Resubmissions
01/07/2026, 04:29
260701-e4gnnsgt2t401/07/2026, 04:28
260701-e3p9eses9n401/07/2026, 04:26
260701-e2mf5sgs7y4Analysis
- user interaction
yes - max time kernel
298s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
02B8423CA3500E26C2C74937F117905B_ثوابت___الجهاد_ليس_معلقًا_بأشخاص_-_منت.mht
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
300 seconds
General
- Target 02B8423CA3500E26C2C74937F117905B_ثوابت___الجهاد_ليس_معلقًا_بأشخاص_-_منت.mht
- Size 983KB
- Sample260701-e2mf5sgs7y
- SHA256 2848a6852c34f3c16c1525b35b3365fd85fd581b4388f3efad9666aaf316fe72
- MD5 02b8423ca3500e26c2c74937f117905b
- SHA1 155559be3aca162a4e0de70cd26b3f1f76a87e94
- SHA512 018b0ea46d6f7633ab3eb19001341c29c2504346c04afc025f179e89c4d8606bcb9bfbe4dca39b1f89d5e80b83f063bd982e1e170ac33952891087c016664b3f
- SSDEEP 384:6K4AABAk6GqzQ8hzNIQ8Yk+MLUMzYKa/GmCwzs:ToakXCxhj8YktTkGJwz
- TLSH T1B825B0D427710AF2FF0C25788EE75355D322D3639D93EB9381103408749B6C2CEAAD2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30c63f451a09dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f00000000020000000000106600000001000020000000f6b347b703e508ac6c54f9a1ffa08657179026fcbd7df54efa4f81de7a239321000000000e8000000002000020000000c4dca909c0db50eeef15de1af48d31b446737018cfa3cc7a99eae3bdb3419c8e2000000055b4d383985e0242fd3847a2ce8be296422f4d74ee833165ed96b05894cfd462400000002f7e081b16d472137954e463760c9e9ddb17c5875ff633c9285343914aa1bbf9532f4cb3efc0a48b62485c81f212d34a239f424926206e3bccd9f39be2662ceb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3821361770" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0E76F3C9-7505-11F1-92B0-EEE306B5526A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000049a593bfc1a93b4c90d42fa23be0011f000000000200000000001066000000010000200000006c8104683602dfbc40836a5bdfb3039a8f2db4ea894c534d66b9672bc7e76904000000000e80000000020000200000009e5ea1683cb93dc7234298545c6eff29d121ce51240dfbd50ae680038a1666632000000072419ffc8842fbcef32a8dd067a5e8e05253ba1012adbf7ef9e4df3e8362231b400000000c9367285091fb7ec7faeb12fc5ea983a306ca692634ee8dd7dd6f5319c3197e645c2181c445df76f4e3daa946e8d781d390d546d8d408a3e7319bf99f9a3ae2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31262993" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3958361966" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303742451a09dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31262993" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4300 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4300 iexplore.exe 4300 iexplore.exe 4876 IEXPLORE.EXE 4876 IEXPLORE.EXE 4876 IEXPLORE.EXE 4876 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4300 wrote to memory of 4876 4300 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02B8423CA3500E26C2C74937F117905B_ثوابت___الجهاد_ليس_معلقًا_بأشخاص_-_منت.mht1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4300 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4876
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 a7128a8a809fe2a38888c584b2e97bb2ef36cc87a8c859727ef6e8e9e5da28c0
- MD5 431f01c2938cdeb42dddf1a29af194e1
- SHA1 25cbd9556322ab2d01b0dbb76a43da2a1337a906
- SHA512 b35ac8d2039714e0bbdef1b4c2f7acee31d7144b59707b081c1d5430ab4fb321239ae67297338e37a94ea5b737e6d5d0ab0eccffb6fd34b844752b2f3128a8cf
- TLSH T13DF0D4D39CB9EC23795214EC13D84BB43420643684810193722C85DFC061BBBBE1F034
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 2bb21fe69da0a63e0afd0dcbfe1f3fb65801e5d8ffe71030d7b40c4dd3dbd6fb
- MD5 f41741b7611a2089b1cd2bcbf14ece70
- SHA1 0681119f165716f6d377c981dbc0df21fe7f61fd
- SHA512 343a3bf2e6a0054b0756b1b83bfd5e201eac5160b199994f69427a87e95fca247bef985b9a694133dd68c4552b3dfc98a695069f82e45cfdb3623d7c2e128bd2
- TLSH T1E1E0C03811FA415EF5F4E074C7F4B52A459BF0261029E2B42EC46B04B7069809C13A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\~DF6154AA0BD7185D4C.TMP
- Size 16KB
- SHA256 5319fa0119e7eb926f96599b08a54c0a6a5301f29d78165c9b77f190df6552bb
- MD5 2e9fb5e2b45f64e66d8ecd6c73a877bc
- SHA1 9040434031b96a6b40066c78472304d691438e1f
- SHA512 9cc99ca4b3271239de09b014a589876e17323ee05eaf6f8cd6c309c63b47882d3fe3a4d672bbf4fe7086ce186d9d3ff08af1687a7871e6f1a86fdd4bb7256772
- SSDEEP 3:trgQU6yjQ3RsyjQ3PVtodilclllv/nt+lybltll1lRslkhlEkllZngsyjQ3argQP:trVUYUoGUFAlkxxDq6Y1
- TLSH T157724C23A2D07625C593B13E615D816117FB6B8D52523B19F526911F18027C19BB8A41
- MD5 SHA1 SHA512 SSDEEP TLSH