376fe8792741f2ab7e1c7fd3eccc5e3f44a8aedf94103bce628b22dd739bea5b

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Transaction_Verification_info_2941UN43RO.html
Size

4KB
MD5

9f4f3097f4c58c7515b1c9b8a09614e0
SHA1

78e57f79889f7d5f64edffd12f3a4a94ccd4e0b6
SHA256

376fe8792741f2ab7e1c7fd3eccc5e3f44a8aedf94103bce628b22dd739bea5b
SHA512

7509f8c1c244a56e1dc1cab0a13e3de30de69e0c6e632d719b0fa71522698711a6f11eb6048c1268663d8ce0e614cf52b42a2d8b5b908213acebc7113fa02bf4
SSDEEP

48:M0yIVQ1nCmDAUfFEp7VbXFVDZnZxTHJjibG/241CTvp64gH+deDvVREAc8dG5kJo:QIuUm/FE7jlbzJhdavSn5yAE0FC9qfZk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0200b9e4e3fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C715C7A1-AB41-11EF-A0E6-E6A546A1E709} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000009fa68da0d79a272fd81b835595266038a9cfa3dfb3445b1d1a31b9044eb11a81000000000e80000000020000200000001ce413b0f729566302066c0eeec1b06a3836032691ad9d9af5ea8cee0a160719200000002ede2661c0824385ab10b8f2de3565afb1794d12d742a70efa4222e4d615edd340000000b191c9b987a5aa81e23c77f36e917214cdf4adcb68e242842892d73d8d2bee1806da58504249cfaf78d0b18201caa0564f3c0c3bdca33c3cda2382c9b6ab89f6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438710319"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf000000000200000000001066000000010000200000007c960a8deb7e5d5aac78f3cdb524984e1cc991e6b2bf90ad981d20c02dfcdf2a000000000e80000000020000200000007c216a6f886abac6df840c0e425d606ba7ff9e8c3e78d9d67ee94a48bf5875a490000000b89be2e5e39ffd1c4b7be6d00161177cdbe21404256f4323e7835579c74cfee92bfcc31635ac772ee22693d9b8a4a2e9b05f884db5d077302fe89964b37fcdc1644b8e8065008913676c38c9cc316d41aa1dc2b960e3676046df9ed7a87c44bef0d514455611edfb7d016200e80b896c29a8bf0c4b14545b8bcb4004ec239a98e650adc1c2157326e573b4068bed82ae40000000dbf07e718d0117e58d012275536d8b7efd589c40fc266810e6059aed7c92bf2b666192dab4fce13e548226fc6ae5b5f1ffd4bbda97cf67697e7226130a74423d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
772	iexplore.exe
772	iexplore.exe
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE
2176	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 2176	772	iexplore.exe	30
PID 772 wrote to memory of 2176	772	iexplore.exe	30
PID 772 wrote to memory of 2176	772	iexplore.exe	30
PID 772 wrote to memory of 2176	772	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Transaction_Verification_info_2941UN43RO.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:772 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d1348b770701e09e9ac847f413add6fa

SHA1
d719b001f1d35c76a8bf7c36cc2cbca7441ed6e0

SHA256
433cf6874db2195940105e6937d96a94ec7e1f113db5d2e7d7752f3003115846

SHA512
8aa0ef49311fd55905b544639bace0ad613ac2290f3c31d327e01243b34c83d23287a2ca4be8fb2960843a5d720c230d515fb298d9ddce81d8ce9f34410a5181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee94c8d0e23bd53d88a71a64b24a2760

SHA1
552b9c8ac46cc5322433b7c1b0c48f034fa46259

SHA256
78b0ededbee53e984d22a1dc4e22ab43e4e61efcecd0566484060c0eee6db72f

SHA512
70ba51967cdc466e4f363de019df2e284f95e2bbe4f664496342b86d6523738d6fc79fcaf5b69359a12910353040b56f6c1f28e20ff27e728215702adeead800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6526d5ee988b01f3252d55cd08ae271b

SHA1
f1b1c32705dbbae7ddf30bcd55cf0dadacb0def4

SHA256
60cbf3e8887fccef19c65bf40e6e56a5fd47304758d14b370eeacbf6be151512

SHA512
1fdd74cffa95adfd211c254e2f3baad1c6eabbbab244888d9af560a126b113dc0b958d02b3c955cdba6c322d20d686dae4c1c2c4af07326361a63a3cb0c2eb25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3556a548ecf8e8f630be6b03bfc77a8a

SHA1
3153267d47494ff391337d20df37d76e7659c14f

SHA256
162ac2ef02b47735bb0c9a1310eb3ef08d1f73020485c6bf57ad6da7ea7e3012

SHA512
6992c654125ee5b50a5552c4ef5f3bd776f08bafccb4569188247582fa8f02278b6503f6b80139a821f7518921452b0f2f601a542e814f9bd5d9e91e87ce0f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e940cfc791271d9079bb5bf69d822b4

SHA1
1f47cb1b97b49c7ac18f524b7e1bba1b40b8419c

SHA256
63bdef2baf42f4b1a210104c0825687a774e3b00081f61220a3af7dd8ae996e4

SHA512
0c77de06a20a338075e9b08123b4fda2e4a559be5daa332c6991ecd0b2eafbc643526ecf8563928490875ab7bef52fa71805c744cc8b05bf158c694827de20da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da7ef5fa496d7119c1b4efc6fc43738d

SHA1
052c6a65c71b65fcca40e23b9c1369623b4b3c64

SHA256
619d8722c808c9d54dd7c7b0899836f8190552f1189673bc217ca2040ed80b35

SHA512
5befa66ea982fa0cb5b6b7e13e7632195301cb54f457f2eb7af45c09bdac3205800e8559b632ad4dbaa399239a9921742ca3c8e3dcddd0773a0bed1a9d36c37a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c8de091ab16e3263a5f4c15a77232c5

SHA1
dd6f605cdaa85c1d4394531e6526a111ec0316e0

SHA256
b3b872951207a3a90da88f97343f698127d8fcb44b0800917625b1bef3ac3e6b

SHA512
7dc3ee2fdb7747a7294fd677b9c5f99a07b8ba98061bb6e93745d223c27e42293f00958931d93b10a85fe58f538e1262696e726d5a41de7abca2a45837831786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8547a68a88f267cf78d09f38dae1dbfb

SHA1
9614b2abffdb11090fa43f4f46647340a94cbf56

SHA256
3c2cea92b48f31089ff6e77248acf8b5c36b7bb5557efe99c0436272d87103e5

SHA512
480225959e892e0a986a06f6d22dc3eef14bb13fd2b6c5334d3d61bf1cce36cb07e32bf4e9caf69f02502f8d7c41cbcc999a971355f1da368c3123b19308f651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2eafd9428a8c2a22fbdb741bf2cef31

SHA1
d31d42c76f82818ec616dbfbf85f1097b4bb7371

SHA256
53aa5904ac538329b40bf83e6180bcf0f9d8e5f0d7e65efb07b85fcc05ef197e

SHA512
76122e352053e293d650f7a56516821f89541383278e1dd093a489b7a902586bddc44e18e1ee005e0a5b39863d3537839fee0d74bf9d28bd41f8081aeb5ef6f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a1e64ff1242b7d7bc756434d064069e

SHA1
cf66e9fb154d237ce15c3bdadcecf11eae69247f

SHA256
45b2e9728d293a8810fcc5932d6dc9cac5099b2641359ea41278d6ef744a5d92

SHA512
eb783a6016bc466adc49a562b11dacab54c3ad633814dcb47274be8554682f887b2f1dc5788c76bc7fef1dc43674cba56b24ad8f2f6e96d61ffc39cf747874e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e9c32792a836eab3f83f1e3fd6d41e3

SHA1
bbf5c6e96ea4d050f79299cd10b74d9f1fa4ee28

SHA256
d4c52e48f69fb9fc1307a1fcbc8f749bc15f194c1d90cce916a5d94d74a19d06

SHA512
23a087568a3e38df71222ce20dac1745b0aba557a68a85164b3f2f129b26754dd7b02fd5143fa53b9688f1a26a7abe32a2c60d75fe65f19b0d2bfa11b00151b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4f9c5d15942ed4892ebabf19d5b56ee1

SHA1
033c1e861c03eafdd15bde9c1736e9f5fe8b02fe

SHA256
b7a017c2fb53d1aa1755ec89a89b5424dc5d1d661908a66179d8085d3b79011c

SHA512
e794140fc5d03a6cbeeb44e38199c0e77b9f7b593fe4e576a8de6f1576c8e853dc2e11ada0678d0e3f447e5bec5ce06f118ec11ee10b19197ea76800ca601ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
617480b99dad7b880cd9db514a401231

SHA1
e52ff9ce2b37956b51e2953e2b5ce884aa43c12d

SHA256
2d055db1d8e6c55aec9425129029d940f2a85ebc6ff9c36c2844a084afc9b563

SHA512
8555360c33383b83ca4a663ac4d4802f57928243cd876193a7ccf6a9c09e98851b7f854de30c67465e3a598a4f1c7903c8e9912098fd5041cc7f6b15a6eca533

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD71E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7EC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit