e0f41333a5d401ca7ff4f07b5272abae0e96f181d0f7176ea62d0caccbef938c

Analysis

max time kernel
149s
max time network
135s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

qs.html
Size

1KB
MD5

40d00fa24b9cc44fbf2d724842808473
SHA1

c0852aa2fb916c051652a8b2142ffb9d8c7ac87a
SHA256

35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035
SHA512

9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2F03921-E796-11EF-AF7A-C23FE47451C3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007adac86ab080d64f8305d3e04defd2ec00000000020000000000106600000001000020000000dd6d3a12dce2f9c29b76582c51fedff850158931ab2de4d8e60159ea64cf2a73000000000e80000000020000200000000dd5c3f727240c9393d4e2662d6f1a53f98f792b209b9aeb7b76d161b0f23d8f20000000f8b17011f028230df668f38084e3f1e9455533d69f049b2f33403dc7199f1262400000004b7748ee4d0dfd7189141debbab02a813efb6896adc1766447f045310663f12f01d4ad6839e2e50805a57ee2804ee78095b752a09f41efaf9f4b030a4901f371	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007adac86ab080d64f8305d3e04defd2ec0000000002000000000010660000000100002000000005c65ac16113ae3df9a09b9b5aabd0e77855e098a59ff3bb82110bcf42fd6b33000000000e80000000020000200000001710e0e01f4b6abbfca7a30b43752d4f50407f77303e62bb5a793fce37d4bbe690000000aa4a97c2d76ec2d2350c6315f9f7714390dbd28270fd56844300035175a190b0998654d584059bea7916ec626062f1a02ef6a6eacc485557bfcf443a92c2767f6b2477bcbeb637ec933273556d49a21375a30f7bba6121b87f5d23e2cb2ca1527f94e90f7b3dc8a8fee18e5835903f51e263f714bfc067e57473f284bc62fcec1f3ae5b79ebc3a45633bacc158d79e1d4000000002d92d0d95ee9f34f6992865416a816f39cf0500cdc3103473c21d69707986ed34e2892776a2d49206c406fa786a66844f97aee6806c7ba101a5a2a283e62a12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445343927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c8f5a7a37bdb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
432	iexplore.exe
432	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2440	432	iexplore.exe	29
PID 432 wrote to memory of 2440	432	iexplore.exe	29
PID 432 wrote to memory of 2440	432	iexplore.exe	29
PID 432 wrote to memory of 2440	432	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\qs.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
269ce267586335ad6c4d20d06da42a84

SHA1
7c9ceaa2251cfbc11b562552e56487a4bbb836ed

SHA256
94f3b690de77848c9a7c94a01e6246e578ad8f9a7080de1bd7f3f5a9801772b3

SHA512
cf4cd0519b865ada00e3d78b3dd6f994435cfefe5b2871fafece0867e8d362516c6aabe224a3cb284c42cc1f49b7c03ae0e41607b39fa377b4dc60419cfec275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6395907f791d5b9925a8be7cf6749cb

SHA1
f71ec7a6167eb5706eabf6f1f18177cc4644537d

SHA256
1ed8a3b984a28dbfb216d35e1481bb7db9bf5ebdab40d9e2690b8aeaebf0ece9

SHA512
6e1217068cd06490a561721122a556afeb8df8b7a0b6daf1ddff20122d6b363055d187c9ab01839158b1243f1dd2be277603ffa223434299fd56d86bf49b3b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325ecddbc26afed1eec221ef2318e0b7

SHA1
14db9ef0b14555f8b9eb04789b0dab1b54751899

SHA256
aba123268dfcbf27c12759423a671462fbea364d184fd818de11870eb8027fc3

SHA512
134e08a452ef29ee914af124c0ce3e690145a34aff5fd6eaab289c734c7e5a140acf01fd7998eb252c14c79861302d370c767154559e714ef7e5eb8ac049f594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bca4864d7c63e2c2df268942d821d177

SHA1
5cf5a77dfd681b193808ef68a24783738f4ee24f

SHA256
2096fb451774b8f5cf7950c34c8f072033b9c3ae9379a516d8c9ec3fafc5fe6a

SHA512
56268753b48aba943e9223ac738f5cb938253cc5d80f70b51f3c65ac72d0d22bfc5ec43ea7e6d7a2a612236ec46b91881dfd29c64b683b928778e6f1810df6ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c302a79e032f6f1b8ee56f0a556e9712

SHA1
788869e5b8cb7118798b1276ee8c32f31de97fcd

SHA256
da58208642e140e117e53dc6e301b39541373443224ac8b15f30e30e44f77b0c

SHA512
5cbd1427edd8083656b432f4d471d34fd7094470cf9c131dd4c7d32a725ae2a0eef66e46544ddc1618acf1da4e8fa0846b0588a89a02ab2a310c0f6acc170206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3836d1fef69a006e77539b671d97854

SHA1
510314f92238025c9dd1bf1b6905da0557cb99ba

SHA256
572a6b68a61cbc7822e58b99ef44933774c7defcd1931627043b6fc0c5867700

SHA512
2726709768e3f75305d2711bfafc9612bc1784a2e5f50ed584da60815f70872ffcd9312909319b3aeea130ea5219eb6fda74ff075189ead76e9e4eda11d5c7e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FE8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar527A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit