9e364ccf2384a19973de23c0b730e50a84a250f915e09253e77740baa69eb9bb

Analysis

max time kernel
139s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-11-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bin1799/Plugins/Gaode.html
Size

1KB
MD5

9d9a8c9fcaa08607f615642cbbc29125
SHA1

953ed046d3583fee6f9558b3146310e77e4c3613
SHA256

64a05ce511f9a49b2c19748fc5a955897a0d7f0fd10905dd4fe60c7d16c688a9
SHA512

b251069b6e9accdf8450587b65eaf6c21bc03be916380e251f213ea919088aac97198dd75fa36047ab772adf77862b0893914800071e930f4da211a67c67e1ce

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000e55f8f591d56ef69f981945b07b2c4537d0fd066d78fb33771ac075b8cbf9970000000000e80000000020000200000009d7d3fd7d2767f5501955c716c38f78953d32d41d1d6c0e27cc67ddd7500c28290000000c3edd87de836685715d711c362ea22c20901d001ab313a4d34b79753e50af1b46d1f9dc5b207a31efe8131b0e88d20f4761f1a71a3362601adce900551efc3a83d4f7356e249e60ec2d299e052e3460249dd4a3987e9614e210bdc160f34ea5f6426e9d7d46ac712146ecd98c1586d22707a44eb8466bf0add4c7a8596782a3eddecca7eca1c79f54c7640ab0b730d8040000000b767a8494dd9084706c52466ccad1ff884dabe09de41469332d3a6a1b025f27a447ffbb3be6fe2336200f97601c87b08d6d6b9d3aefed36518bd5c6dba2a11fb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438082735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000004472e3f5ef4736f3625539abd40ea3ef66c1e32f5e818b64d6d02af768991510000000000e800000000200002000000050e9c82412682248fb7c5becbce850655ffc833ea7a02334ec6e9d9e8998a684200000009711bfc3241e4b8a417440d0bc0518fc65009e7f879e8180695b9abe472f30bd400000003f4d1cdd809fc7f151353cce131266fc39c3e654b589f8422028b0b53fce1a91ec4ba4bbe5cf7fca881f89c7e48498f7035a13c956b3c417c6ace1cad7090681	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509ca17b9939db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A4820D1-A58C-11EF-97FC-EA7747D117E6} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2700	2084	iexplore.exe	31
PID 2084 wrote to memory of 2700	2084	iexplore.exe	31
PID 2084 wrote to memory of 2700	2084	iexplore.exe	31
PID 2084 wrote to memory of 2700	2084	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Bin1799\Plugins\Gaode.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16dade93a954e48d9b6b3cada30d7382

SHA1
0d3eaaa231b41399bc3d7c9ea63779a265af76ec

SHA256
cdd9aca5467a726ba0793c96eeb1c8628c9796743bd0f225253c1273180fe49e

SHA512
2f6677577537ea9aef90f4b4cd9fb4eda53490512664095ccd960515d73b2ff16ffa9dc5da979f316a71282fda42c5896275bfa3c4d79e438bef1622b0a08d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
474bf5033e0185910e30a7208cfaa0af

SHA1
59c78d80b1ad871201daf8b2a8fbe8a5ad350419

SHA256
ec53017513360b7c96bcf85e6f16903f4c2e93c517c924373ae25d33a1be0bee

SHA512
6221d34b92eb7174f3da6eb068ac753a108a0756314962257f3d55b847989c5c553388c7724c62b2d00e688cc5c1f7b8294d15d8f40e1e38fd207d8d0a58b3e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae149ad2361a493ccf8ce535f96646c7

SHA1
185b0b7d5462bdc72728bcd440eec3a6e88a4582

SHA256
45fd0dc96eeca2c1c8441c65815284dadda515666e44705a6459db50ef7e04dd

SHA512
1dd7328edc06fa23f58ed981a0897e6756bc56462ecc557c5e53b4df00816ecb1fbb1994b07747ef3be1a150d128e4021f6afb2217295662de7e19181cff31c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11181d9768bf97de56d8ea25f5bb621c

SHA1
37a83e345b116b969ed89fd4d909bc10a6e69864

SHA256
5816b90cff5012a9436367777713d7e7c536b8b7ff91160b1b0b94803d947494

SHA512
bc0f8c8f6a2cc1d6fd1b1cddff3dbdc9501c7fb9130e931726ce6ee63b5aee031ef0d48df0fcaddd87fe47e9efdc55d1a586b1b84b74d9b935934f27f2a7e067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f2775cf68a1c8f6ada6454da6685757

SHA1
df187c3d800cdb679cf77c3a2d013aff654e7e03

SHA256
80dee81fa67b5a91f7da9f9113600acb261f240bcb488a067ccbe3f4afd103e0

SHA512
8ae5467dec23abb04886a1a41d581d9c3367bcfda78af7a7aa1e82ff79073e291c83e9d0fb395af571331fee0d4746128da4c193b4de9001fc16cf15c395af18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4248d73d341978fae2f5d575d8d1c56a

SHA1
fb7d9a9273bf837c86643d19723fc730586f7875

SHA256
b64400fdbc4a346e8766ef8c6b0716ef619fff68746e85288d255a0056411f98

SHA512
733e92cd36562b4d14673edcb4072a273e98f4a8c1227cce1eaffa86b896c49a40b70e38ef18352ca66ebe84afeafb143de373ac2cdeabef72e5faa52b2acc11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54fd54480dc3b7029f9980d078b6ef08

SHA1
33fae87ed285e7c5b962251f79766b3bb7cef184

SHA256
3aa8c4911b95ca8fb92b0775119a77e4c7b77ca668541802e8cb76994a854f57

SHA512
dfca34cf66ff4574c9db2b1347171cd25053bf0969ff6fd0a4e34fb0f0471628e4cfd8909f140aa459efc427f55240a13341eb6286007aeb40e7b78442dac507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a802b1d34a04c3beb9b0d071532e0b3

SHA1
40a96579e9b889d6c9695a7bedec6170c597e4ae

SHA256
b005a884446920d20e0b3be33d197f3ed4fa6e3a31ce0b4297ed760fe88b90e0

SHA512
1b751d076e34d007225bb2315a2a7842f9579cd3df73abe32f349a520dcdc7ce18e35edbd61c4addb6cb92df7bfd735404b2b1b454447e11d23ca401a57a77df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48c6f1f6197524e445f2c18df0c77215

SHA1
7377e97d83e0d505f68d9d879638c9f127b6f771

SHA256
16ac41a046f9e2a9aaced947fba68b513c0a815bbc832b2aedd054f061d4df20

SHA512
dc50dd912179d8844d15a900c8179bb28dd4bce2e395308c70f99fd7b6078f6289db2d3338a2eeafb4695912b7cee456348738bfb6704a939735fe3444c8eb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb46b58a0c2e81f3ee0f5bc3a168473b

SHA1
304df3b4a56dcec692a32bd6d7e5421a37cc6a8b

SHA256
3015c39eca4a2457e3953feccc4c4db0b22c1a639fd5800a80aa3a0ec3f7d69b

SHA512
76e9ad0ad23e84e9e80ccf72f517a88bb82a20d46f7a212fbea27c5be9f12684c2d68763a25d3c5a2b88b686c0ef6f37e3e1fe6b400ffbb60cbf57d0fb4919ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adaace08305a939a9bace8b662a4483d

SHA1
b639bcfec13b9a0454ee53de4719137f08b11c4d

SHA256
4b4a23265b05fe417381b51dc64b7e2513a7ef2605c89b13161272d5b8e6364b

SHA512
2207521a6f9e1d6df4ca1c93b2a0beb5dcb44b8e66f1db10b6f8b562eb51a59c924a4101b1886d503679ad51199a8fbadd00d12bd6db70f8d7c0b66d6bef6346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb73a58f769680410af3c9c4851280a9

SHA1
570eccd20c29cd985d5013399b923b3f598a5342

SHA256
89073fe46a27b18290ffc64dbce2504e9c5427998b283e9d0afc18616bb4365d

SHA512
176cea2cbf9907d8fb7f7f29f3136e2a2edd92d013f8fe6a77eda6e11d24ea87f6a98476d5f48cbdf247d08b56c888029dfd283ce0212db47bc28498e85449be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04e1bf5ce43d64b9cd7dbc87a86ba53

SHA1
310b4b1241424112fb815b9cc04c18de32549459

SHA256
77871dd1536676554086b0b4530c79e6cd8f3e22d1fae192f8cf65a205b7bfd0

SHA512
e28bcb925f7df74caf7882ca88ddf8b81e55773e0c61f700397d4a324b17f4c3eb7a32996ec163f7c427e51e708dd467c234a981f2fb7543861305b0d9ef44fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d88f29f81ce580e6dafc492d95447bbb

SHA1
2ed3293beee43a314d0f67184b2e1a3c09e0113d

SHA256
5aba17569d3e8b91114df641dc5ea433ac279d23b65feff98fd6d10db78a74f8

SHA512
3f13c6943d369b05882363d25fd3debd6ed985687a3ac39bcb8ca64a0c38db183c6ee88e72b7e8e5464a17fc324d95e9993205f25c1cbe85bd7e62f6e038fc42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eab16b8a58bcb23c371fcf154a6611a

SHA1
03cac8bde3ed1345060ce46b3a3ee6c6ec2a3214

SHA256
fa7ac83a14e4831004c5169b949e58d29cdf5be4350b600a19159471d2d35e60

SHA512
8f1ea1cc4a4f0e7fe3e11271ccf7f465784391be651761ecaead60e4d844b82d1c0634defa7cd396a977e1099eae4c4a3c3f02d82ac229b79900354e99d06c9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF2B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFBD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit