ec404dcd1803afcd25cdeccdcea7078204e2a63789c2e02eb721bdfa94b20c98

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hmKBg8jjXR.html
Size

10KB
MD5

b3b36dbf184e4e73bc1939036af7b3d3
SHA1

1606269a3caa2251e90b81faa688619745d22d94
SHA256

ec404dcd1803afcd25cdeccdcea7078204e2a63789c2e02eb721bdfa94b20c98
SHA512

88c3994a80a5cbced62f9d01092f34bbced9e7c6f4959158569465227b38521942bce45333b5c80a25f82439b1c239f875cf730fdb9b129e0684373271aa1ea1
SSDEEP

96:AKQf4iKKwOfRrcLHLYRe5mvtgCsXe5oE9Anx/IJ:BQAkRrcLnoVNanx/0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000aa02d1836f655757346a1ba7477a0280420ed776898938e79287ab1761ad18c9000000000e8000000002000020000000955574b21b605808dd3b5ad61c07aec574d5396b792096fe1ed44a685a69caa720000000cc5af4d6cb240f7d1b8dd7d3e8650d14e42feac299ca39362b332751e19573ed4000000073a66a0e9a2c70fefa6ed03ed2e253d94bcb60e5c328b2604b97d5f8974f32c86607d23fcb39c0f07f1c66cb124b6edcb4fd537d5554a5aa1220667018130b35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439193038"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000ebadc5eeb1df1bf12e6544dfc5714a9fdfd5433a7de79600bbbddb9f606d796a000000000e80000000020000200000001159210ace1030e9052cee4301b543f1723b10609effa1500f40847d465ee644900000002a64384a46b25e65b8bac6e2d3d4eee7eff89191a71e55b63163632238c89b0ffee964435cee0605408649778039361581ab4320107df25e9217e0728270b3433e12c05853c2d3cd879636d7af78100517a1ab4a1a27f4bab43c1a28330408a93211fb22835853ed1475fae31fadb759b40bae561a989658faf04eab1b0d92e250629cf40720dae25323eee6ff713f5a40000000c6ab88cbe8387864d4301829c4ef624316ca3770aaccd98c632085ddb7b171636def04d93424a0122f0b315376d7379f8b8058d2a94f68c2de5624bff9cc2bbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B5011391-AFA5-11EF-A8EF-7A9F8CACAEA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f87389b243db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2788	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2788	iexplore.exe
2788	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 2844	2788	iexplore.exe	31
PID 2788 wrote to memory of 2844	2788	iexplore.exe	31
PID 2788 wrote to memory of 2844	2788	iexplore.exe	31
PID 2788 wrote to memory of 2844	2788	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\hmKBg8jjXR.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2788 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5cc8cb8e27a47c2ee86429d914d70f

SHA1
0d549f631b0cdaeb49a177cdd751a5ce90808410

SHA256
29f627bb6e022a54cafc2d6d93236790dd69ae2cee7986f1c5da5935a74ee240

SHA512
5f28aca66da5c517efb415a0b4c65e2e1c85c86f7236730a6fffe6f981753646f0eac53ee2605ba48050531f2803be0d51cc2d1218e4e3935c6afa336fa3c0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97287466ef4f45dbd105096d0a26e5fc

SHA1
c3b4783f4632918a38bd760ff79f7acd44d5e50e

SHA256
4ac0a3f5fe9e2fc901ab9c30ba87ceeba556f2470e8f5d6cf188b3d0f366f258

SHA512
ffd991c3184911236d88caa3aa5d4f85d8cdc409e428cc47959e7e0819ee894f5d0dfe4631b877cf6600944d244f99cec69b1e1c2c38b894540208782cbedf33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b73efb4445e4f9c08462d69db328a7

SHA1
bac8f3dd7791e20e58e9b64ea1a96044f0a89d4c

SHA256
ef991ac3b11a16d2ee5eb12918493b94c9391ba3937f423df46691ab6909798c

SHA512
062b7bf6429c3c4b75013aedf7ea185d97ae10ebc1aea3f5efff9ff324abc62a2ee252aa47f7367e82536239fe7498737ccff63dec6a2c6ce1f0b337e0a48cfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae28248712c6589049a6e0fee681c295

SHA1
1b3ebe95e1024ddfbab4fa31aea08d70825983d4

SHA256
2a81d77c0241d24c4d76bfc7cb5ce003537b7c6fa7913c22fbf02bbbeb685a79

SHA512
2df34def3b7513055b3c7904a5af1d87315d8dd6f3ce24cc888abc9ed84560de8c6b95a7e00c80b18ff641a9d739c38dfbaa24b848f170620da7787861dbc077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd1a22091aabd447ffed14d150e06655

SHA1
a5acf6e6b70e09745eb7702b081fa820215c3a4e

SHA256
ca239b5b83a000853bb08708ddd19e43d0cf4142d75662c549b97117375346b0

SHA512
2fdd91a08cc1ae31d9507a8f2908c3f3ca564dcd0b5f41a6eabc66cc3fc0f0d078ab915eb722f8b57978fa7431a5f4903f12151de69c1f72934c8ccecbc3ab65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
711deeb857e366c12577e7ddc0e3fb24

SHA1
3b8871075efcc61ebb41fd182bff6fbad9063b29

SHA256
618e59769bd682b63b86311704e863908c9d899b4021468fa7bc9e4571908342

SHA512
29b0005877f2a7c72d786c1c1f7062966d117801ce95d7eabb21e4a5c54bfef7f5df07026a44147e249f66b2cb10a81ce7269bb7ce1b05ea64bce87888e21f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efbda3b0d90b08157e249ae0b6abe5bf

SHA1
c98a654b11a1398f369b1d5a0796fbb03c703a4f

SHA256
4190a83a404ac6fdf5e4c142901609e8c0dec2e83d8712cc1fa5a62be52bc744

SHA512
21eddc3244f76966ab16e6dc49dd8ca67416f874f9956ecc0d80f6c24ad081502960581e20b08da4785f01524f2fc88253fd5012a9754452f62fd868755a6085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
065bddd0e4912924085f81eb68329a67

SHA1
45163fb9cca73bcde7a2869ad9fd66e9d4fcfa0d

SHA256
cbb178301a622226898900d3e09a7e6bcfd77555112aa3d852314c305e9a35f1

SHA512
28192b657693747686aef04dbcc3f9521457402e0b46f88fb516bbc4e0bc8ef6adb92c05d13b3adbd1074f6f0c50b67068c77cd23c1968149d15bd9d32fde7ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
734060d51ecddad2dcb4e5f9a94ba574

SHA1
6095ae577f93a24fd9df2bcd6131cca400242393

SHA256
6af1e61bf141dd3832f4b69871b2e4329befce978f920fa4ce3f54f2a3fe8a60

SHA512
68803340fa457b95803a60403abc03a057b3a81eaac742395d4bd9a48a2f9704b65e2ec05b9c63697445c97cc62a818a8f29509f10d2d51f2fa85a10089e702f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D99.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DAB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit