1824be1799f0c32c14c5fcb3c5d34c98b9fb4d2b867067b8ddc3d129783812fe

Analysis

max time kernel
90s
max time network
137s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/imfsCjY.html
Size

162B
MD5

1b7c22a214949975556626d7217e9a39
SHA1

d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256

340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512

ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5a4498e0b12b844ac3fe9407cb9ea0a000000000200000000001066000000010000200000006549ac4f615653eb5bd2ea668e39acd2b112a711b481d7d90c468dcd4cb93e99000000000e8000000002000020000000a08f35846078cad7f4fad79193e44a55473e18d301b6a5527392e3fe862575399000000078c2ecea33c53551fdc72a97682b8f83ec10a845d19385e00f32602307d45b0139972872453c14e852cd0b58cc2cbbf65d8cd20b58b8b3a328c833048ff2a5ea14e9af33e29158eb495c965a78581d29e73f067c4932d02f5b84908b952bb1b56c50f43e071d5eac8704f32f8d4d03cede0de8a2f4af0485c649bd5e1ebf26dab0efdb6a184f6b1063772a62eb3535df400000001ef1b973d42ad7539e575f48dadf3a093df6cb5273468d6452677122445c1e8c5aa5a3d73c611404c446155cb8b9d4dc04268ac17a4258352085c3e48b3251fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5a4498e0b12b844ac3fe9407cb9ea0a000000000200000000001066000000010000200000001a3c81562a3439adb5d61fb5755d4f524ffafab4f0067567f69a270cd9c867b7000000000e8000000002000020000000d288f5f8f6f9ac796d7adea3afc3e68d2c9bf9d6061476150b9c3920c990371a2000000088d2d2c453dc7f67f0a12437eb296af618507c8619396f00b5b89a853ad7b10040000000697d9ebb5b757b6de70bc70ba6ad9a6d3b767eba3952f8190af92d09a421c4fa0374a54ed3dfbd24b0626de7ed9cc99586b7ee567c98c75e28525431756069f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446774342"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA026B1-F499-11EF-B66C-7E31667997D6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01d891fa688db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1268	iexplore.exe
1268	iexplore.exe
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE
2904	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2904	1268	iexplore.exe	29
PID 1268 wrote to memory of 2904	1268	iexplore.exe	29
PID 1268 wrote to memory of 2904	1268	iexplore.exe	29
PID 1268 wrote to memory of 2904	1268	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\quarantine\imfsCjY.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e25769df61590d65ab348d00070a76

SHA1
859a2ce2b0a1694558b2248fc169835a79167eec

SHA256
547f0746c5c6f42ad0d86b25130408382bd5d1a18bd3378453df7c2b06f559dd

SHA512
f3081050569a2b7270044386abd264a72d768717368eaaa17f51438070b95226f261a81bbeae72bfac8483018f37d50bede3eabbff4d40948ca01ef95bd7b4ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1d3d542813d5cc253767e10a54c94caf

SHA1
e8283157e5e63e37024d757efc44b214b9cd1ebf

SHA256
701225ede54aee2f53f8ca8ead03bddc027731eded8f822d23d4c8ddf7a8b1ce

SHA512
62208c1a56a0c53cfad45254809dc7dd462e4559e8596faf1e720391230ad6ad9ae9b237df102186206ec32d266592d05bc86dedc58249009063df502bb64626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7f67868e5f213626b0a2b4d1f291c7c4

SHA1
44d95bd4a417a4d3bb4a51214f186c79ce699497

SHA256
f135d08cfd6c09340cd191e831b56469bc3635d944163114c74e0320889d2ea5

SHA512
2274d05f0be146718515d110e746c562d8ba830b6d63464593d2decfc051d73c04f925d115a6db24c566720b5cf85e4c1bcda3048347ed13f54883e83c7e489e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ad19a336b8d7517d76611d12341253

SHA1
1c5e457d780e0851d6227cfc0f87d8754db15468

SHA256
3efe3c8db583c08adfb303934be9a506ea73b5bf516036c4b86b3d28bb944991

SHA512
627836bf8e61ae73b26657befc096b86be9a977a4407a47b06fca49e9578010a88550bba70aaca49e47c98dff4638a107bceda5bce5fdfd43a5d29d0d421b9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
252c7f06b51f7445e02ea235c5aa6320

SHA1
23b1706aed751de6a28a74a80a1a07f5f34a7476

SHA256
c97ee628b47bf8aba12cdee4757cb2488a4401b9967b08136a018f9c829ba1af

SHA512
a7dab346c88004c47bc9c447896ec018c5aa7c45caac2e602877ab12053234019cea00b188356618693eed94f8119e8aa40263ee9373dc669062426637b54c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c3066d4ee42ae6818586ac8e5fa73cb

SHA1
8c8d4019201a03e5f229c3d393925dc3b0d75982

SHA256
479ddbff1fc776e144cdc27324efd25ff145e0fe3bf810aa16bd9ff0d5da106b

SHA512
4a2faa3fd6598633885d5ceb399da96613bd24b67137097abb32f08e316992ffb0d66057000875129dce691561e44d40a48879d92198e3b3a0acae526c71fdc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a6b2dc49dda314745a1eb7386f1db948

SHA1
929510267096fbfffd9de695ddf7a8f306e18459

SHA256
11a402830ce22d5262014eb7d3b63bef4401a16a18d52c6f7b9b46cfaef3f025

SHA512
13eb1f477e64c0bfc00f09f403132373e42d8d68141dddf71f0ebd5bef4acc860b250a4c84c42e0e699549a8b2fd37790d9a5a991bad792ca4d06e229132b85d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74d6f818a8ee868b805c3150db7b202e

SHA1
c5680e4c1f0d15fc35a85f431f875348e00b9c42

SHA256
43bec25a2409e9e72d90210652e30f8bc5af87392e761f99e29612733eb83070

SHA512
468ec373b565ce5612ea6e4aecdba302966f0989a728177d2b8f05ef9e95b4bd645abe368524a9eead7fb618ed202440c9bdd272403e5a18776d7ed3ed9f2642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f0d56d17be620a29ae3d7a744c66db0

SHA1
98fe169ee27bf727b99f7460736f694cdeaec8ee

SHA256
3d0e83d8bb92245a2b8af9b8376a19fcf337aca14b6a0e8b3fec4093bbb8e10e

SHA512
11b352cf8ef2b6ddae4756c75c08a835e1970291856ae81670f530b361a88f281fa9e9c6a21cc208b0db7a3c8ab4461097fd7dbb336dcfc8a0e43ac95a024f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a51a7724ec10acce569195f13c2a6375

SHA1
f68fe782f27ca62727cc3b92ff738f67305173d7

SHA256
3d3842eb7cffe5b4ab15cd93d8ca7e2578a3e4e3473bbdac7f728bdc642b0dad

SHA512
aca36893d06b770f6447f65437a8e413a78194c893d9ee584d61a80594ab775ce8e202eb46029d96f302b7c6f9954c3fed5ab984912066fd5ca1ce6177575a79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3014a4db4441054a9f855084bc34749a

SHA1
8d4cb94f20efef927f464407e6946de934748aef

SHA256
2f9debc95fb56eb879ab98ddbc457bfc9c2dc79b533bf08dceb71c71e6ad5cfd

SHA512
ee898bc30a7f02af6a898d488974f6bf8da65639135ff7028fb86346abfd3fc0dc5ad712daedc4e9c2287a3f62b523b0ab0177db93e83beb4c80e01b1d136f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
618a7bc75348bd0822db78498308f443

SHA1
a5364c63caba42c96a35fbd07f6b1fd132b74954

SHA256
f2091af2c7fad71c5f318dd442634884ec7f04d23404018d61952960ad73fa67

SHA512
a13bff76daf6c7da90080587a2ce57ac373ec1515a8d79477b9e9dbc286bc038b114a123b83c42bed5529251099b3084267bdf59f324be5c3ec72c1de8136658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57fea08146178e608a209293ff1be0b4

SHA1
f0cbb7ec3528952f8c7f9bb9c8d3394d61f3b0ee

SHA256
bd73c4ff12884a0f4270a3b91b4b4dc310d9336e9ceb1ca71bb9c0a8372e86c0

SHA512
8cf055fcf6d984dc758fe6420b577b02cb540bd455e89e50f0bac24000ccceea177f1599e5acf88e85e40617c30305f7d737a206d065d4a3970822d17f792fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8BDE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D28.tmp

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D5B.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit