Analysis

  • max time kernel
    121s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2024 09:07

General

  • Target

    Bin1799/Plugins/GaodeE.html

  • Size

    280B

  • MD5

    61b5cba92086a8083269f226243ccc14

  • SHA1

    14af3d49f5ff04ece87aca21bcdcfb7a843dbc48

  • SHA256

    50bb720dc114cf562e7ac6cb34f003589c4ae227d9a4efaf5db4e3fe5a1725f8

  • SHA512

    5f9fcc73d7f83d56bb67a3c8f765a05b162309436feb9ba97f6f7e5e45ed0f8fadafcc1068f02064f8bba010b3f6918003f47f405c2fd6c60f7fac450f3d2b9f

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\GaodeE.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2152

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    60492217425d267a7663b2ae6f51c140

    SHA1

    a50d548cb1666cdd640ae6347b5d6e9fdad21f77

    SHA256

    e697bebbdadb29a5c3296f2fcc459f61a59e0f260860736f6cb727a7db61ae79

    SHA512

    059c90438443630b8910ce54eb4a90a464d3155969b9b6616b449cb5b6c9cd207564afde892207515202f6e2b9d01e3bb5b04fddc66ac1206e5966f24a6b48a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80f32fa1d84d8fc1878057c4340fab67

    SHA1

    f4de6593808f32e73ba76a9bf5df5ab6d54fcb1a

    SHA256

    bcc201e02c018e81a4a5b74ba496f7d647b63c1bf85de9600de286d2e3049720

    SHA512

    270308578176a5de4ae4785cd5782736dac42bec5849f105d09bb2632003f6fc71f6083deec94927973005bfd0f528ef3618044c2f92e6de4afa682564486c77

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ec6744773cd2d46dbdad570c6440fd5

    SHA1

    e2b80695f511760d1d8422c57c41aea9e465699d

    SHA256

    72bef6855a16137719345d8f7f801eae850af0053ac76208d994cc51da27b3a9

    SHA512

    fa045774f8f3612113b340acf20ffb7fdfc7c5d63358d63b0b9e8d3b78f54d639386564839e13828c8e3ed330c7ba73a92a1431d32d114605b6e6e4984424873

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    37a7293e677baf19fe8915440795ef42

    SHA1

    e38be64905c017fbc31c9916ce3a4a0b8689acdd

    SHA256

    c77cdb51c3d23dc26b083f270aa47eb16d60f1dcfe85faeda441c3ef649b8c50

    SHA512

    2d0735fd22a3fab7d615224cdadf8541e109173ae24f4b39b98bfff17fe303bbc4d22d359a22387f17a06e918e4910553acc80a30f4879992194c0fa6beb5e2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3f5fc43d9e82731fb21f2d910573350

    SHA1

    92e259441196562f9a1e5382918b3e39f1865e56

    SHA256

    cfcaf5af99a945875174b9200b03fa35c0922c926e1e0bd264c9f40fc66b6133

    SHA512

    5127d114c755578763077d8066e0e951c4710b8be7e344d28ee7a1fb317c9e4255573ecdcac0bd67e1d3b290639b718f9a9e372d958e388dc221ebc98ed31169

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9c601391e6a70cebbddcfe4f9fd54b9

    SHA1

    55f78191343665f95973d1e2c9dd9b55d1f0a5fc

    SHA256

    1d0c53b69d78808825c538d12140f93e261e81dd763e48b5061f9cb8ea67d9e7

    SHA512

    75129efded52c77bb3f8f5b65636349c8edf4367490d6f4153996d48ec77935447d4e3610c44bf1657e6a0c391f4e12c86eb08c7277a9e37c3c6c9318c91aaa3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    23984c44a43a9bc33e74bfa2401d640d

    SHA1

    28f98c58cddca9b1dff4e5261446f2ca916633fa

    SHA256

    9ca98a9f2104079fa641b55c7aedfcba0d6cd3e793a1f7cb1a5dba801af1e443

    SHA512

    6bad0227a0408f4012a44db1236133df7d391b4d208f7190bf149457b947f201cf4c25953d57f127be388bff4e84db46de898f419602fd35956b8dfb9439558b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    76623bc7d5db659110ec70638790ba31

    SHA1

    17728565d6e3d8a39f26e14d0e80bdd5feb73af8

    SHA256

    2933fd31a3646dfa758d8a4d71c0fa9d861cd4c94196b52d2017a6a80f96f154

    SHA512

    802c92f38766bb582eb81d85ae684d90c64f71ad88ca30548e22183a767dfcee57f00f1b3bea48305271e0832e7e6a498b76c4941d67cc7e63b1cf79e35a0a40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4145690c7f91b3941df3950968dc2c95

    SHA1

    d9e10d672dda3fdbb45feb4f3c107bc939192d77

    SHA256

    e7f1ec2dbd508d81ee99cdc3e4e91b290d48957e05c60b95ece342b9b7ce2552

    SHA512

    38023ad6848f18d1ac33ea61d2093241b29d129707a3ae1af83bf325dc3505ea3aff7c2c94929d4b6aef9cd094729b2d8eab91532dad5c65a5c43fe3f0d0c9e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a1794ca01965bfe86d585778c1a28269

    SHA1

    3b779484aa27fea8ddbee9cdec87d2fbd5272d9d

    SHA256

    8bd8e0179cd354b6e43a49228ac7aabd297c18e37a2460b69020ce2e656396f2

    SHA512

    15d50164b18f729b44a8fec07bf81ffe0ddbdaa052f9ab58fc75a06d5673e47b5ae83e136457c5398f778887c68f639dfb3ea7da02ffdd5d6c14860b925b2cc9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e5727045429a0819fdfaed629e174725

    SHA1

    206aa34a5afcf04c73bf00f4ead75680540a0397

    SHA256

    72dc6140c5c9a4f1583d0c4f8bd27760d5322b6f94dd46d8b7797f01b0549d9f

    SHA512

    0f2016655a8663da62796af8138e45164696e267ea9b80486c77bfb17b31bf92a7b2ad414173db38f6c5ad7c3b64dcab6e8252e1a7aebc952c1f9e73ababf7ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c74600d44ad2750bb1522fecd1c7df1

    SHA1

    58f21782d65f074164910ad16ae5940c7709fec2

    SHA256

    9b60f9c8b929e319e720b3567d2913509be24da4baa5a7ae63b9f2323e2b131a

    SHA512

    53f5e2030df00cca10da1182f186cdab1627b5de163cd26b1b884f1a47f69235604a4863dab1830bd9cd771fe0cd52fa7754cfb0570e092dea562ea39676e9ff

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5bf3f64839b6d4e15e8a020e57f56229

    SHA1

    8ee6575eb27adf97e4432c92f97ffc776537f58f

    SHA256

    09fb84988113f443c390723088aa3a51cee2cdaa023776a2c1b92bf40d7c98fc

    SHA512

    252bd80438b4c0e2ee9d13832135fcd5f06c5d22b5afdb2dc24998a19fa98cce5d8afbbf4ded10c21d2b8d7d5512637d0304a134987a719eca4921f0afb300e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d0ddcd417c095bc81466ee9ff39c8e5

    SHA1

    a3ad8a709f326b6fdfad6f80f88a247bf22c3570

    SHA256

    c672c178d4a9e2551f94487002dfece3496337107edf98935a5bb8f1b74afea4

    SHA512

    6f91efcd1b0c7fe7cdb00c3724775ef974ad51be50e4cefb033a76cdb96d8a9fdd6b5912c8aee2d8dc4966be00e4f45bb9c6c8c9e5fece333994826ce546962b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    489ef9f079784f6529278ee4170ccbf7

    SHA1

    4a510e30c398efaa8b6542951be58889a55f9e9a

    SHA256

    672d06821eed5f84357f2ed1a131940af2974260a6212bdf3460aaceca24382a

    SHA512

    d05cdc1abbea274c71f5114c01e591818599937295abe562e5954784bc110f94bca27dfb22491e6e0c6dcd038d645a3ff7e5544de6f8abdc92824ed42d75d0b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a894fcd4c375b920db2e3d86a7f14bd

    SHA1

    a0b9ba398c6425db839635737f35ee37482cfd3c

    SHA256

    8d304b74ebe6a192646840c926af29214a7c0d7bd4db1d0c6207c9df45321030

    SHA512

    d43a337aadba64adf5dd2bdfa323dfebbcc39146d5ef73c3dc9b0e1e9c14e6b41f8b79c86263600d9e23c341ef5c42efaf6c81f0f5e4646ae9a137f54e65c3c1

  • C:\Users\Admin\AppData\Local\Temp\CabECD0.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF148.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b