71ed6fd674e384ddc915e47f5eac03ae4c21157b591c4af85880426be3c5d227

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/12/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

popup.html
Size

1KB
MD5

4934237abb4bad0c689eb75319c96c1b
SHA1

82bd7c64f2512d3bb4d5abb055f151e232c63e15
SHA256

f96fe92ce12364ffa2770f9dcce9478d30aee0e23e7a65bd4435b8933a49b4e4
SHA512

1b80e49b725d53f68bfd71cbe1ac5ae72c4f9147ac3ba8e09a0a05dfdd30d2823df40c6e82b94c3f078ecd7efe4f128d14a72d995d1c0563179fc00788723e9d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001ed0953a6c385742b3490f2d4590e86c00000000020000000000106600000001000020000000b797ff310f5d817ed09da7fee7441f54ce78943412a9e5fb92a26ca512d842cc000000000e8000000002000020000000211f0f66662dea9e1fd5f87ad0eccd984463e89760d98321023037d525362093200000003ff384b59d11447792d0acde1f0a28ebb17857bd6dc12cd55785549243e3c3e240000000de55d52a0388200f2895899183a980ec6bc2934b45847ad092b385a1c9d21f412213d1abb69c880860ac612510b983b681e7aebb5750806376ad801e551db768	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D09A4791-B129-11EF-BDD1-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001ed0953a6c385742b3490f2d4590e86c0000000002000000000010660000000100002000000075ec8bd74c038296d80a3e6ed4343cd204cd5332a3ac080844f0117a078fd5f4000000000e8000000002000020000000c1656a82d01f1e5229e0a6c8a8034b758569e11be47411a760b4cd8130a294a490000000b5634e8ed141e53740a256c11beade8a7276049bb8ac543ff9378c82a4a6ec4f2f836be2268c276fc498f2c3d726210f4b9bea7d4b6aa80b607b459ebe10a0e2bb0cf440e323f11e3454351ef4e2ee618c8dd8746665c971bd8cc9e782ca818607f89362772d8f5cc8d9affa3be196a1b47a44dcb90742a8b33a5c07312863d6b56bdb966f7ece6215b445e8bada8543400000003f5c2a36d5028d93a742a96e3150cf5cfd233fdfe2b35c8bd5ce6dbe875a4b86811f45daa5497d99a9c3109fc8a38475cc370bfe33d694b5ba9016f29757b317	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01da3a63645db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439359730"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2492	iexplore.exe
2492	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2212	2492	iexplore.exe	31
PID 2492 wrote to memory of 2212	2492	iexplore.exe	31
PID 2492 wrote to memory of 2212	2492	iexplore.exe	31
PID 2492 wrote to memory of 2212	2492	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\popup.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cdb27ec4c44b6858a18cb8dc2e1390dc

SHA1
8f85c0e3434742a0e7d0b8976ae6cf36dc54703b

SHA256
412df8480ab8ff81eac51d927668f6f1b195675d840c0d37644302e23e0cb716

SHA512
e2f1758e0d24a57e4158463e62bdaab6fd00b4e68506b674583c657c44e1d99eb326460119fdaaf5cd4f9508166dbb0021ab1d855071990f54578a64b610d7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cd5d2f5dfc840d944179ff1266525be

SHA1
3503edbd21a959b27749d6bd8677d70499c8d7a6

SHA256
23d00320093fdfa86e709ccad3de93d0b309f4315c7aca75bba7c6e5f0b8c37c

SHA512
310631c56eba1e6e38fcd94bdda0b32221e198a96e8a57c23ca476259114132ee02b2bbf4ba9d25fd9dd915f0aab26797c5aaa48cdfb4c4ae16b3eb4bfea8bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a18053530db3c267d000edae7dccc0e

SHA1
65485de11fce15752dc35994255872226590e6e4

SHA256
0dd37d26fe4cef98c098234241263d4feacc340f4455ce8ad928375717073e88

SHA512
5a94f05eee531ac5c805cd7ac56c1bd2aa131363545d12d49c56e34928969d46b759dbcbf30e18a3b2026ef43e6361c56ddcce967ed761a73e145e56bfdfdab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03ddcea578c1205ebf63206fa52e04a7

SHA1
ee444e9a41165542c4720316931b006c2592afc3

SHA256
b7a596b40cdc350d248206385a521ea242d6671842613dee55fa30b0325d493a

SHA512
f163e8dda00affdc2632d6d3c9135cd1944ec980970164a1a37bcee7428cc4a20cc79135978ed4a2fcc4ba11fcbcae0121499fa460ac3b02dd9b06daa0ddf37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d057a023bd68baf9c15be83e4e7af09

SHA1
3b6da85988b8862ed5a3e43fd2308fddc563818f

SHA256
543c142c0d214df3d0c0000c374e1edbd622b6ac7b32bbcc1650d33afc3dfd16

SHA512
21699413033999f4e9f7a2f86542660088c2eac24b1bbcfc6a717d4ad9b8e3291a0b9a2036a0414388df5da4cecf11211c35cb3a5f7b1ed0bd4465cc93f85f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b22cf433992139c80d672df1fd9304f

SHA1
32d99f832fb63e851b14436337226665bc609995

SHA256
209f8c96a5f246f7774921819c29b82526a5b31b7cf395d105314bfe20b746f5

SHA512
7376e9203218682e1ad5f6842d1d4ed8cb75e433a8d2f667fd8d8653d411a6242b317a3864bcfd7e5cae3d89e5794480cefe78596a8aeb12f2c7fee22ad733b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
117040394c8a01c2f941d60a41e7b152

SHA1
972ca17931c127cebdc8c5e490b50c4de1851ad0

SHA256
47dd006b9bfae5757b1688a5344d1d0a1b6846d361269d32edfd8bc0629783cb

SHA512
2e644000ca42493a2ecca639f1ca75f26639ad432b886e8e17021a33238778c8dd8c235281c900cde3b837b019554ff2c34e0979207b74628dbb83b99504d90f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f0d8e41066028ac3dc687fcf6e750c1

SHA1
dcfe2c22d286f2f7b6f9989776bcb1ca722d6fab

SHA256
a4b517b1a0a27a488ca0c44d175d3c3b9a04fa820ce7f6aeacf8ef51a8b01606

SHA512
33a35dd19412e21fc42b61a8a10b7dbfc94747581356d9595ee57861b1ce6714fe99555b361edb950342b1efd70df2af7c774a2601f488581ca68212dae4041d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b9be8784dbab226dfbdb75711550b4

SHA1
613c137f4697c702a3e6900747cd1a8fd2c7b705

SHA256
78b23d6d1e4382bd37c8413a4230a2367906f04af06ecb6344741eb967e8c172

SHA512
8a48a9cf80c6dd5b55d5036ba50212636301d38ea41a0de0534925b810d192efda8cfdfa8588e551a105573199f1630e9a8cbc554197c9fb0baf5311a77dde57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
603386f00b1e09cf97a034955105e12d

SHA1
339e67304e0913808495c09d5d07bf4ce5c09d30

SHA256
3ace2bd61023615cf79bf15374b77705bb59c936d9edb94fd03ed7bc3b41ab88

SHA512
dbb1c884ba2f5c898d925cf768fe53c97fe1395b0c5d98d54f4bb2fb10248822aedd43dfa295b1223cfbe41aa0f8451f83d641e7d61f7b5500cd437889746f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd148eebcfda820648e7872bacfda90

SHA1
1670e8ebd4c8ea985ba19fd67262dfe142c657bc

SHA256
52ddf6444777e3d65e9c905db1af70e28509821ee4d13dbea60af4c296942d1e

SHA512
735d204ef6541871b83c873d133066dc746a4bc4d404615bcb89b47a93780e4c7d8186263bc6f55c3c20d61a083a87b8017c1118867cb228f63b3f7446c4b5b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92f613255ed01acec5c4a397212fc9e7

SHA1
69f590bd0611b0163d0d72db29939e31d5a7351e

SHA256
1274433674a2c0858f99327e470c04148ad12dcbcbedd5215a507b916304e2ff

SHA512
ed7e072c5df3950bdd592c277c303f07672517bc03b7fa7ddc24f9d2255dce5363a4773aa9c3d0bddc8f6fddce6c498bd1727d8991d613a1ea82443345a13d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa4d0029448b6875b8aaece408c93e37

SHA1
da332193a99cd652d080542d9d21194050c29a0a

SHA256
92bff04895f5c7a7b042d1841af91ea5132f2d359ba233a474d85d3f6cfbcbbc

SHA512
32a12f9c27a83e11045bcb1bd487e0d23de61206b55b796a8c1bf37346e36993a31e9f00e41ba2f1a6f268a4c22a97a78011c343d7bc902d44e11a6653ea5eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e59105751c1a66f0c3dcce0eafce704

SHA1
1572fddf2ca807805f7e1a9441a6dab78d5da1f3

SHA256
0d20afbc4231d010839ef1daa3ba9264f89df7e495a63d93c69142ffc6b500af

SHA512
3b5a266ec86a6750be0bdc64a3c093bc948fdf379deb58a7aace580b3db307a2a7b2a45b84d9e8a3974a5783637346182793e702c962a1102a4b4c4c6bcce673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3744c0422d120a11ce52897ac2135e38

SHA1
e2e5c53613e4c5024fd031fdc83e01bd18d5b0b8

SHA256
861bf315b1ec33a435a4031054d02c22862c73b29c9d72e6d11657e90673adab

SHA512
4c49656650ff2e8a3da43ec2daf8f8a681465f6ece7035e33492666222f502c6a77d1cafb101e2c8e5dd456054add32f7b5f8479ed8b16612678a618dfccae51

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA22.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA54.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit