beab83ee3c6aa1b1a6355f237914423494be0b8ae8374fb88f464cc4df105b83

Analysis

max time kernel
134s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Order_en.html
Size

2KB
MD5

f71411fc8737a74062e0e38a7cdf281c
SHA1

76fcbf73173ee0d318653cd92b0f6db985bbb59b
SHA256

0f31b418f6f75277f4766bbc4cf4d59f8888f36fb5821247e01d5fc3a1dfdab2
SHA512

7a5ac321e01cc4f2e40d25e579897d295f2d9a61d4a80f0c824a00c44df36d8f620ba3071ec8edc7dfdba9908204ec82c505c09c884cf0241ed4673167d0e60e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706df586f13bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000e53adfa99ab38c10f76b5b96e54d107bb05647ad1636d4d44b557a4d6405be37000000000e800000000200002000000087a33dd0bfec118a7aab4bb9a9b06680ccbdb6d639c1806b480bc2970fa0fa7d90000000bb5443a90afee5d4b2f6ef7a2c164e1c6f3dbea4905479982fa0a50bdd7d9ed2f42492aac7023aa5297070eba8bd412cc7e6c6231fd08eaf55e4d2bcf060d99d038578efb2306adfd77476368c72f448b79f418e2b5df529ce421ef3548bae48b1d221db1fb3e03dcc4d0740d75fac42606e911f6df6a838910bff15e980dc57b1eec07eda159b33ec8873d51b9441ed400000002fa909f92aa68c81413522411196457514a180c0b6ed90934824d77c282aa2859926859441e9fe8630448cbb1ca77e66f10ab54c588b3337fca88aa1d032ea17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000038cdf53280091902ceb94c9372a6d2c3c6e3c0342e6761a2671ec5c53461c6f1000000000e8000000002000020000000cfa315fd21802147ac546cdb8029bbff28d18502b09796f7112c3a7daa2e1f39200000005b41320322140805afba863a18e5afe913664b2aad150344a540e846f48d67d1400000004492ea4f6e47e45e6395152dda90625439c58dcef4b98371fac8adfd2e171a7934ff25de03086e301d5a3fba3fc517281bb0e348d85d1a732d652e32a2f43f03	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438340483"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B26BDC51-A7E4-11EF-926E-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3036	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3036	iexplore.exe
3036	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1536	3036	iexplore.exe	30
PID 3036 wrote to memory of 1536	3036	iexplore.exe	30
PID 3036 wrote to memory of 1536	3036	iexplore.exe	30
PID 3036 wrote to memory of 1536	3036	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Order_en.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3036 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd495dbc8ba5efc77c90327a6ca59cdd

SHA1
2df3052d27ccbbd009c8fb9d8976adad340be298

SHA256
5b064dcab303144ae4507f20b02a2d165afd81cce2e83a0bd2c68135d2afc0e3

SHA512
49035377073eeee652f5e6255b9a4a67550fe10b37d8c574f67592e74a3a4ab40940ceb45c81cd625c8f80e6ad2ce0a43f1bd2e83e41977a57841ebb405845e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5c1158cc33fbed2a36e48bf6a5cfae

SHA1
aee02360bb16580eb91a858bf28a75e5d573b3d7

SHA256
e5d9ff9a200b256d55439fdf772664863bd6f4fbb80bda3de7ba322fc95babd4

SHA512
096f6cd6bd7826143b04477b7609c0ee36066dd758041171365d896d2c62f30706ab4ba6066499511f77231383462bf44d12e64b3652f31ac5f2c7821073f532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ae5ef8f595a2e318b4d4a7bb37d9b30

SHA1
d2b5a9bce60486078562f6343a47f971676d939d

SHA256
8550d9d72ef35bba63bbd8a9d8de5bb73790d25556002a973371765849020ff0

SHA512
6a6ed4590f5b63775d230e7ee32ca1330b77b5b20f043d1c2e7a90093675aa942f692d25b18bd294a92556464251480975d15745e9e793f4f6c54688ac3fc076

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
259a0684b09ec07e585622652354d10c

SHA1
b98c94d4b56580608759c979f76816d3a85ef544

SHA256
8ebb792d8b7410bb4644ed0fc1453ac50962547c0baeccce751e1d5fee8f0ca6

SHA512
c8a730517eb1d4f3bea9b276768f3e94f09a1ca75eb4d507fedb1a2877be2bd8255d56c009c822f1fd1dd9f1d7995c973a21ddd3080eb028c1d2338e6727e762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d62b20850d4ba899c217e39927b0ab7

SHA1
46a8827312d810aaf09894dc55f54b69efa52096

SHA256
db70532afede8d1ace268507172c007091ebf56c1e3ba7f16e873064e0fce9e9

SHA512
91c759ab87e02d9f7109c7af78b723d407219dad20153c1b49ab3477e5147afa0fca4ed793b8356ee4db23fe6864f9e536a9c731f6b51fe2fec05d39aa02fda9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bb6ef6c1d4b71aa6ac2bd1fff69c315

SHA1
5ae5f07f4a25017ae9713492147f23748da07953

SHA256
87b35bcda5af6e59921538b0c4da23cde95c8abb36998bf5b3cde26a3104441d

SHA512
92f3a081c22bc4a24625bc24447dd1a854463a67ec7589fae627b7ff1a3b7ad1e4d53d6895f5b091d3d78a9978d4e505475ae9c03349107ef92bbf795ce7866c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e38e6f34ddb7d98af2c8eeaf5afa82c7

SHA1
69f4f2377ef3085f7e6ac839906b7e62700c4889

SHA256
834266f2569c3356b55bf9bf67fd372529a657baf1fcdbe173f33f5d53399c4a

SHA512
52ba166cd3bbe10bfdf7c78d38e4137bb976aaecd5fc98106def5bd4e1ecfce1510b29fad9ba22baa42141468437fb15106c81d2e1c8e87eea7136a775ed7347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4301b4e3f88100f640b2e347cc7c8590

SHA1
7b1ed8e45ff76cecf63186bb2c902cecee8c3668

SHA256
1f3fc781ffe2a258c6b85d0b99d9484f3b850ca13739f281590e5f5235c40a08

SHA512
a3ab8011ab6bc72f0e3511c8790e0e405b8b9431d2a358f93126f7f4a97cd4059131383fbd67d4e33ee80b13b78f4c04ef5fb573e7bc5312b406db2d2be40c33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09f320f4906bbdd2301f3ddcd439fdb4

SHA1
492e6b9fec5fa6389376bf4aa0e523df0e58c5e7

SHA256
4bb2203d9fdba05db6204df9f0ce7be30998af46da8f018f23f6870c32d3e3ee

SHA512
018e2b695645f9e2bbff795c895c23263923405ad203030368dd0ba9d451ea9c4a50725f263a85673d7374945b2c235007fe9e2bbeac4819324a2124e62055a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47a3ba6d5a9c896aac4da53eec1a9b23

SHA1
5827bc701c51cfefb350168d13c8fc57b4b8dc9b

SHA256
52f38bd41d5f38b3ec3c4290956e7777b00a5f7888eb47fee0bfc82e0bd118a7

SHA512
74d896248045824ac66eb9fd06669f15a675628fd68a8cd2dd4366208dc368796aad3202c047c2044183d159a5a0598aa6fe8e219e8cc8a6385fd51047fb2d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c6df9d9b40963c33e9093663223145

SHA1
d5b58badfd17d7bce2421cccb4967d8493c7f425

SHA256
bb53dbb7088d748a8cc91e6f48be415f8b4ac14eedd391c1042dc7103a8e5810

SHA512
d275fd71b1a5f711b6e53298596ab7ea82d1140ed3949e3eb1b32dc8d3e1dcd7319fafcf893c2305234cba5b0d879e75b19955bcabda45f5161b877f48647b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2c324edfcd008b69dedbf3465aafa2b

SHA1
4b9e33748b5e029d7b8f700c8c7f76713bf0f089

SHA256
fb2dc9c6c741e717ffc5baf5d7cefc404060c30390dd27294ca1f7b1dfe5165e

SHA512
a7f9392942b70d7ccb615e3427e2abd5a980cda6c083df2936481d021ded537cead28db30544252ebc64e6cefbd35c238d8d848993c0cfa045215a9dbe47c805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ea69e73ea6aa790ed08ae9356a4170d

SHA1
fc2d396d4793759d010486916a94af8b3d0ea79d

SHA256
2d9a19f827ad5c951eae0ee282d0138db151e82b451813b4fb46676fbaef7edb

SHA512
b41e156f28373c646324541c14b4e5603ac5dca3bb231051eeeb64435f50d83e77782047a8649acf2f324bd164886cdcdaaeecb5b313a3708cbd89c15f86aede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d0651f57b0d4608e0dbf8fd4444627a

SHA1
f9906da846351b74ae2db174196972f901edf64d

SHA256
16eec4a2f8eea26b93499668f0cb8186a55c22b7ae9f9b2b5ef09b4d187f58e9

SHA512
3769fa410689a75cf606c2fb371b0668ece8f0b589fa9bbdf6470d0933a6b80fdeae29c6bef18a9614673770f55e57a693f1d656a6ab7f7e05aa71f41048bfaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e22e38307b24b7473cf18c2e39da7f

SHA1
a7b2ac7fca7789798a125c3220363915ef1485d6

SHA256
99b55b4418b04061695fc4b26e31290d23791c018ae3e12449a21a04c8e55c19

SHA512
dfd53b186432f464b23c47fe92bdaee045536b2100f4fed19582e1d35bcc6adc5b0ecf8743a7bec292096aa699e07bb7957172ef999515359188007150a32007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a9cb6245d9cde1d2c4a5a878d9aa425

SHA1
6ee7a0f219cd6a0bb6284ec1b698ca61fa91f654

SHA256
cc5faa47af88840c212277b06b86139fea4a8adde1970389bcc2dcb376db0970

SHA512
b4108b19e48d6706232bee0681705fc29fa6e40f9fabc5378d702f3264855d07ae051a382b39fef33470986e5b1dc538a481016f62c6f27b239c4b43972a2fee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac0f021af94be547230f15c11c45e0d7

SHA1
26a6c61ad626322c1b10ccb9a902a7d0c4c126e4

SHA256
e61080a041ccac8c7ea272a18cbe5a224e0b66dc3de56a32f1851317c488fa4f

SHA512
b6224836ceb93f5950908c2847774b1e3b4939ee1a43e1df38d5b5496c7611ccd400afe2b670d37e35cebb7c8e8f34e86718533c1ac4e2da48a46701465a6961

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9C21.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9CA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit