eb7b9932b43d60ccd5013a1cbf59c360952718b5d05a7d3560c7fbaea8df9369

Analysis

max time kernel
119s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-01-2025 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

id=746904.html
Size

51KB
MD5

9e3431c8c000efea0ef506a7aa4c0584
SHA1

b5feed54489358ad5f5aa4eade037299cca604ad
SHA256

eb7b9932b43d60ccd5013a1cbf59c360952718b5d05a7d3560c7fbaea8df9369
SHA512

375ec95e2f24f25d19357493ace2979c26c41bc97dd1d88773ebb862585b6af6429bf47340490580dc7b11f07c17094a530f31a54a69b5bdeb09d3febd9f0aed
SSDEEP

1536:2l+Md7yPdr0sO/TGRKC9IYkPwJ333DI5I5BuKtEL17kmLWoL:lCL1oi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{88EC9CC1-D692-11EF-BA44-CA806D3F5BF8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a80123a22309d48b9e50dc5280bc8e900000000020000000000106600000001000020000000dd82d7d30b5731988992c2ddf9232b275b6b9ec289ff41867931f7d01c4126b7000000000e8000000002000020000000042364ce95516a4b4641e9cd1a327ca7e2a3f966f4d25ab14f3805eaf57a4dea9000000054a8bea526dfa759201e7a4f89c218d0df8ac3c5ed2d463e95fe973cfaa8667113f104b4c2150246cac5324a306d5a639350ddc19fe7abfced40daa18265fee28fb76de7742f0b177db388b2fd15ad4e291449b5bcb3f9d77e85dd9b08a98c8c8208f820898311330322f181c9ea4f0eb127c29a28a47dc695a2468d8bd25a51a4ba75cb51b2208956d7228bbd0474dc40000000ad0b11047a0370ead653b801cfb2f043c086f6cfb317230dcce17c6507b874e3640fcf1eaa19885f3b01b96a6462ea6e95b5a264aa1d4e104e7ac71a00cf793d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a80123a22309d48b9e50dc5280bc8e900000000020000000000106600000001000020000000d71e9b2c1b1dc1b82169edd875731cb5ff76d3c3c40f24d629660a9d7b2aedae000000000e8000000002000020000000c70b72848fdab97a7b594ca65a6abc09e61d559c4c6174883ec65a1e3433766c2000000001ecaa57c5f5e4a073ab5f25bc05936c22c786d5fcd4739a2bfbf53ed211b998400000002c1b553ea2c4f6902e3a5c37a00b754e1aa6372a6c8d0f75bb080886bddcbd6852a1bc8d7b08987bf14cb1fbbf447b7c4247bac624e5e0c7dc5ad20637f151ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443472915"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06e9d6d9f6adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2340	2736	iexplore.exe	30
PID 2736 wrote to memory of 2340	2736	iexplore.exe	30
PID 2736 wrote to memory of 2340	2736	iexplore.exe	30
PID 2736 wrote to memory of 2340	2736	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\id=746904.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
89be125d23e0054a59bbc887f60bf482

SHA1
2c8009ba1efdddf11b6445e2efd7fddfb5d83379

SHA256
64c5cfbfb1f2a35fb2c79003ad6274325faa89e83f203cf4019bdb01c62dab03

SHA512
3f61ca1de84958fdad1b18b140e84e67213f3ffb722273a13a9f5ac2927937c0ddc9a8939eba0113ac5babe992a4d8ac795edb19266cf0d22188c187185dcf75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ddc14883850045298d6e3467d104b44

SHA1
0ad2e3d495d1c2217da1e6dc0c19e1ef026252c8

SHA256
2f22a33d0b4ff7a3b584a6ca77f492c611ec8aac4ebe02f50f3004e2a293cc9e

SHA512
bdd938bbf94d5f53f205cc1d45591bdc4453488b0a392b4447ffecc5233709d91f88b5a229af95a327f6aee9bcadcfe8ff4dd84c71e6307a9d1d7aebaa2ad59c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fbdb1e49df58487d00329d4b8689978

SHA1
25a7edb42506c6e60ec4fede4caae4d70b419a39

SHA256
e503564dd0d18dcfebd176eaf6d4a0ba1a8f0cb59b5ef5b39a37b4da2ab3995e

SHA512
d4939c59be108271501ee294fba665981e65b905ef0ccf93d5e23cf546e004ba729b0b10e4c982a2848a155134a0f576093d327822c76ce2e5f4ba65ef8b70c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a343771807a4bb23b48ffd58f7ba63aa

SHA1
a8821cd6711765df689febe59b04e0091fa74505

SHA256
01b90ceb5373d1daa6549d1f213af500d283a7441727457364380db5f27b98bc

SHA512
bf1dddcf4ee2bee06c7a63fb75e51536072b621b57878073925bfe9eace772ce7fb6c29ecc43ac752d93a4d73ef1870d104c846e195ad10fd98f2613571968c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40c3e367219365746a1fbbdf36bd0461

SHA1
5cc0557359a618f16a7d8ec02cfbc8b599f1f172

SHA256
7831011d5140f7079b74cffba1fb55927c9577c5d49c86229b56a49dba537dd5

SHA512
898e965a50ea22f587c421b59ff233b6224c04b327538487fd15ad1ddb65b1b9ae03fcc477692237675d5de24dd14dcc184b644ae9517c933254aff95f1ca029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca0bc14774b74c9a2c6742ec54a4f95b

SHA1
8cf8ca1ff65fc4a195dd7cd490e9c3010e01712c

SHA256
2a02986bc7693712928f2ab6bb88f7ebe31429b27dd034ad6e71eaa3c1112257

SHA512
39bcd3783166a2852d161745f65bd15887b88d9121444eacafaec802b16c1888c057ef0ec19727eabbea18194c65cc157f78a3be76ba3ba37917ce8deac2cc26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce263b3aa1bbe0396ad710dd49a23e8

SHA1
0279bae1072498481a62390bbd6d9f80935f9a2f

SHA256
25255f4cadcfa997dc71c0fcd8e7c7ef5a3512f2ad90ea5f514cced5d8e03ea2

SHA512
3c7947000c79eaa7c318614f9b99ce34c2b9e7ce210dab532a7ce0419dff5a8a28f23381e9dc209389a333a027351278c9e86ebcddad6650775530ae93ec52ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79da441336ea2c7ed6a0faf6318ce333

SHA1
6792e6b87dc888fc9c40219919b9ed5f699f97ae

SHA256
a73a09d536544c923ebcb3adb6d16214ba43df508eb850629bd95bf918df8564

SHA512
48a97ecc0915a473bda369792a84b38b0bc8503efa2ef066cd869c3fbe615caa86c8ac3a9dbdbf32e9dc3639bc89c5fb58abf5d6d601de848bc14e098d2bc591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d8d9f4e7e40171642ac435436dd97009

SHA1
261738f8c93dad0f26e7b19cf62fe854972ac292

SHA256
6ab6761ffde47851de9285ca6a20a4366d72b54678f29f11fa33a0a60a00464a

SHA512
b37b36366cf2310eca4fd3e1ed0f58fdf42909d2dcfad7be355bfc155ef610f4dede8c91cc6fb8c7b539e028c256c9a027189e1702bb2fcb369eb141b41ef126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\jquery-ui[1].js

Filesize
458KB

MD5
c811575fd210af968e09caa681917b9b

SHA1
0bf0ff43044448711b33453388c3a24d99e6cc9c

SHA256
d2f0522008bff05c6434e48ac8f11f7464331436a4d5d96a14a058a81a75c82e

SHA512
d2234d9e8dcc96bca55fafb83bb327f87c29ae8433fc296c48be3ef8c9a21a0a4305e14823e75416951eecd6221f56fbbb8c89d44b244a27be7b6bea310f2fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E35.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB12B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit