8f21cced2f5e7dc90314aeac2bcf2348d0743622e54c1d929d74fe7594516aac

Analysis

max time kernel
135s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/01/2025, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jres/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000739f16af3e25d043ab3c9bd3bf8ee899000000000200000000001066000000010000200000001f6a3a8450f4a83bba77b76cecfc36f815faad9b88acbe5d44a964a6704572a6000000000e80000000020000200000004fffb613f8bf90b245ed438342087c9d75009dcc33b80634f53a9f876b662c3a20000000065e0725c64e0ca49f462535fc0ad6e6ea4173369c7b30d4039becff02b0955e4000000055935ddc38696dc5b35a24c549395b3017b89e022e735f911fa3b971684152fbcb2eb8675901f4256d179a7cff027f46afe8dda64bdc65615a16791b1eb742de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6B05451-D2F2-11EF-8B05-6E295C7D81A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50571a9bff66db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000739f16af3e25d043ab3c9bd3bf8ee899000000000200000000001066000000010000200000002c8f6c56785b1a54b35e6f251feb7d244b1a0a9b0f060159df152c833f771690000000000e8000000002000020000000843339c0335255041279c554e32082b53e272ca2583b035d862d98104cdd7c9d9000000006d0498490a4d2610a0799d06dba14abc5cdeb9360841804d39b7ea6e205d2483baef37c5845acf3d3a30cc411fb7eaa259713e6384cf39419162527df6a7294a4c9bd958dfe1be7ce75d5189d62cb3b435bf428694af0be3c403af86478d65b144d579d5cf034da325a54ee7c1983d01b07eef5a716aa46bafa4a4434e263070bae5e9e5bcc225fed0cfb719940c64c40000000bd6a0fe2c3feae7e73684a5fd141ce78f28ddeb78ff653be122cb7591edbd8eb4d765a726cf8a97b38b6e87a48a5ca8110e384700601ef9e1650dc458b87025a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443074432"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2876	2112	iexplore.exe	28
PID 2112 wrote to memory of 2876	2112	iexplore.exe	28
PID 2112 wrote to memory of 2876	2112	iexplore.exe	28
PID 2112 wrote to memory of 2876	2112	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\jres\Welcome.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f8e6719603dd0dcd22c81d68f2f42c3

SHA1
53b2d43da3261427ae798fb35b47cc3d6b672290

SHA256
033620415126b52ab16af8c40b02fe157d4ba557ec3de1bd1c11c81a68a3c153

SHA512
d14dc378e899326ac9943f7e9b33c096f99614aac68bb3a7bf89929ea4c81b513b5be0669aba7c0ebde2a96240d1602841e4b0a399e2e198b65fdece8785b1ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca5c506b7eb8988acb3ddc9f9b69dbe

SHA1
08c4ddaa9496a8dc47ceb55065017f48ba724166

SHA256
6bbe102cd2a27457a481a58e0be8fc619731d45c9ca354948c6f515e5930fde6

SHA512
8f8d83b7ab7ca2b680755037a2cc8d4ab8836e2b502b3f6d4c1113eb1e08852838b3fbd08dde97a1cca787e07eb912a06e4eb05edbf74d26dfed48b970de72dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
143317469292a99dbe5020c10d496d8a

SHA1
8cbf6036dc5e5cae3097b4110fa07311f80bafd2

SHA256
633ad882fe78a5d7f0dcc50b3e7c104103bbeba6e33903c169b62f9793f2fbd2

SHA512
b75b008821f902acdea261b143df9e707bc57bd2947ccef6ed83e3b6fc97668a1a055370e6a15326f36a77530a2a20f32f4baf22df762408ca2ef171e1d4b1cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38ce0738b00cd441b22abc79eedadf3

SHA1
b017536f39f1d55b18eb7b4c6686bf7a9b201533

SHA256
9e3a6c16d56df7967ae0652e1ad7bc4b85f7eb08ce79851fce3b7f36a9f325b3

SHA512
2a83f70be9986d26c114dd194cc22a78531b46f80f6e1de44f17ecba03ef83351573987b70b9726879b815c395fd3f7b3d9390be41b46fae169dd4589ae96895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b312cefe811c6189c445b3f16e95daf

SHA1
d523ee3d8f772481abf2fa4f432d220f2ef2c260

SHA256
3a2d14d1d296ec8ad64e638b6f6ef1e61719b9dadb4fffc8bc75811ec3853848

SHA512
70c192ecd0587108a38094d74ab879016567ca898469555defe684c9310d28704f9996e10cf1113e40734fcd6ddc098c32f5fe07adfa3aafe3c2564e455ddffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49274beaa8e1b5999913c7c840919d92

SHA1
234305c617dfe49bcee2ff8cf74c97693f87c60f

SHA256
6e49e459ec396f81d6214bc53de3e26209d8f389a1440326c603ff1cff921b2a

SHA512
0a88efb9749e0fc4d0b08d449ddd09cbf3e5e8f6acdbeace6e26a6bc22455b69c94eefad3580ed5becc41f0ba4ef8181e833d50eb23c1875ab8e5f531404f0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f24aab3d4ddee52b187126e3566ffb67

SHA1
cc60157907d6c5ea82b7ce9b1cbc91795e9864f9

SHA256
f943712d2ebf422409fed9ab42724485e8a80a9ae97959424be18bba9dd6e279

SHA512
24792b0132de2d01abd397477be7e11191a35f20dd0cf92690a84e5b4ea544e7599092bff29ac779df403cede05dba520dc61e5d001da62611e198a851e4f87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2802b7d2c2fa7912b7eb7c281b4ce6c3

SHA1
60e4cb84572bfb4c8b8e8e0fd2dc853131f198be

SHA256
90a39d5e82984fad07b78c41d44e197c59f2834c0cf3742ed3bebe9c792db99b

SHA512
2703d80656fe48eecf8a987ff7d05733ccad974064f62e7379f5fd9518364d27c7ea7cb77deb3cd51d38b988f4d64169de21b0b02362ecc9a9ce9609dd28ecf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4ea713bfc5c7cc7308896f3d7647181

SHA1
782c748e8db2520ef1b7af4cd6caa8036a1bbcd2

SHA256
5eb8080817a49c91e2cfde4793d6e53f9fb2abb912b15570065d2a7516302d8a

SHA512
02907a73aa54e30e2db7c6380dd6a6a982a88a4ff26c7d348d40c7371229e70b9f37d9368aed9a2d5737ca66a8775f0294bba5c2a1f6077feb11e50cda1c3b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac30d82bad3750c1f66eb1069cf1b7dc

SHA1
74fbb7174d80af147f6f1a41dc1951e811fc3424

SHA256
af2fc44f1a9820cae3fe38be3cdaaf69b70b0869758ba4286b81734fcf8ed0d3

SHA512
ccde534c0501b93adf20dfd4a1c1f77871e64205424ff7a52271fd980f0bc1f1142718f7a8af109c813f129fbede29d89462fee1d93f1cfb985912b73b4a9f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b3b51e51478deb75f360a986a85f34

SHA1
02da24fb3d59f25306d28f7984e390df0bc769a7

SHA256
a91ded443ba416d38745df3de9b1f40d7d9a2ff1b6dc2208aa2a360b8f56a277

SHA512
32f04a5cb719b224c37c674df1c74b87eb8dbe2f0e682f848625aa06cae1c7ba81ffeced45061f89fb8508a8b9b58df41dcaf2f0e0988ac1978980f034fa753c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69bd90880da5beec22690e1c2588cfee

SHA1
ab13e1dd24f78e29fb20c961b08689d4236d73a5

SHA256
5ed2307a1a4e550b86d33b7d3697c0c8ae07de8f1df394e1e82ec20a3a7cb23d

SHA512
e00befbf813390bdf04e284cfab3b5552a78bd1039394e4d7836c30c47fa66ed4584feabfedcec4ed7f9eef8e56ee593b2506ebbbc9cfbcdb5982289dee95696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e57b24ea5a8c99fbfc6febad036aac7

SHA1
aeb639ea954a6346b84a2a4ce54085dfd188d534

SHA256
8f3ef93863daf7bf97326138d368637898959351b634170926974476f8bf664f

SHA512
4103549dbecd1992ea859c69a97307896c34079afb9ed359bd5c36e6420292a1786e27fc2036627a6ce5ac74d165a89273e2f25e0971b040bd87c9aaa17ecd91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98de9fde485413ee744299348ade7460

SHA1
fe53c4eb82ee226b5e573bb080df07ca6e141061

SHA256
9dbdf8c3be3e8ab84fc292fa7fbb0684da2fc06542455345fa8fff4a37fcec86

SHA512
31a05ba382ed0b8441384228ae9180a7a25232c5b12323d9b42d1f1fdb3bc0fd45001f2843add6a478d83c4f984c2e97acc9dd1c02ad39eb4b52317317830179

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b0af4a3ec04ba7694bac9ca50f212c9

SHA1
ed0c357b9def6a16aa411edc6c3e788c65afa88d

SHA256
c95c42d0f2c9bd784a6e929e62de675a499bb34bb6d18fcc9a672fd1569abc84

SHA512
d164bece4bb5653b811bcc09f2542381ac0b7800b1dc85987245b91a056192fb2e008a3f1e3dc348c1f561d2f8111aeade3a2fb858b5d4dbcaf75be6740466fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85ac38da4a23193c00e44caa3ee92f97

SHA1
92c8c39d40ade96ba380662ecf4ab9500f54d399

SHA256
f37b36978716af29c6e9c2232a39c9dd91f3e55ce43a4e2ec908819631becb95

SHA512
0ede04fd0acc7fece9a411df51302b6efe011f96c49d9a6ea9c6f0b91b3e243613a2cb94adc56895cdc66e6746093596ed457017838b52872fcc96ea6acd68c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD81.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE3F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit