1824be1799f0c32c14c5fcb3c5d34c98b9fb4d2b867067b8ddc3d129783812fe

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/ninite22.html
Size

277B
MD5

d8243ccef58efc84a689a703e9e28ea0
SHA1

82ea4b52e378f4efaa0084b00d676ffa6bbc2236
SHA256

d772f666c8c2870b534f593f68820b2524e78460ef67417572dab81e0d23c4d1
SHA512

ccdfa72d1e71984f6e531a3f6c099be8d2e6620a2db1a98f326ec0ccf169e1f759e0d1198a2a0e238b19ff42325503ab5481498080a61d59d24dddab07c46764

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f2ad785859e0c48bc39fdee908bd4c900000000020000000000106600000001000020000000170fe8fad6ab3cc8a19223c139a347fb3d589c0727943e41aa2ce40d68f5339f000000000e8000000002000020000000c76d1044721d79509e6bccfda9be16bb2d13d676f7e803ad9add7694ff67fd6220000000fbc50f55b4bb1ecbc6e1d2146ea615cc482ec4f5df17075113510f83d5f4d1cb400000008446b9037a590a8d156e0815007514c211816ea2c04a845ccc772cfe764c401f4d26005420f27a833cdda8815da9823b6b3f23f13987f7afa7e35310e489649d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "446774329"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{469F5EF1-F499-11EF-9816-E6BB832D1259} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008f2ad785859e0c48bc39fdee908bd4c9000000000200000000001066000000010000200000001d44a3f539daa145f949b2ee37533a937782fac1faf7553858148bc5e4a6df09000000000e8000000002000020000000804bfee843d5b8d18bb0706e4bb2a24b344fbe01016150cb5403f555e73ceae490000000151af37b2a69fcc4619bb14e5fe7930556095b9b21b60c14285eb8cca16a1294904eb60d68dfb70f65d64ad965840af35c135f98364cb229906d31658bdb5f93990b607ace3d45f88fc6be59970fd1717d8f2e68167c2e33016faf0e82ff08bfa07c89baea6649d2901e3cdbd642103d653b98505102016a9f50af3c39f17354aaed33efb478f5abfb4c2f5ed83e5b37400000008ee9190f3088d7b5a1964e254f5459f9437746493bdcb2390bc1a7f147fca171b64c3150f5c6500a87b5f80e6ce55d5be6c810f54ec00767323e1db841e57685	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d013091ba688db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1416	2508	iexplore.exe	30
PID 2508 wrote to memory of 1416	2508	iexplore.exe	30
PID 2508 wrote to memory of 1416	2508	iexplore.exe	30
PID 2508 wrote to memory of 1416	2508	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\quarantine\ninite22.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d29a70f13cbc98c2fbc5265faa6d8452

SHA1
675f7be44bed52e978536ff40ae4dba79d461579

SHA256
6b7283e00986c2245c84db9f37a5fc07bc8ec153e92623d3d22bf384981faefe

SHA512
acf0f97f06d5768d06c27aacd10f065e89b98e03619afe329f222e2cc93e9403c4fa868dcf99fe3942ac2599fc1cc6a4de2da9e04031828e7186790bd087dc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
008fb14948d895fe06161b41f3dd40dc

SHA1
236e9088245f966d1d3b8d61d1ef8a53f40c2ede

SHA256
07fe9ebfce837d96db6315c684395d686e017037d68148757475bd2dc8841da2

SHA512
3d6a9ab9d0b5acaee193b7afe25fe4603da1d95d2e9a7c9ff543d6021e9d6aee03ce387bc3b3e9c113fe6d9527dafe11aaeb3f4fdff124a3fb504aab2e3dc75e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1de47cfd09be9baa5255339c943651eb

SHA1
f62b3ca5dcd0516e052f557a3a87244ca4a39126

SHA256
8a027b7d7596d97b2ebc42bf11d26189c0db3b6ad60b57ff890084952ada2152

SHA512
a5a5f7a4855a09e503fedccf42df2ad376317f19774863f20970da677a0f1d06aca5cd22e98ef076e6aad60923387275ab34cce3ecdfb7cdd62608710b17ba3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c7f6239fa10aff3cb4690759b0c79811

SHA1
a3116847b44fd00b0d6bd1dfe993622134665a90

SHA256
1d3ec3df0de9bf8305ff473f8afd7b8c744ea95d77ebc52d8b56bbf6e866d4af

SHA512
494957a7246973cce25e36d2c24da337bd4d1025a8d054ae615d1457c5f1aef1409f8f7ba54f76fb6fa7db9943bde196a70d8b8d114b1f6b0194868c2beeeed9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfbe20caf872b679aa4560331777f66e

SHA1
d0830b7ee39cacdc6ccef849f02b1a07f9d6ddad

SHA256
2b7ee6b48f8b092f734f9a1db2d0606e7637683cc705a66140d8264e775781f3

SHA512
5f63c33ba37507e58554f8d132b65296a73ca3a1135f16a4d811b1d0c286b9f113c7a2447f51e329a56381b01cb5317a12c8ba7f819e0fa5de949a90ae530ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d7c66ce8288f7018d32ceb11aef4aeb

SHA1
06af6298ae718a162803a3b514baa967b9dff1a8

SHA256
3ca65d048b15ff48ec5de6c4acff74645e0c6e02999cbf1177f794a3df30d140

SHA512
b31b710856650ea3a49131adf7c7bd74d0dc1c5ee72517b612e937a96701ac008a80897fa9ed9f9919216cbf1f39afe453ec6cf78d08c57ba0ae21ac2c47327d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3663fe71a47523fc22a053ed29fb060c

SHA1
fb63729809acfae3c3694b84c11b5fdbd5306913

SHA256
c4e1129a1b00ba265694ed9537f5ed0819adddc0d799aaeec9bbad88f66a4c8e

SHA512
24ff8ef001601ae26c55e490e0086502ac6c5a9d5c4bdb52a73a2629e7f62a4cbef04e2c408d094a3b916e8c17f421b51790f589b81ae0defca9f4d7d7cbaa24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad1c35eef418e53f8ed391d03774357

SHA1
2e84dd9f330173ac298dc10f270be2738f51f93c

SHA256
93f38530b5dbf78068b57034962ecbd11e2b42f27304353d804517ed064b0fe3

SHA512
e9221803f6cbd2315f74b6c63e85e0d7721d7e3cc27744e692c2f155abb4cee660d7a6a456ab9717fcf9db16969b34a3484bd7ba91ebeec2e1af8fa0f921a9df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c183dce1eec15e6cfe796b6e21b25d9a

SHA1
7d6715713a45e89a02b3f5cbaaa18e26f10bb9dd

SHA256
32e9951fa18f911b2ad8d36969e8e344c97717c99eb2a348da7a143bd991d8de

SHA512
defc18c67cc2c4446c45697526619d245dc9959ddca2abbc86ca9fbe6770e359b9b8b3c648e64ed008bf48d3def93c464f922281648286414dde6c00932a8af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6678198d3465a7bc78922226d64a9abc

SHA1
9da83be60ed28f534c6ab51157e535d7eb2f01c0

SHA256
3b8acd6fa66ff22a7e5b11fb35023c9ccf143e712ef76363625eb17bcb5a0c9e

SHA512
c795b5ae15df88d99c097f725249823344b41b94d19b5796b16fca8809e03e7d02cab246bdb90d8fe6805e4bab78f3e81ad484f4f804edd21ecd69f13f99efb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
844771f82e017e357a7f57a95a4436c3

SHA1
3143709c91ab3c580b47e29f7008daaad07a120c

SHA256
b1722b6a31dd41392a55233adeb8715a37faa7cb1087d438aa29d18836a22023

SHA512
76f5d716855b6689b7134a03254e51e45bdb89e7f4d3d4c7feb3a9a831511dfe94faa95540dc36dbbad7a0fac3803683c08615bcb4439b8065d62014f2c621e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c1d0471abc34cd8ec67d8819c9d5e98

SHA1
b26a6cdaa967d043f85a69f06974c9f7ed4da71a

SHA256
d4225411f14175930cad72048e14b38a87984a6ba6f06db52bbaf2b1bb4a1362

SHA512
d8c2d765c9eb4bd98e3cfed3d3e49e4be4ab753e04efbf2514928ef9f750387aeef19c8913dd55221e1539612e8a0580909331088bb8d8ba3da8ff3b0282e591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
851c490ac86d2782d929ef8be2907407

SHA1
53de2951d97b673733edcdd6110fee61c7bb4162

SHA256
49c5bdd64f79eb3881d16d70c78c56024046205ee8b9881fe1944c77b39f0ba2

SHA512
dfd9abc5fbffd1d63fc932673b74b7bc69c3e28d5cc587fa9a72560023fd2db558c9aa928158fd3ed0527a48e28c95766b2f3038fa5bf3ec799fdcbf09a6c0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
80421b23939e2bf9dd5a78f6dc08fc4f

SHA1
739488a553fe9c3c7fc6915625dcab5746f31762

SHA256
0ad318f3fb209c7aaeb5c3d7fc8c6944353f9eab78a5fc5c2f9415ce320ea4ec

SHA512
4bd192a72756815edec030a3d6759d0e3619f3bbe2d881f1d41ca848e61d03e732758ffa84251b8f30c2c67c713b535169a0938fe18915727b960d16f7c0b453

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e5540eda9b6908bc97f4b7c6a89904a

SHA1
97760dadf1151584873fcef670ebabdac0e2ff35

SHA256
4e5717e0b7d19ef6c2da10d28302178cfaa4e37aa70f662430be8e69a30e6368

SHA512
7d9c07f073837bdd9a12b4f5815043f5b4d46b407301edc53df80073d7033a1bd72c42530576315b196b67de92c0dc5de0f8b2085e7b607de36664b04c02a629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59a6bab55f00f57d1a9125ab1ce342e7

SHA1
c1a9177ca9f272d89d264381600b3bb3048fbecd

SHA256
536a8ca805679545689b8934ae10f0c1c28eac9a4246ce9d8fb46bd5d57ad2f3

SHA512
681b1e35651d87bbf03011a7c3729186f9e1858f92719e0375d9db21e768be3fc9f10b0de1069be0451fc0b2cae100f42880f68326eec495728714956bbdc83e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC6E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD12.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit