165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8

Analysis

max time kernel
298s
max time network
88s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
17/04/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
monoxide/x64/.rsrc/MANIFEST/1.xml
Size 392B
Sample260417-qagblaex2r
SHA256 165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8
MD5 b8e76ddb52d0eb41e972599ff3ca431b
SHA1 fc12d7ad112ddabfcd8f82f290d84e637a4d62f8
SHA512 739cb69dec197879f4c7af76af86273a170d7834495ca9d35825f64f35290e6625eab67f404b7353edb340c2187f62976cb42ceb9a0c119deaee81a2143ffade
TLSH
T162E0C0C1C1E8E719673001856837C52C9A769357109F64ECB4EC9BBFAB1A642C4C30F2
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1D36ED16-3A5E-11F1-A1E5-661C1F56467C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "482593010"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b6d305893fdeca41a7c8b5ae1ec72caa00000000020000000000106600000001000020000000e490386b9dc02b681aebc5e9bf5f2faa1400004b42caa32a8fc8f5fd9838d6df000000000e80000000020000200000003e4924df0c77821521f5e7b4ae492013910d8a1f589471a0a478897b15cf125820000000729a943fc491a5f3a7050155c7573c0b105112309fcc1da55b0c1182a33977db400000004d0ce9ce0a2c590f93c3c80daf98415e98f68ded55fbe9f9c49d7464e41ec9a8f7fabb8e87dd5a8dec9844dc88bd5ca4d7339e1813f8437c46532fdd6502eb0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b6d305893fdeca41a7c8b5ae1ec72caa00000000020000000000106600000001000020000000fc35b30800e39ad3c230e92063512a6820fb355ebe8e8a929dd9a1cf798570e1000000000e800000000200002000000050b0489b6c6ab835ed305d0d0e1f15493886533b7ea6f7cbe41c3e04ef0de57f2000000040b3ffeaa1b2bb333557c56a0832a9601aa2069105dbd6185898995274fab45440000000b15d5e61d823e104b2fa7d241ca8cfa0516d5e5b01f23124d955ef7847e7dc29f0387413fd18f07c96dd21a34ca839f835b04c96fd1fd72593825ab8defb32c6	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809fb2f26acedc01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70e9b4f26acedc01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4740	iexplore.exe
4740	iexplore.exe
4352	IEXPLORE.EXE
4352	IEXPLORE.EXE
4352	IEXPLORE.EXE
4352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4740	3552	MSOXMLED.EXE	83
PID 4740 wrote to memory of 4352	4740	iexplore.exe	85

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\monoxide\x64\.rsrc\MANIFEST\1.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\monoxide\x64\.rsrc\MANIFEST\1.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4740 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3552-0-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-3-0x00007FFDA358D000-0x00007FFDA358E000-memory.dmp

Download

memory/3552-4-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-5-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-2-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-1-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-7-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-6-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-8-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-10-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-11-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-9-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-15-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-16-0x00007FFDA34F0000-0x00007FFDA36E8000-memory.dmp

Download

memory/3552-13-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-12-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

memory/3552-14-0x00007FFD63570000-0x00007FFD63580000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads