371edb664c31555dac5e695b0f7286115dd94b380c188948bde2f167f030a7d3

Analysis

max time kernel
97s
max time network
146s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-de
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-delocale:de-deos:windows10-ltsc 2021-x64systemwindows
submitted
19-11-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial Grabber.v1.03/Mercurial/FodyWeavers.xml
Size

139B
MD5

d43cae162166535ffb77fe23ba9939b3
SHA1

a90ee3518fcb92bc6fdf16a699b141f22b9b7946
SHA256

4448546786231d0d396a9987bc8776509a7a6f6fd755fc68ce63bed29ca8ee33
SHA512

30c836160cb51cb162391cc8172e620564d8529bbf618c930a0de4b037f977f03a9a3950cc3546194c5d452435aeb2fcbc416a8c5206b05710c1b11168d51e2a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c27c3094df67f4d98fbd20fbfba7eac00000000020000000000106600000001000020000000c5fd5e9adf5ff69911e0063629a62ec6968324ec2de0c9ffc4b9e76465620475000000000e80000000020000200000007441d8e5697c46665a8e21ded0ec5ad16d76dd43eaa9cbf0a07092c0f4aec0fc2000000045a8f5e4d0e4fc0b54dd1e101c04443435c1823dd4debe1c79f6de81ac123d7440000000bae9d738480a86bf811f2da936ccfeb851e4952da381e9e6480091ab3f9a96defb093aaaa08bb1e9c976670cbfbfe6f9f11e8ab9661eca9ccf0d61e6bf364b2c	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002c27c3094df67f4d98fbd20fbfba7eac000000000200000000001066000000010000200000008e70bc22e51fa331e58a0849229bde3e771d0e46ada0550b1f2256123b752afb000000000e800000000200002000000096969118fbb561f7e80398898608291848ee0016ce9c5851951286ea6cdc597720000000e1ce20af2c9f9aa53c7a32fb8216840ea49e55d365c16d717c46d1cdcab44b944000000067d4a7d7f1af68f267cfd168e0f75c026926dbc816b3081e5a0b971adea47b0007bd4e938f1270303bf4e296137169d381e3d1101c43d2d7ba8714ce170fa06c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3077310482"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\de-DE = "de-DE.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31144565"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3090904582"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E2E37F82-A668-11EF-A12D-6EFA970C7C86} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438780464"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3077310482"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0003f3b8753adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04cf5b8753adb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144565"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31144565"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2108	4504	MSOXMLED.EXE	83
PID 4504 wrote to memory of 2108	4504	MSOXMLED.EXE	83
PID 2108 wrote to memory of 1928	2108	iexplore.exe	85
PID 2108 wrote to memory of 1928	2108	iexplore.exe	85
PID 2108 wrote to memory of 1928	2108	iexplore.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\FodyWeavers.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.v1.03\Mercurial\FodyWeavers.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KMZNQ6LU\suggestions[1].de-DE

Filesize
18KB

MD5
cc5361b5fdccfc6830217e2eb9972dd8

SHA1
e4a1206d9190eccea3e6a116c954d11da0aeba66

SHA256
afd57b0b6d8166e25bbef7cbc97522677c11c9a930fd4d4a204d1b7ae6258492

SHA512
ef63961bd7f0d3357d352a8f9c8ea57d0271e0fb664b1be179c38cd2d559bbaa4864f64f3521f26f868cc074f97994e2658c6d652021a39dc5207d45411691bc

Download Submit
memory/4504-11-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-2-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-12-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-5-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-4-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-6-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-7-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-8-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-13-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-1-0x00007FFEEC00D000-0x00007FFEEC00E000-memory.dmp

Filesize
4KB

Download
memory/4504-0-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-3-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-9-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-14-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-15-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-19-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-20-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-18-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-21-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download
memory/4504-17-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-16-0x00007FFEABFF0000-0x00007FFEAC000000-memory.dmp

Filesize
64KB

Download
memory/4504-10-0x00007FFEEBF70000-0x00007FFEEC168000-memory.dmp

Filesize
2.0MB

Download