Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
milanuncios/block.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
milanuncios/block.ps1
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
milanuncios/index.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
milanuncios/index.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
milanuncios/sdear/logo.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target milanuncios/sdear/logo.svg
- Size 12KB
- Sample260528-pea5psex2r
- SHA256 4ee16b88a5c68ee5cb0a5cbed15d9f4b4bda9ea66c269e5729f075d8c7c32a82
- MD5 2676833a05be4053b7510a0dcc4bc8e4
- SHA1 9385087bb62a1220361e1f26fe54e951d8a1bd4b
- SHA512 7582c855af26f1439ba397f2e9ac016a17aeb27da5f969fec3859ca1554fe69b6adf5944ec3912aa5c12b28aa2c8f91ad0faae413964829b84fd3162d638ae6c
- SSDEEP 192:hp5bV1nXo6147kMbgN0Tprq2+StJGTprq2+StJCyxlLkRg1p+ZKPzAOIMlVfDe7C:hXbVloG47kz0VrmSLGFrmSL1bpLPKO
- TLSH T1FE429E384360D3F99DD6DAFD9F6294A4908EE0DEC0E7C7828366CA6051E38C9F24D4D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256219" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2422420574" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "486735425" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2415235487" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31256219" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006d7097aeedc01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BB22C19B-5A8E-11F1-9F3C-761C4632812C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908e179ee9d21446978e85b516b39ee800000000020000000000106600000001000020000000fba706ba79b97b1ccca3f5fe4515a3e751feb3f0fb4a12457a838537cfb2da46000000000e8000000002000020000000e89c6b1da3f0f021fcb74e2a397ddf1a32206a1d1a05e4a9490a14bab079c175200000006b4457ac39ad7979b00419d458e5eb48ecb92e5f3dc9cdd985015e8ef1353556400000005ccca93920ee4efcf6261dcd40aa5dabdaf72e174ed7099ca80b631de6737152243f42e568423583ba3da26ea536ce3f36c9dc52b06ae9f50b7708799aaf33de iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000908e179ee9d21446978e85b516b39ee8000000000200000000001066000000010000200000007be5482ae856bca2e6b9530971a1e0afc47253d38ef029016f685c22b4649297000000000e80000000020000200000003fc9018a36cc536c0518afc69400a0a116df79e0a5ae8bf8427b32a811bad668200000009802c2b074dccf8a8b086b3d88de95e418139aaa9431e25e683336714e067ea74000000012c19f1d34b7bc09639466b04b35e0a784f10f2261f65683ce08dfceb4ce660f1aa0ec122df79ffa06eeb77e5fdbdeb8cdb332f08ed989de606a98ab5e2fc26a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dacf097aeedc01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2568 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2568 iexplore.exe 2568 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2900 2568 iexplore.exe 88
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\milanuncios\sdear\logo.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 4d3e14cc3ba0b5ef8d4d3021e03cc79a5804bbc100e0be2a2acb2a311350d9d5
- MD5 48ddc4c7b7ffc263de0bcef0b6ffc0ed
- SHA1 7a4b01e224f5106912f4904f5d890b6e70c4c4e0
- SHA512 1f1b91ef105183f61b4b3fae655261764222a109b3eb2b8ed2cb91d06e9646582e2cc0ef7364bf30392eafbadfd0f9de77f4cd39d104ec0c6c208faa0f79c7d2
- TLSH T1EBF0D423623ED8D5BA0050CC59E46B357071F07D108424C53324A9C104296B69F1F136
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 db912f2dc9520a3d5bf74101cbbfd57037262d6f20eaeea97226511cc3705d74
- MD5 391b667bed2c7bb4fd68fe10ce21c7cd
- SHA1 b31b067dc2f76a9dd470453e292e9c93d69c148a
- SHA512 cd956a0baddb92eca630506af84b841429635494f34d4517bf52eb202782055768b364cca46a655731be315126ea629c5a3390d61737343f9d7d709fb4747d72
- TLSH T138E0C03426F6011FE5E8D0354BE9B436956AF1220539E2B629C45B04B702A00AC13E29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1G6LDOHX\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH