b3bf563ca975578305761e8d8d3504d435f723c50c1eeac39201a7a4cae38c9f

Analysis

max time kernel
723s
max time network
727s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t4BWzC6A.html
Size

2KB
MD5

cd002c8ef5659d9dbb8f30f34836b2da
SHA1

3407f22d2861a6bc52e1965c351d15d30f7afe17
SHA256

b3bf563ca975578305761e8d8d3504d435f723c50c1eeac39201a7a4cae38c9f
SHA512

851d2aea7fddb15a3d9c20c290edcde01ff79ce7bebfd8ac6c207cafacbd9730df9f48ccdc3d7730cffbc6f692de8d5acab47212b9acd43340d5822c5f039429

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000251aafdda9e1b14a8ae513525567fabe0000000002000000000010660000000100002000000056aaf7b249e28f0ce707a54cdae2c7806b083a9658c645fc3b086fb3ccf3e667000000000e8000000002000020000000801fcc95739bd6a31b4ce2b2e020234d35d4fa32872ae8c504337a9c4a9c9b32200000000ee69e52fe7f3b74d2c8384109f3e3ff896e478acfec94a3b6a4b052d6a399aa40000000b4e12cf3fdf67580ab201661f41becb8df35071ba4941b9e384088c023fb2f0b2739e69abca5d4c993fae09566a81e2d9ee4910b3f7141190147cd72069db2df	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000251aafdda9e1b14a8ae513525567fabe00000000020000000000106600000001000020000000af7913a861b079df92b22ab920394445b4eae757f9b6dfc05b4bbb35c43e7b28000000000e8000000002000020000000e7c6acf68063c1e49b901b0bc61fb064bed89b2b0243ff69deff38ecef4e4e4b90000000d30bca908afd0aa81cce5167691b8d8eb80353209951327ede574ea6844162b6c7b5f99dc5e7ea2816c318bd52dd032d584721250d17689c6391716df01f2453ac026ddbf0ecb4c216348a3f85eff4353880995406682f9ea270875f94d4651c171c9b0262382db0ea6e4403439b2723ecb2dbddc03e88ceac279aa70d84f7e3b6b15212cca1db1cd146ec4c9d002de640000000197539c3a1fe41a8502d5ad183abf82c34f407fee80286e3f6f58dec2481e04c4a96db816bf89ef8249eb7f9952109db04c2af8a694ff2825c6d21676d6b0245	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "447457930"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4C26771-FAD0-11EF-BA45-72BC2935A1B8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90bbe7b9dd8edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2424	iexplore.exe
2424	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2072	2424	iexplore.exe	29
PID 2424 wrote to memory of 2072	2424	iexplore.exe	29
PID 2424 wrote to memory of 2072	2424	iexplore.exe	29
PID 2424 wrote to memory of 2072	2424	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\t4BWzC6A.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c56d4cd68d8d4f999ad97babd758d326

SHA1
c0a1d306b0adfc7cc27398ec221ab1489c2ee2cf

SHA256
f41c3bb1054cd04aeb373015b77085f9d4af15054c302ebf3136ed183f7a7ffe

SHA512
acdfcde9a1adbd9552bbc8b1047906cec1253c7e8dd3d4ce63e4004c325a60317bebcff49c34bfbb322b66107670b70b1a01939c72a8bfeffb4c909131c4b09d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4320f437a04c9edbbc80e7c99ea60576

SHA1
853f111ac7a41fa5b6d4fe3aaf2ce6cd8403a7f8

SHA256
c0daefac8ea26226ca4002255729d12b9586732e6d5567a571b532dbbc86a1a1

SHA512
4eab384820d2881c2ab7c691230ce48750564873c65ab75acadac3f545a0884a6b4281c8a05a22de1f6234c9771cfa0d174cc8b657248c12ec84840b8e0d7955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5479322d5f2391431d4025e2fabe2836

SHA1
23289fae8e335f45ce812d76c2e2ec8cef778ef3

SHA256
e14f1945d26360ead8f48d4942b96585a9f937aeb3afe50574d8081cd59aef47

SHA512
99f0f451782040a8da10d684f8e840fce955b9546fcd2836fe17e2e2c1e1146490abafc682faee418e91bba1770063614ed1495162e311c547e9ff17d69739fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
307f9ae8a1ca7bac017b5a711ccbb382

SHA1
03bd81c419252295e3d1d503dee7a0f20b277163

SHA256
b64401e8aa698bef1abf42992be927a6373d5efb24c710081d4626aa1a198e22

SHA512
afa60d8d9cd6749323fab44f6bbe674fbef7e43a2cdccb4ecbf3f5a54be36249efafc0f440661371cf18914b671d53d4dd574b118da10d00008051acc3d6dbb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba2cb47809fffead62cda370c0a803ed

SHA1
700ac1d6d06c4feaf23b6e393e2bc810b7bf400e

SHA256
c96f7cc384e9a015b67a1fe91f8a72585510d1b8b36cc119fbb63eaf9dc19305

SHA512
00659264bc55ee1e048baae70ec69cae6de7b36900f9cd22c4a927e7f6532a06292f4a64e01c7fdc1713cec72a798db287b82c0f9c483d46fff27948ef923f64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d195bc33b2ba9ccb72c2a10b777da8f

SHA1
364a296a355277751a4374d93f36eafa704d0ad2

SHA256
f4b0cf8bee6cde1a7a6c72623819c8a7d9889984f639b8387010882af80a8a58

SHA512
2a5d2adc5a3552a539b2ad9053511a97e5032f4e06707ca97ab507fccb5cf54d423a969d99e6f9b2c183082f427fb9a93c0034ed8ddbf4ac1b934bab173f0850

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da8cb7847886937aadf5396bcb3f5204

SHA1
eeb59819aaeef38e3c7739bdabbaaf37eef73881

SHA256
dcb5084982f65bf3c36970b1dcd4365c1267da625a3bae7c139cdf1f03a680b9

SHA512
2492d88e59388532ae1f16edc783b1ceb732c7d80f4cbf40f2b5287627550d658e0be93d9ec4f71f70dfa41e59809903ca7b8e64fabee801ed7df715cb8ebb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
46747a2d47ec5576095e3001fb2f9320

SHA1
3c444abfc982845116dace00d4b6f7acb060315a

SHA256
da3f4027e2e5be1d7d25a2e5b90dc8ac2f7ac6bd55e990bfce5a6bde99a37354

SHA512
4f3c561e4585521035e8cf69d36ef5bf42ccdacce84816baccff432e0097c046218f38c59b81c29635a52412db35ef5b55753d1cee5dd2c916cbc7f72ff82a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37b4a0370257ce8deb2a9f80e358e6ac

SHA1
42b2bdb4e88c52eb317f66798e9e246670dee4c8

SHA256
a826401c1ba00b95f7649a7543a4c0cd88b0edfbd37e5ff3ea7939d57fa848e7

SHA512
1b3def335cd9cbd29f0be36b13ed80dcb1f20506fcb71453cfe1f8548b288e5e56340434c8fa2bbedeb6ec95b1a794cd0ef299783f20bba7d13c6100149c1a1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df7dd8a900d31faa4d06bd0a48e585d6

SHA1
e5af044df1dd0dcd0599b63f8bb0737b563b0fd7

SHA256
d6e26c638f4e4a40a7791cf9e01c07e99822042ea61dfe3db5275b451dc2933b

SHA512
088f381e406cf2b26c3e718768303d446c2616f1bfae3ada2bd6df56ba64c0ed88ccb5b88a84cc8dc09c6ed59005c243b3ed8b927a53cbbc3dd5f3d42ea20f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ab66f46046b9753bfcdf0bbc5dd2dbd

SHA1
e0fca30c675310c3f712bccf14c26f211057301c

SHA256
36cc745f3b0e7a681689547d06e879cd8f9618d459f2e60b029c3a9b9a5126c8

SHA512
b2f68b98dfc64a5c677f76acfab228460930262ec559d5670153f178664031161e37cbd5389ad432092d1c4f9b79c7f6cac5430725697d60eb889b1e3a1ae8ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8eb5221e4ddc24695fad71210f8866fb

SHA1
a9bd68b39d19cf5e5f9ec8dc4b902e75df132fd3

SHA256
8de9956d8c11c9f2fb336c09560f76772bc9b3eefcf4fe80159e1c3ad8932c9c

SHA512
eb6a136e647746380c143ef21b1a34520f56665fe1e25d84f15cc8a4785e3062932e4bfcaf2f239e7cf1df7197b5cb54561bef608cc893de8649f19e5f5f845b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3bf54e74883d72071de4259305c410

SHA1
5addefb03896de29bb2833f60a4695760fd2d2c0

SHA256
55e3ddf9f6d2439da96089d8d2bf3c5e2892be978be6c46749876763698a5ce3

SHA512
7d1a2b239177bfa9e74213387b79c51b20e73953a72b363900da01cf0bfd4e0e3890ce5ceeefe0a21ac4ce07816c4022a94bf4b2f4a9576df5e14b9c2e0375be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f799ec7dd0c8949fcea5e472b5922c8c

SHA1
db141a0a57ec457b345fb1ee508224af1385a045

SHA256
d4541bc744172283e5c7401b58d2744d9333a9ea4db7c1c88604e295ad711efd

SHA512
256a4bb1a3a49d0444981ff403bf580dd064abe56a1a93bed7a2a7eead8f0036704d566d20260b12a2da28b14e7596f92c17115432d197fe50c37681203a2730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab978.tmp

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA09.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit