512

          52bbfc6962bc717799e1c4552d91becde75aa75799041f83bc96535a295dbddc01605cd7a959b7b900fccd253b5cc5225fa86e48766bfefd4075168571019b6b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          0e743b89ac0193dbd5986bffc42c1e87

          SHA1

          db392c478137a3a1238252745b86e3e04791ba07

          SHA256

          e074c41901cf72812687d4a4afec1aaa9fbbe52f4feaf89c83bd0629453284e1

          SHA512

          f1d00df39c9ae563655dffee0c592d7c13f72b34fc6d6eed392eccc03d656fed41c97057ea1ab072a71b8b62143b88226c7463ea3666b88bd60040ffc3f397ac

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

          Filesize

          242B

          MD5

          0f9d8e1451cf386d80ad7b38724cb9aa

          SHA1

          b5cfa4a2b076371ef5064bf9beae364801f63242

          SHA256

          299e713cd892a38c72fb324921932a3c3ce0341b5c2833abe3c9ca3a95449d3e

          SHA512

          bebc2e4e7e71f99783f403ef8dbfca8d2eb6b34b4e2cb234b64ca89f55aa4c14d11b8a8bf848c0b5a739ec3b4edd39f86ba266c3d16b8269628d39abe857f511

        • C:\Users\Admin\AppData\Local\Temp\Cab9668.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\Tar96D8.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b