037289c207c8e229d728f247c2d7eb1459fb4413fcd4fe662f74c711169a1e08

Analysis

max time kernel
31s
max time network
24s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
20/03/2025, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

void/7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
Size

10KB
MD5

ff5e80953341f1cb01a5d31fffcad2c3
SHA1

cf2b440681ce3c658ff734517a16cc13afa7ede5
SHA256

7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a
SHA512

bfe9629f07e9755b2df63d632f7eca214c29fc3d701c77ccf4b1eaa7f9ec518af01d141065af38bd242223344c518b57dbf8c9c43d669a191bfdeb22703a9509
SSDEEP

192:PN2x2BvekROFASf+mhf7h6RyfVah9OLgmiMMpIFaHU2y92N:AxeJROFASthDERKgIAUn2N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0b4c162d499db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a0400000000020000000000106600000001000020000000048c5375cb8843cd74e7c975decb6cca4cd3dc9fd5e3c6f7f233890fba66d6a3000000000e80000000020000200000008b5551e3b14817f6e47824bbb94191b4382d94d9ad42df4d722a7f8de825b073900000003f7a0da3632a58c67a7d17f577b85649ab87c0f10309fdbff8b508bd3a72c56b6645c9c1e3e67def93c3aa0302b6f50ee30e646089969e2fac83fabc7f08742c5e2461ee2f88525fc2383daec492b189e3e9036cf485e6903c276e24baa788b228f5e445dc9f27729b77c5de14283bb8a30471be55d5f9966a48207923de125e77d9db6f1cc2738cf041aa8b60a5fbb240000000c3fb72d3ad6fcde96223f49bbdba8df608193505c0be9b4de1dbb76281ef51db7d2c81275922f9e137aa336e47fbf77f2661e9260c871f6b0ce03b4669de1904	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E11DEE1-05C7-11F0-AF87-DA66BD97457A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000596298383b88f045b768ac3737055a040000000002000000000010660000000100002000000022a396f1c8a4aa6f48726f71ea6151a1f54c3114c7ff9de2f79cb45485085f0f000000000e80000000020000200000006bc18b52d163372d9af7f50240a4ab0417ae4b53e1d80f2911f1ca4078af009120000000c2ccb0f62be9089671669212568a5f6eae2a266c123c6b9002c79fdc694cc0f94000000056377e4a16df064c61d708e23ff0515bd56bfc986b0c666a8353b6a693a51d2565ff028b129c919e1b2128b94ee3ceeaf4213272bf9c7d92ff6d556f8ba9f500	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
936	iexplore.exe
936	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1616	936	iexplore.exe	31
PID 936 wrote to memory of 1616	936	iexplore.exe	31
PID 936 wrote to memory of 1616	936	iexplore.exe	31
PID 936 wrote to memory of 1616	936	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\void\7dec88c2ec34b8483abc44e98ec843877cc5ae88e094c90d46bbabfafdf3749a.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:936 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc01bac5aa98326524be0b32e18b4728

SHA1
448888a7f409d37a10fb3eca900ddcfc63338aac

SHA256
cfe4e4b9b011551291e1c4bc6d8f8be354766a42fdb0478c58ac85ef405c6597

SHA512
ba7eedae1d7eaa40c205bd167d5924fc961b82b8aaaba2db3cb98db0da5c7473fc470608a072a98c0108552a9b9d3ae8b8c81cc838687c53560eec46df62e896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b56c972bd3e29ea1c8650a8539c0d202

SHA1
eea3988b29510ae7113aae833c25573d4b509b07

SHA256
10dd309441f1518d2fea7973de98410d978bb1c14113d54526db5efa000eae6f

SHA512
8c02fa81dab3e9ee3a536681ad04cf5bf7fd2bc1bdb4e58d56d704a10a9ca818604cd8fe5f06f6b3148731cfe55cf39895d208be807ad8505f899fa2e9b4bc08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177f04ae3bf53d7411e4322775b23285

SHA1
3f6eeef3ac5de97929a44d5168876d4c052211e3

SHA256
32f1c22b975a8df8922992217b42b0dcf1893c2de3d72271211f08fd49182b3b

SHA512
c9c4a908958954c206b4ca58f0d12ae367332bfb1e3d4488271c47925dc3fc39ed4bff57af17cef8df58dc35c14063e314ea46c87cdc25b1fcbcf8707ab95dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b2350c1a3aeb111ac146390a322378e

SHA1
e784314def4794a3d0c9dec299208fd341bebfcf

SHA256
4b82e674dddf82bfc795857dac343f62b12efee8a173405e78c8fda78bbbcd08

SHA512
789c482c65499f1be746fbf897c91bab821907f5c5470bc79e09559d099e061e985993b6ec30b03db02bfaf41be5691f6be7c112f385537d5314b32eb982d6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a23ed5661c5b861c7e81c29d4947248a

SHA1
1d9199862ad0a0153410cdd41edf9dcacc204afc

SHA256
347f70867ca031bf0d2e528cf4309b174972079b3537004ee8d0c8e1875f9ed3

SHA512
acfed8018dc70a2d0ebe86fe5dbbc05589146dea8ff3c000d4992eed15ad251a148e105b6dd163a343a14cd21cc39872e5ce3384a9752250f99a8f14e339b383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e502dbea0aa0c509176727a9e4590271

SHA1
21519e749b10706ab4ccc17cabbefc12980acdd1

SHA256
42bc56fcda7835b3bea050b92bb73274f3a23acf34f4f296c5264ae8592d6f00

SHA512
9b3cbe6299ed9c7d746260ee47bb7bea5c71a32c3f698b20b27777943ad84379e5ea76256fe14897682c291dfe25400d5ac45efc5832bffb0c5c380b00a36f15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42d2b285332d2e32ee16f9ecff702d02

SHA1
0fc436244cf88b0a76d3bf3ee7f7a4b926d24bbf

SHA256
e7d4b59fff6f80f31eb6dc48edd645b50a58fa20bbb488b0263f15c00096400b

SHA512
99ed240623d43b1aae466de7bd65e0a9f185a1cd201f21b88d46f1e169d55fd18ad00a43b98c8adbe6bb384e8e11a536a243e384b57e57e7f8c5432de8c66797

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2776a102ac361c0260d398a5ba1c642

SHA1
f7f70ea4da0c35131fecbb254ef098d9161b6973

SHA256
d4ba455c4ca04aae289e82c348a41b7044e776005a8fc295bd0dc67e7443e0e6

SHA512
8c661147820ca81d56d03ccad2407af51791639dca997c98397a5a89e2d8f913499ac91398fb669c1981f48ef28c59cf68f3d4502d2ef33c6eee385ff10cc49a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94040efbcfb9863f5c8e8f96cf3660cd

SHA1
04f3fe5383702d365288bccbd035424f140fe362

SHA256
9f8ff173e479fcbe9f7d335652406cd2eacab392caadb6f55aabcdb7083a21e4

SHA512
ae8a721c74900f7899d7c1316cf59be32e65f67d10c74f082644decbedba4e4997869ef6ba10b49a36318badd9075d8ddc3d274c6a10ea8759497d36134d2074

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1789.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar18E7.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit