6948630281f9a172165f11781c513dc43a3bec8412d71049b6db62594187da3b

Analysis

max time kernel
58s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
05/06/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DeadIsland-Win64-Shipping.xml
Size 139KB
Sample260605-kcfj7ady2p
SHA256 6948630281f9a172165f11781c513dc43a3bec8412d71049b6db62594187da3b
MD5 4be83fb309eaa380cc92f52fbf249027
SHA1 f90a61640ffe94856486ffe62a5f50cf322e9f0b
SHA512 521fbf9ae954cafe3fa540de3b5eb860c827c3761ca538b4873a7fa408aaa0a1142a55a4240f2f5e0c0e98fad4d47712a09ac2abb65612214d8a375e863826af
SSDEEP 768:IA8UBcJ+DXAUI17V4Ptfvx2FfTMUfVPpx0aoLVtY:HSJ+DXAU84FfAfYUfVxuaoLVK
TLSH
T1B4D30A53048A9C3FE1AF9618A54C190A9C38F20F23D2A59AB47DA1375FD7D8F5C8F690
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5136	iexplore.exe
4900	MSOXMLED.EXE

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "923172396"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31257797"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0c6837051c1504fbfb5d4d60075fc3000000000020000000000106600000001000020000000d18996203703f2b898c0d464047e9f54693f6377c4a1a145c4977f69b0955648000000000e800000000200002000000031bf5b7c05e3a38701fd456cd9a8b5748b07b4ae9f13c02d293aa6fc7d70229720000000e3aae1861e22e2d96bd0c7e8e7d6649e3d2b761672440d4e689411da35533f3040000000dd2d1faff33ee8fe02cdb00e553559d44570f7c3134df449b4aac4ec5ec831d198ed59457b4d4365d07bf98ebafe99e3a4e404cf0cfa9abc4292d1e08071588e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{623D8FD6-60B8-11F1-93B5-46CA1D11D955} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0c6837051c1504fbfb5d4d60075fc300000000002000000000010660000000100002000000007559fccf37e58854be5c9cccca815e08fc4f3d70bad61e474fcbc476aaca4a2000000000e80000000020000200000007ae2a43153a672d87e7368054a6af5a0f15ed16b570dc32d254fa2b47f0c24fb20000000a6cc5093fe0accdd391ae7a8ec843bc42d74831d74568754eed9c737bd4bde2c4000000060c25a5968516f72c5716db2f9242844890785a6842cf22efd340dee9755f8fb8f16ac7b9727d788225c3fa16443edcc1183d4893271d6a760c814df8e8d9a5e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05ffe99cdf4dc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08b059acdf4dc01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5136	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5136	iexplore.exe
5136	iexplore.exe
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE
392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 5136	4900	MSOXMLED.EXE	85
PID 5136 wrote to memory of 392	5136	iexplore.exe	87

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\DeadIsland-Win64-Shipping.xml"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\DeadIsland-Win64-Shipping.xml
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5136 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-2-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-3-0x00007FFCA2F8D000-0x00007FFCA2F8E000-memory.dmp

Download

memory/4900-1-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-0-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-5-0x00007FFCA2EF0000-0x00007FFCA30E8000-memory.dmp

Download

memory/4900-6-0x00007FFCA2EF0000-0x00007FFCA30E8000-memory.dmp

Download

memory/4900-4-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-7-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-9-0x00007FFCA2EF0000-0x00007FFCA30E8000-memory.dmp

Download

memory/4900-8-0x00007FFCA2EF0000-0x00007FFCA30E8000-memory.dmp

Download

memory/4900-13-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-12-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-11-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-10-0x00007FFC62F70000-0x00007FFC62F80000-memory.dmp

Download

memory/4900-14-0x00007FFCA2EF0000-0x00007FFCA30E8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads