037289c207c8e229d728f247c2d7eb1459fb4413fcd4fe662f74c711169a1e08

Analysis

max time kernel
31s
max time network
16s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
20/03/2025, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Size

10KB
MD5

ff5e80953341f1cb01a5d31fffcad2c3
SHA1

cf2b440681ce3c658ff734517a16cc13afa7ede5
SHA256

7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a
SHA512

bfe9629f07e9755b2df63d632f7eca214c29fc3d701c77ccf4b1eaa7f9ec518af01d141065af38bd242223344c518b57dbf8c9c43d669a191bfdeb22703a9509
SSDEEP

192:PN2x2BvekROFASf+mhf7h6RyfVah9OLgmiMMpIFaHU2y92N:AxeJROFASthDERKgIAUn2N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D1AFB11-05C7-11F0-B731-7AB1E9B3C7DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf484e1aca74c544bd3bba633feabfda00000000020000000000106600000001000020000000918b2859bb998dea8e72ff69999341d1bcedaa27df4bc2ced32db9a8804328bc000000000e8000000002000020000000afb62303551de82e62cdac4966e88d409b2fcf92c1b74dd51d4ceb7bb7706df4200000009ee9a21019e59c195ab041188528ff51fb03a22a3cd41d179fe2016a1431b97b400000002fcb40f10e3825c71ba4a386f680c100b69d4c84a2d713929f1cf6068c82231d15bef8e69b655c35e0c0c7fca3b7a811cb70b414ccd14a06bfa373e4e0691984	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bf484e1aca74c544bd3bba633feabfda00000000020000000000106600000001000020000000c9d8c149e1e4fdf732bab6883a9456d1094cccf9451977dc832f14aed67d2959000000000e8000000002000020000000e312c87f537c0f97c82b11a07d9bd64096ab174339ae5afcdde17bb970810fe89000000039040921dcc22a87f968b65a467213397961d5c01dd8ea809f7d8d7457631f597ae603c022c19eb29f2ab5f3370a4f4e59223ab99a896bd57efaa221f3a22f86de2e5896ccde00a716348c1f0b157597304e13b394c80c1454587970e4a6f61fdf4b94f79ec718cc5c994529459d4ed9e76bd6135aab8a58bd9a11e051f93cb9f2834fb02c3976bbe1729513a80f006c4000000047edbf0b2cb8fe96b50215407a0a07d8d9c5f9b37cd4507c2d96e74a7ccf4001d0c0689c39a027d34c01b8d3b5b82647dba78f0aaec8c4c17d4f90418459aee7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0279c21d499db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2128	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2128	iexplore.exe
2128	iexplore.exe
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE
1008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 1008	2128	iexplore.exe	30
PID 2128 wrote to memory of 1008	2128	iexplore.exe	30
PID 2128 wrote to memory of 1008	2128	iexplore.exe	30
PID 2128 wrote to memory of 1008	2128	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\void\7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8507b01dda74cc24a6ae1e1c3a01939e

SHA1
3625123a606c693b2b039568405885b08f891e80

SHA256
0a7ade2128e7b80ab7d104cf4928b3d71ff83809b12edfffa2211028e83f834b

SHA512
ed9acf7d41d2c103363dfe1ac112c7b93c628b507b1c21ab87e4deded669fc7048702d97ab7074565e7e1d9f96305014d0983d240df541e279c9fe88d38fc366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb0313ee8c7e4414177e6a43b2a6fd21

SHA1
1b6f9ba6cf299b94b4ee58bb1a7cb793cbdb722d

SHA256
278fc2c2080fe7a2c9bb975b160b7422c8c2f4de02d48107d002a5d0e31e4cb1

SHA512
762fd7e08424690d742eff9143a18a29868bc7cfb4f07292079a52de635d601ce83d9672036fd5bfa277065cdbd856167c056a32ea515e4c0cceb693600e8ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0071269f5541ae9b7f95db22c4374aae

SHA1
995408e831c221f18e26e56a2390cf6d7f6b898d

SHA256
f85c73b76d71170a617263f5d7268b8171947352a5a0eba9212845d8b11ae7d3

SHA512
c47254809a6aeae5c66b3ba89d14c3316d1123179a5b49af3cfddb40f646bcb4d3d3ebdfa4dfc65b3caf2c0c84d093a9ed41b8b391ef6052fe750680e9f1ccb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
676d6beae140cea575f24a0c2aa83341

SHA1
6e15fe20260fdffe9d43dfc467f408b1fbf35c96

SHA256
3066b601d8728de70fcf412d3f30c83160e7e5ffcb05d40a7a172dd0690c90e1

SHA512
af39cc61d408f1a2d62e74e2913e5ad40a607f702119691db5165cbbf7df057870031d437793a0819c423b25492222c08c580d54a76e176561226139fe47dd7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6ec6a6b54951aef4f93b1be88b220410

SHA1
34849e8c21e02c5f88299207d06b0d1d1ad279f8

SHA256
3145ac27fab2f42acd010ec3f78ccf9f4616ef4864c5c03fe3c40f857dc444f8

SHA512
41f41d93ebea9b959d8a8c450cc410e6c42c1bb5677f10fa15c4cfee0f2b62e10e9f856ffd6937be383d0af14a54906786ec94ee46043dbc237140e1cf978c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c890fbd2bd9ae5aef473541e1cacf7e9

SHA1
bfc4eb303d99803ca010fb8ff8d575bd851e85f1

SHA256
1cbd0ad36cf4f6f221cc76922e7b449a6b09edf477f0f4dfef009be855654305

SHA512
955086ae7706fe8b0a93bf6bd0eae5b090fdfb867eb39f7ca36fbc774f5d1a8e389ce3bf98d7d3cef1fabc637eaa815e1e9e74fa8e3bb7127bb780f53716de0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0768e2ddabd56cfcde5ba8e7cc40e1ef

SHA1
42c36c3eec339c48080827790b488b4c59ca0d12

SHA256
4aea1d7c2e085983c24085bf7811405df35c7f7fc9e288f3b9cf8c854a38961e

SHA512
038456ef2ea234b42d6ae1af933358ad81975554d763caa4646ecb198f47378779e9bd74d47e6eb88a0acc4da2976ab48a34c5934c14418caadd7b273d90af3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81144a7de756cb381bd338996bd359a7

SHA1
b1014b4dbd8072ac31a77b405d67ed8334291996

SHA256
d9c00d85740cc3777af4f78422b6e1f5a1129e3710ee4439d05b18cbb4651cce

SHA512
ae8bc8cb3f0708a0a3a759c239fa2411de357f98d8234f28b5dcd70b7bf076f992c929c8b03f79780b5e2909b065d4f8e8b04198579e9c95c10ed39cd4995b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4738.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit