85c912a1a16544cb7b3c6f11048f764c969e76b2ae7ec94773521869cd871860

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Themida.v.3.1.8.0/ThemidaSDK/ExamplesSDK/Protectio Macros(Check Protection)/C/Visual C++/vc_example.html
Size

1KB
MD5

97ea28334d67d71e4a96b56d76fe0d15
SHA1

caffb42a57d09d6b8246c583f0d76004fd003d86
SHA256

9965e660e07492e5c45bc7c52b981d1d65f6341a415979742418f5f699c1e771
SHA512

0f2c0e693dd4e83e3c0bd2b68f6015a878f77b87dd0c84da836416b74e4284e8787c19b5d361732ab0d45c2b9c924746d73dba1493d1722b93731db6229120a3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

IEXPLORE.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dac90724a9f3644ca758b4ff37ff5c8600000000020000000000106600000001000020000000516341ad82372e76aa8d76123980f7645e849d323d65a84e9f6e114e676c188c000000000e80000000020000200000008b3b1e6cce69a17f2d1af94afa955d80b5a553ccac8436d2629ba26d884bf3c720000000247e3a42365ac15f6472c38c2fc8375fee9b81c809c01aa2931244066958ae174000000086fbd5e96920b6881f3b4ee134a77072fbc738607a1d2390005ce0bd6744d0b7f75644590c3e7d8355f43df011565ef431943980b2640ff279a95bac9dd4f930	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439037690"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01C5E541-AE3C-11EF-9D58-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40943dd64842db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dac90724a9f3644ca758b4ff37ff5c860000000002000000000010660000000100002000000090e658b9fd49a522e4f4e98de52149ac633073895bf51cc4097c73d4c22ca01f000000000e8000000002000020000000247b0ae1cd49860baa9aa46442ed9eb3be0ec947a34480b34b8d615312a633b290000000454d523605f88d2215e5bd27060cbd3f268494518be434a7038473748cacb1a6ea88008a80c28f87e5c8e9847e5828cb34867aca65581156964c77cb28ce9d8851f1193275a457fc694193cda2236ba4d57c42531bd9717908b0b63311fd7bbe868cddbf66365caea990b40aa948a126db2f589a0ac13aa43db4fb3c6746379f56ab99f97c80efef3d1c17f3b9bf4f1d40000000201bf08625caacc0662dc2c588045045d293504fce5e870138925c49691872fc75efd8df1542d4dbde0dac9c47ccfe51ca59d522562032c84e00d1fbc2309e80	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	Process	procid_target
PID 1732 wrote to memory of 2148	1732	iexplore.exe	30
PID 1732 wrote to memory of 2148	1732	iexplore.exe	30
PID 1732 wrote to memory of 2148	1732	iexplore.exe	30
PID 1732 wrote to memory of 2148	1732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Themida.v.3.1.8.0\ThemidaSDK\ExamplesSDK\Protectio Macros(Check Protection)\C\Visual C++\vc_example.html"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df25be76a04ef51e40ca8aefdf616bd0

SHA1
df2fb1cacbb740a006f313474921377a4d860cb0

SHA256
d3627ff5883d46a536eb99ad07f158f7d4f597f05095613221161e389f4475b3

SHA512
1e31cad3519be213f67eb67e98e849016dc265e01a02e456d31c3808518b3824a75f8f223d4d0cc6e32e5013237e123896b63b6051b42e2f721ecd5196f94577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8ebfd128296a7ecf34d2fa83857456a

SHA1
8a593e9772a036516080f27f92f7e959d4fed8dd

SHA256
b691d81a08c7cf3ee0fa4cd19bddb5be25a84ed0f93f417dd70eb7a98d44a426

SHA512
93814e0eb57d241370dc2bce8ed9f22fe5759c89c13dc4c29b083185d07c6bc266e22e0ade86cd27ce6f258e60f58d9947ba4c540b35d934bf87bea9db715c6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ed37d3b2271169763787a0f1c1c153a

SHA1
96efda7e426e8c2638344887cd2678ada538fe8f

SHA256
28f87920c9adc5b47579f1ea406e06e910a935fcd4b0b8e51ad0e6d3dc4e055c

SHA512
ff3f6f9d5fffca826fd9df45262123231395250bbde22160097a73945597989f63b1b88da388b9b91878295cb15b55242f5d2a488007b31559a1c4d80ea6f4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99f54153ec930b2258e6f9b36ba377ed

SHA1
044786f2ed034a09df7cc9b1e7f44ea7ad199021

SHA256
813189cbc6cbcb16e638e2d7ee2f4114b829daeabbe8f661eb4bf7e1c8633410

SHA512
dbe67795dd021c111439ca6065b3aaf92f773de57c5cf764bda8ab53cef84d6dfc3964026e3eba6b65ef2305e72432343dae5883717ed07954de167531169d58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1e93164be53b4d4aeac805d1051e80e

SHA1
a5d7bb7b416e6786314da3482649dd9f36c48978

SHA256
d881c91fac4a3c2c009b9a8a2e9f77709b5389dce6fa18d53291407ab6f25c58

SHA512
af4bc0fe5e2c013366307bee372ef1b7a069007fcc2728dfa466539c5b6e9f1fa7d1dfafba1c8b1b2025be99d562a3e3b4bd3701ea778e84ff49d1235866b892

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
534046ac36f8b680dcb2ef1493977847

SHA1
2718b7b70283f27fb781884b795c342c086b22a4

SHA256
13b856c613a8996d73811889eb09b69fa9fec3289414e9585c1535db533a3181

SHA512
d6e9f316f31fb0da8f59ed89cec92ddd17c0658420fb23763bbe2af352e52eff01fd32549ce8e9dcfb06a8a6a4250e065b8292eee6eb7fd9e1c4311f704c4eb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95a2d7ae5e7a6cd50e3d0a7fd587cfbf

SHA1
9369a3eef65136e3ebe7edde2f9a15f12b0aca3f

SHA256
c614fdfcece0cd0208a50d5dae9d370930a8a37e0af99032efa855a9d3c4fd02

SHA512
5aaa7e530642f3fcf69b9d5822438088704ee8dbdee3d8c088fd9d2f3dc9d86a10aeb8e66553edfeb0e3f27746fd0f4a7297c5b7d7ab24bbdfd189f579ac88a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d8b48cd7f8a7f934dbb411246aea508

SHA1
e2a8db7ada50946354ce9014b0f2924c94b45e26

SHA256
c810572500c6087f803893ae7ea6d7eb674d8c88150fb37572958260a8c2c675

SHA512
5e84fbca52538ab8c100b6956d2b1128db2b4224f162ee2ee869945e7b9ad0d694badec7e5279171ad2dc19b66fd088b582dd1acc957ccf036e6c7aa84052a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ef9213bcda16db2f45ff8e9cea8b1c9

SHA1
64f03c0213871d69901df675a5e10ccc55b7d1cc

SHA256
592808719dcacc84d56ee111008c38a59bab3da54d7eac65e3361031abf578e1

SHA512
88e60e571e6a6cb486e50f00b6fdbb86359f97bfa44835de51fabb4df754c2a550101d49904d913ca25fcdc2cd32690b53a1ba77f815e486e9c9957828d982c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5348bf4a76ffc0550c35e13818bd7f0f

SHA1
f3a017d7fddc0df89fec037b108d3acabd023439

SHA256
0f5c365fd80f6456ab4acd5b70f5faaee4b9a70b062fa29fa052e2481065b530

SHA512
d90933837f69e66ab0a0dc3cfcd999f3de68059319e746643fe209c28ce72e9526b7acae4dbbc5af57d2c12a939c1b7935101157af14cc3553fe1916e50cb636

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab173B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar176D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit