12dfc8f612ae54b12b90c519373f76e615309d6877014d39ecabb3a061703d8f

Resubmissions

09/03/2025, 10:30

250309-mjy18azwh1 3

Analysis

max time kernel
30s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/03/2025, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Eaglercraft-1.12-main/index.html
Size

1KB
MD5

6240dd875f24fe43e5080887b9bfe78c
SHA1

1581e257e3d8bd82a558f2f84b8bf5834c8efcd0
SHA256

06a54a3ee26a118b00d5c970d4bb61434aae4db2a5a51dd73e8c3daeb09ac141
SHA512

bba52b6bcca022c1167c3597cbd3e79b2f070295aab207a033fbf45539dc5c8fbfc88968d08a47813f2d28299d55e4fb5fa28c5a18c56adf422c8a6d87064cc6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704c6b85df90db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0EDF051-FCD2-11EF-8C8D-7E918DD97D05} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f70e432442460c43bfe1f1934469364500000000020000000000106600000001000020000000ab99b5854f698a64ead6fc3e78e0ad356734c9fc7beca103fd1922ba4b53cd41000000000e800000000200002000000033665a6d80b3340ec618a843d7f8f038d28f1cd46c4be63df61030fc77447c9a200000002a48969a89721d98d5510a98018a2d561084aaf29dbc4ac54626ef2366811f8540000000c1c39aed41362dba120da7fded98d8dbf4532982066b59b932a31bd81727b5bac9e7cbd9f1fd702a840358f97b8b993c80418b7d3d93d86228ca76247e7bea25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f70e432442460c43bfe1f1934469364500000000020000000000106600000001000020000000ece9a9b0bd7dedeb658e5d7407d2e57b69f7121775472cbc06ab184b6feed7aa000000000e800000000200002000000062422c835adc73f03c9548f30a9c18fdc8542f193a0c69e336c9e7c27d6396e89000000020a32c3df35ca0e4edfc5da5b9aa429e27cfdea5124b9815c4199a2b352352431cdba65c9170b228519d030097e2851dff2797414ae15fe967fd9739cf48159a9cc7906659b98cec908213ccd5bb53aa9a30aa54c43cb1d8a4b9f210daaf9c0484d248bf4ea72c94391741b3fe803785e6c7fde9fa048d4d2292254b41304697429414ff02efda0edebcd2b0dfde469340000000457613855579baf555854ccfdc3cf9eb4e77a34f198fa9d7d03607171947bfc139b3a8123defa15c5419a0019b071f902e451a6ca163a98ecc64c0af04723be6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3016	2276	iexplore.exe	31
PID 2276 wrote to memory of 3016	2276	iexplore.exe	31
PID 2276 wrote to memory of 3016	2276	iexplore.exe	31
PID 2276 wrote to memory of 3016	2276	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Eaglercraft-1.12-main\index.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4feeb4b7f367e1d91d5f4dd24aea7d21

SHA1
88768d48362b96643b078fb1b5f8f60a4fa0dabd

SHA256
5f3d9cfbda184a1c2e433f3d94f6a35727308cbcf51f201a5c1099fa2890af91

SHA512
a638993ce80c7437f95e6f4f9a232ed9a4a468d5a3c7dbf268fa847c55198937d7f47100ffc8ef2938d2c5c0b5459896facb579c3f36f43f636211facce82eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d6b9ea83b4d10ec1657b407c33b4e834

SHA1
a34ca618e81f1351db1a02d5753f32f24b7b9e94

SHA256
585495e2fe9a4195c74f805ac2a9db8914db7b5fb6b7c435768057038456161a

SHA512
aeefc6dc229e0c902f26512306c085a45181fcf7fcd81259bcdb2e010ab28778e6c8ca6da1f3087b2290af80e512e79b5d8e69ac27f9b5813f0917954f0082fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3739f6b9470627270bd4fa3ba4f884ab

SHA1
e9b1a846fc3c29e60a5c8fa01c515948158e469d

SHA256
c1a72b1f61b82daf2259d163afc3ee190006d642d0b3f8decbaebc705ee3b76e

SHA512
13c6b8025486b66bb4c9a1be1eabf3e1557e4c798777a311113e3978f8aef5611b5f54ec001e83fd46e60172183eae2e734d26b03a30a8e283d2a1116b272d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c280a52ce8732590974f158aa067c35

SHA1
7716dd4fd93fb30efd6e1e55393bc62b8c2eb3a9

SHA256
bcafe408dd63019d353835e458e17417e0e930bb62e36606f0b9519684f17e0c

SHA512
5345dc46f27434cb10f1ff6693e939cd7d847f091e470b160f7d2bca6e793b5cc2a7580fc5a272834c03f97ce864c913460945c1e5550562bf652f67d5428c05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
58c2447456b360c40111888f935d46f7

SHA1
939543b9ef6277cdaf23dd52271ce6ee55f86b4d

SHA256
d0e51a4b20a65aae6463413e937e6aabf78039039859aab55d0daf58c26d20a1

SHA512
282a41b1ad304a8b1be47a4129b97b958a5978b68f57ab66dfdbd763e18369bd42220f1bbc25b70330d95fd1223ea1a2a047dc27eaa9881412f3ff9a186c3976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ecaa0321d37db36eadbfe8fdcef52da

SHA1
e4f7ead352349a96c612f63200ffc8129aa5a2c9

SHA256
e0afe89218c7058bdc5a4e9660a147cc7104c8aaeb81133a4593d6aec36d1006

SHA512
f6cb99f26f0799515d46e3a202e61a56a827d45512d56473d0584edea29b38937fbc59700a465ed0722486fbb0e26c663946e955de947dec6fd46cbaff47b496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
568f0ebd7de32b581c574e9ae2b0c984

SHA1
f9298f75f40edb1cefa10692f5882848eead24a2

SHA256
80d70277e8b4c77c4a53c55b9914400545f547c8bee3fd3e854b4005ed5a6b4b

SHA512
89c25ec6144ac93d3c0457cf2039d54aa1ed5f0e75ab2e50d4055bfceb01da5d5cb2289bfa117965476433cc2019250e5c6bd23ca550f0e777978a3abfca6701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4859df01f5fbdadce7492e97787f6e13

SHA1
69e593dc6c49bd124da0f66600e857fe5b9b3631

SHA256
95fd69c447e5f87498a90d6bdcea708afa5171fe551795758a5a7901631e68de

SHA512
20835f106fa3ed19c2b6165d4cd97c159783a64c0d8544dcc922f97542cf72c5f1bbae825d31f172659ad9ec79106a368e77b0f670ce028d02be4128b3b110f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad6ac8ce9337ee85fcbb550c03f89229

SHA1
56f99ae29b03e057ffeb73e7df551e7f3d938e95

SHA256
12018266e2e368e569ebf37f93694b8bd1dd6c13ceef3f4481f8a5d3c7932d60

SHA512
fee6b4a836049f3eec1b2c5ab878613cea7bea6a8abcbf8ca82a84d30c66cb14ca55b900cd36dc9f83252930200b9bb74458c6679a4c3e306286906009401305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab570.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar632.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit