f3e008e85fc5164da2ddc2cc44ae62e86ef3cef28fd6be1102c5a2be7630f8a4

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hm.bat
Size

326B
MD5

c54484807f0886a7683570d5c513c847
SHA1

c0c6b9df60e4203b7ddb485dbb57b0cb70c41181
SHA256

f3e008e85fc5164da2ddc2cc44ae62e86ef3cef28fd6be1102c5a2be7630f8a4
SHA512

7adc0a21069b38200fc25625961d2d4dac9981f7477fd1c670d09cb67fc637fdc88c53e5948637ce1362b1d0b904c67f46c7ad90e312d298fbade15bafad5d32

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 60fa7ed5bb53db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E68C541-BFAF-11EF-854E-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "440956273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2736	2380	cmd.exe	32
PID 2380 wrote to memory of 2736	2380	cmd.exe	32
PID 2380 wrote to memory of 2736	2380	cmd.exe	32
PID 2736 wrote to memory of 2804	2736	iexplore.exe	33
PID 2736 wrote to memory of 2804	2736	iexplore.exe	33
PID 2736 wrote to memory of 2804	2736	iexplore.exe	33
PID 2736 wrote to memory of 2804	2736	iexplore.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\hm.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://download1590.mediafire.com/iq0dxe3c4smgaV2oq67_DMu3tXJgEGhMDpy3wDO4RFglMwn3Dlbqi4ei2b6cV9ZbK7tG--sOWoOilKfVUAzzoAajPYFM_CS9cidfX_jHSJoc9P-abLAGiGvn76I9ZYdYGS2E2pf1iUaY_IIfhiHb8peAZY9NP97FWfENnQtZPCh0/9pxuen6x78afsz9/thorium_AVX2_mini_installer.exe
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4c2e8c6d5a3633033c270fde15c48da9

SHA1
2fa8eac1cfb83504b05701cdaac490a35eaa689e

SHA256
2ed63af10ce8eb43806d54a739c9c0528e5d6972d490c928d3d3efe4831d7eac

SHA512
46de8dc8c3030e6f97a95e59dc02677ed789fb4c4028f6f79a9a6aad6c83fac75f41d0a7f034517a3541a1bb624b2dcbbd48456041fd9972e0694dd8b42fd1b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ec98def3b8f007ba37d2037118f1fb

SHA1
fa09ca894553ab71082adb8a37e2494fd8f9357d

SHA256
933cd28f058a8170f8cf1e0d03cab7403e97e85c34e465278dc121883f6be54f

SHA512
b5fe5eedfb34938cfde5eeefc5bab68f161615ef8efa0bcd4b6dde451aace8506b8c3e9a2ba61ff3b9149b17992e359005022d644bac9483cb72e3448a726090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566ee268fca68315a2cb655f40913e59

SHA1
39be5c3b1e048db0980164627fd86e305a7176bb

SHA256
b7eb8263fd8187d932300ecdd97171700d98184de35dddd5dc0e215005d27a37

SHA512
4a36e222f384707acde97d28bc1c6c0f2164bdda9d7a2470bf480f8fc0fa40f31c8af2b0781ac2890409aa622e761a97ed6b9a7a949dfb5c5dcd71d553f0562c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ed15097402b92c3c6c143776cf5f800

SHA1
2ec3fe61cdc8309ea5d5f9d2a067cd6e4ce2b579

SHA256
4b102ee19a6a05632724eac711ceff08aa983870b3d9d8a7468b569a902e05f0

SHA512
0019cfb21e6ceb30cba0663119d329cf43bfebddf5a36ee68ef200e6961bf4e16b966e7c105154b987364ef6e5165df551e4d0a5f346fcd0d3c4fd076bc6adc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e7563217554ac918b8963f42f46dd57

SHA1
db2645cd9cd772c04b87c5eb55b8432c272abf07

SHA256
90860cba263a1dd1e9df23d4c1ffa03e6674fd97eced9696d292cd6dc8c9528a

SHA512
4f547f059729a6f29827ae9ca91548a38f9bf1375655dba479243b8376147e12bd03c24d5db1338882ec89af5a3d504cc75b108d99da0a34159ab34c16868e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad1bfc97778ff52bc2e865279d59434d

SHA1
617dbdbdbe390b7c3d5a5b0c400b3628594cfb71

SHA256
8bb7f0be855c6356bb1f71236d6deea9cb994361dc3d3e59d6a8ef768440235b

SHA512
64f71993133c57b32b46e823609011a3d9176cc490e015b6e4b1ffa3ceb779b2990b402308e842b1b4f5e15f14ae01052d9675e043f0edb0147a6e7576e1f7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75fcf980f331f2d3bd3299f0a80e87c5

SHA1
7b28786ea9a85d75df8c3efbca74acb4d8acf15a

SHA256
a741392f524d07d731a9f7f474e1b1652d7047df2586ffca422d069f2242a6ef

SHA512
e7d044d8da220b5a20d1214c61c522dcb6ad9cd25da572b983231bc358899e0952e14571286d39d6059ce97b42ccde9f8e899187b99c7ee4978a54f95f7bba93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95e99a8529770079cdd1ad9d350e11f9

SHA1
70f1c0169235a0f91ba08dfd5d6669657a19b78e

SHA256
5ea3920a034f598b6d83cac33a27310f696ae2e63cc002a59b5875c20878cc28

SHA512
37fd4145510908c0601e8222c6880124c304bb7552e3f7c1ce105fea3ba7a5636ae7b5d7e68ed727401ca9f81237479761296336018e03ac3ed86b0cbb4ee5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ac53cbf29010f21985514e38d084eb

SHA1
4b3fe7a6e86bf6c3a5891904a4a7d1e5439cb200

SHA256
f5c0f6fc7bb622038e2e00ceb3ed70a0ed6bb5e1bf9f0418e076f2d38cc35f0a

SHA512
79e43c52edbe34803ea65e0f45dad11f75e84b9582527a7d5d83ea749d898b71f976022a60458cc978d1853954822fca4330f8da25983322e5c03a47db5c42ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68879b4dd9b9b56588bd11c058f4f05a

SHA1
932becf75d53ccb7471c81417e37384461ce1380

SHA256
aaf8840aaec34b473b61ff0b4cebeabfb28cfc0adfe7f85974fb97e98a7a382e

SHA512
7f98b83ca4845262fc97a11d983f231c2d6c2619ec431496878e7810b7f34b96ff35b3383fbdb23e652a3afdbebd84a0bef6c0997563c89de1da4d4a072395ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6edf144880bcef89abf6d1b0fc6a02b0

SHA1
d45b348662dba5d0d2b85da8915ffac7aa2d0bf1

SHA256
ee26863681699554ac257aaab505d13b649f4fdca52970bdc4108aba5d74375c

SHA512
49aaf45f061f4c3d5e78b4b67d179d8d5102eb8c93664b9fd7eee7da531c146f6daa22145f6b0cfab405f49feb05bba6abf29ff682cc565f0ae1876e80c5d429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ceff2a9356f5149ce119ce3b4b0e9b

SHA1
6bf86a218aaf73c1df17412d70140a414068bd27

SHA256
3b3e8b0487d1e28f410a129d7ca36b53fa06ee327c7b08ca2f6d11b6fa5d293a

SHA512
0085df0d44ddfe3d0759504668439ff0cbdaab7e2251e1b955075245fd7c0c35ee8eb2ea57c4ed1279fabd9ba8cb785f66b2c8f06f4b91bcdd6de68586ec4269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
603bec54c41f45cdec72ad494948f5af

SHA1
1014d2e1d4802e8e3aa0c0a35ec0306e76af439e

SHA256
3349d00d8d58c25858d2b39d61822c8eceb5d1a6b6cdfd7b0034688f95349030

SHA512
11f3339ff8d520bed9d716e882646105cbb91e844fb00aae013c2e5e6fb7a98f327c1bd9b2c9020b5edb44e0a106312b01ecb55f7e4cdd2c23ffb76010081634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6dcc02a067e66397cc6e8d40ca220a88

SHA1
f1d3d77c17c29fba0ada83f0302c43768223df6a

SHA256
99eb8be15fe4b97d9bff601c82082fe88dca285394b7cfbddee794418e3e5b88

SHA512
02cfd27e6866c351832a4c8fd32dbdccf64904c819484cae37c3351472029a746ca8da0bca3d01347765bdc77903f252a48aa2ed9fcc8a0a3fdddf76b78d7a34

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDEAE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB3E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads