hxxp://fdfdfd | Triage

Resubmissions

19/11/2024, 14:02

241119-rcl6as1qep 4

19/11/2024, 13:52

241119-q6nesawgmg 6

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fdfdfd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60963e658a3adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000bcb99bbe7a204ab8b3e71eeaeb4da374cc0b0b9b01c2f61faf58e3c80ea181c6000000000e8000000002000020000000f9aea365d6560911fb3a6a1b8c50d1a9ebf2c44b7fd2e3a381302c9d68c2c8c4200000001438d50a0e6b3eac4cb8a0ac970c7ead21979a399b521fe60aa98bd0cdcde401400000007caa8a32e60cb04b80aa624ca0a80735b584a0bc5ec052723d7a8e14b3a9e51961ede4dba358c9a6b019448b3b976283a25a4c3985213fa4a41e4d6f26fc6b09	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8D54EA51-A67D-11EF-8FB4-EA56C6EC12E8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438186233"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000378d2dd62f26a413017a5d3fdcb7acb0f3642162fe488dc4773ceff7ae886b08000000000e8000000002000020000000661cfeb69f72d86881fcb9373de0526bd15b19bd636c92680acf36d135fcc81d900000009e8b8cf8d1b4107014bcfa98f6c131fbaabd4f684aeda2614b76333f83bb75edd5245fe90e3752eff69fb986167a31f532c545dcf30c62ce9474cc7d0ec9ea62e9171d8c0712aa4ef6ebe196d01e07bdd781c6ef8a2aabdb71d6cd940aa971c1da596b9a2170e90abc9d797efff5c1ba4d7df90eb29f47844329ff85bb8e4f521f1b666798949e6386f92f597630c0f5400000004194ae9fd0b17516d9ea259bdd04fd56567b6a233807cb2d31e9251357f1ff3ba3d9ae5e003a2b8612893796a4aaa33a4110f55f5243e699e02e892a74c1f225	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2452	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2452	iexplore.exe
2452	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2816	2452	iexplore.exe	30
PID 2452 wrote to memory of 2816	2452	iexplore.exe	30
PID 2452 wrote to memory of 2816	2452	iexplore.exe	30
PID 2452 wrote to memory of 2816	2452	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://fdfdfd
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2452 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ece4ee830ee3b964561272bf78551b08

SHA1
2290e7cedf67428de9014bb346e5ce187a32a0b0

SHA256
ded48574e89579071a20131777779134191112d459b289e3cfe2573ca41ba6af

SHA512
0e120d566be1bb7abb65ae90b2e1d5b2b4afd6431eebcdd0789167ff9a54f05d5ad62c561a17d04ddc20ef3f457cf3d89858fc50392e7d9e7a07c2e8b4c1b906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2f4a82b9f10042571adafb8e55dcde6

SHA1
928ba0c2ae9ea882ded9fb211f4536efcae08a45

SHA256
aad1295e1db88a819bfcfcbd1010bf9c2f3c641486b6bc2b2c9f74c3a589f1dc

SHA512
7710d6d38ee9e270e61a0520694ee04308f18e549cf394d99953e96cc29be63a627169d9dd7b5bd014ace37a7da914120b1ce08553e56d59a8dc68872947dae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2123dbfe274bb86ef7900605321ef680

SHA1
5f488f9abc895892e24fafec3434d0cae1698b67

SHA256
70517a47a6d90eecbbd0cb58a4d58db9eb9bf72e5acecf6704be3a56c805caeb

SHA512
30e8c6e130d89a75edc7d58e79e9f4f3337de05d8b7404fa67e4f9ea5f2250827e64fb4a398232480d470c0e732bd01936911b3ff13f08714ad66c8b18f8b331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d800bc50c1acd5d89e0f5f9c72be4cf4

SHA1
5705fb7f83773ca04cba4b086432798df85416e5

SHA256
41eb216cf182f85e62ec9da292884aef28c5e041588aca36e6ef3aa45a020270

SHA512
d698d18fd1e12969fa3fd246eb6433286dd13b598c6834d4830eca109d0a947314d1a6f64163db8b26369daf5fbcb830041f51a3feee38718d948579ff33687a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0035b02269042e9af08e54ed9b1bb355

SHA1
9e540c202288fa20a63e27c2ae305978555b3d99

SHA256
4123ea408023e32a5016a15dbef907d9198b8f1935b008b25122ac70ac9e22d6

SHA512
1f66a26a522ae80d574fe8c0c314678d5654d70fb9974a39c4524a144a05c3bb3088b7f4e1ad7bc94bed8806085122bf75793165b72f2f1c97aa8baeedcd37ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbb6e279e09fa206ea0ee2a945db4121

SHA1
d3e1e2dac5d88012a78eb1b7f53b6f4928bf6076

SHA256
de860d1d6beba84cae25a9da44ea54ea0ae2a45c037b5966746d7b6a401e96d0

SHA512
1bbd3bb765a69fbcb6acec53411533abc71a28c9cd52f932334a6a050ce59bf37f112543c2defb67db18fa2abb0ef5f4ae8b22cce7de2ac19a2e0d275940b25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e28489b27599bb85e8ce0c4a506397b1

SHA1
1089d108c8413322cb8b11b7b99f38b7deea0aea

SHA256
249d0c1a0a06f56efd728fd2ca9ea562591c59c8d3c1d810c404137cce909183

SHA512
fa81c105bb1772e7b373a113b0faa68c5ebeee39d20e21946c212d4ffbe163f59c54e092ecd309be2d7b0d3c6a431c6d385cdae7c88f5fd78eb4620b20398537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e68008d3ef2d61065fbd123701cf9c7

SHA1
546a2047d08f6f21d0cfab1fc76658c5303013b8

SHA256
fec045b68c7c98291fbea63639e0d70c05a34bbcc616a26217b13f03a93b4129

SHA512
a776e6a39ccde64ab16aeba68ef02258bb9362dcf29a4bc534e10c1f593ab782a72ea65eec1954e4015cef8f090fe158e1a9bc83a0be5c6e71971de1f5459c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8027c9ad4b5629b156af222801d4885

SHA1
a25468d3fa2511b7344859e35841630cefccf484

SHA256
3664ffc4eae6e1576bcd63879c6f53937fea13b1fe23ea3b86df2cb05934e996

SHA512
96942bf05052cafbb8eb7515ad885b5dd850f30ee00b83d74fd8b6853ae49b42f487647603571d34c71e5d8af1d59c9296b954ec0d82a4de5966dc8dadd3af43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ebb0e6b47b63e85bdfd30422beddb72

SHA1
652813bb204b00002e2c8c724d2df349785b1ec2

SHA256
a4a16759267e4ad5fc9db239edf025ac87625a5447e0673671dd664af2fc3a81

SHA512
4f4838679d695da88100188519c48c269a2f9572b0f010e81b6c0a834f5e951ee8c656b5edb5bdee9bc5cd36111fea7d5b066450be3d54d7ad3142748cc6b683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06cca28c602920310c52718c545b0d51

SHA1
1e5f6445f62f89e397df54305ff16eec84d18f72

SHA256
ee864e21fa2875cf8cc8d3774e87496501b9cabb3a9bda357db22fe6b2947165

SHA512
e7c5fc316828cffe2e52ec633bb707795f5188c80b9656bb08bea1773b2511168a7b2f22929b93d43959624cc56f1dd6aca58fec7dcbbe91f765172c65ea051f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a80d1d05dd4132242d4c794e89a21875

SHA1
8af65a637978e4fb3e3724a37703a906395d8565

SHA256
bc55af6c1c20b7f6cfbc66a02b29b2ff365cb690ee38d057fc15e2b1f3ea7ba2

SHA512
68d0414b0217ea532cc75b7c75c313e0b61e21e03df8fad6fadec53c5288dc9c50db17efaeab754e958fde0bf38962b659a1a0ebc9cc0c18046726039a0d5ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
defee851bdf30f67082e7aa464944a2e

SHA1
3e3568129198b2e9eca42c2c2836b68507ed0f59

SHA256
91dec32ec5b6a47b61b17dc6114ad888d8d1fce2d32ca86bdc5502acb0a8111a

SHA512
8a4acda5b9f6fabc80bc62dcec292ee97c4a2b82087417e269a66310b5841d605b3c51606dfb10c081cbba8401f123404d93ecac624d2dc63fd4405a102da07e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a98d0b70fd0c6399531fe1943b95b4d

SHA1
fec92e50503cf6a85dcf8ee607572fbc3cf965b6

SHA256
dd50cfcc3d8457f8c6b8fb886cc5cda4336a1058c711e93146b900ddd902cd60

SHA512
d2620acc643b2d95a5ff31b9b70cbce3f6574d962f8129b290f9ac2adc7938006cd55a33fd7129ef51f6fba77c68afee80cbf1deb761dd775c5e1494113ec2dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b92fbcf1777588ccc0f9b3d482c24bb

SHA1
96599ad9f43765ab45ae22b5dc8a99ed57b81859

SHA256
ee8446dbc804b0a09b43fcf3b0e8dc40c65c769445cd5e0d62d8b143d3404673

SHA512
c6a92d290e4c2613ec99e4743c0b169db9a1fee16d12281ff85b697db32c1452523823a9215179e3ced8b3e1b434085b1570775e3b946deb2677ebd026bd41a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263c13f92072523ae3df230417588b40

SHA1
086cd1330fbe8eb876fe28f0bfbc77271c327625

SHA256
fd73b51bd92f50c394b6d227bf4035efbbb30f588ca5f8bec265b9cd4a82bedd

SHA512
781c2bd6babb73a8eae585cfe4f597c40954a03cab836deb1a3692189e129fa0d760048a3bf479e1a5b5b7b6b8793f9df38f722ee98d1af6f4e4c60ad18e11bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c144e5b68cf8aca84c24faf795e32875

SHA1
af56a68f4eb4ef7e2ff46e849963533653140770

SHA256
e955561b21eb9832c33a83ea5cda947c3552dabb5cd041027e2fadb4b4c86cc7

SHA512
13e91bef5680e752183cf498c2d754d5e39f95e9b116bc5d4103d0b3e9fac0b73e9867917714ab45db0136f80631d747f836b36bf0fbe479fa1db65c1b009772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e4bd13a5c7f3fe9e2126ee08a79b1f7

SHA1
449c0d0c3f23747e1089fafd3fdf22c542018525

SHA256
aa335a843ddf53b8e129ff3986d605b5b404de3e813688876c00070288b7c090

SHA512
38940a01558514d6dd726dcfe5622092cfa73e4c45146180effedff3f240d1695a260494ef993ab08ebbc85c801ed5f977f76bdc7362a604e63ef7c7708dbb9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D06.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DF5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit