Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
30bg/images/adobe_logo_black.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
30bg/images/adobe_logo_black.svg
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
30bg/images/sharepoint-portals.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
30bg/images/sharepoint-portals.svg
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
Behavioral task
behavioral5
Sample
30bg/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
30bg/index.js
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 30bg/images/sharepoint-portals.svg
- Size 66KB
- Sample260705-alrnpsft5v
- SHA256 543637ae1cbb45ed2347b53dd13d5edcf973382b63e063e76cf4343ce91c20a5
- MD5 250ecd1251e08c952d624476ff1c39db
- SHA1 367f882bc5fdb29a928b9b3fcffda3e16f74e664
- SHA512 73cf5b406a87b25db519f9d1dd27a0bd2ee5ab53af43dbd495129d30b72ae99cb785edac616291ef835c2b1fc10719f848e7ae75cb84c946d8f618f52d1f1e6e
- SSDEEP 768:13Cx6wLe8O8KjIpBaRRivkF7ikfqzCGhrd1vmmjcGFncv/b2PsVgnnXyQCctrQr/:pb8KHFukfqB1vgz2iYniqtrQrqfrU5D
- TLSH T16363BC22230DB7AFAA49469A9A3504D570DBDCD7D130B1C0B7BB3437E94E8D16C6C3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000c91483e2615e2b1688d709599022a825ce48ef4b726756820188c046e087c5da000000000e800000000200002000000038cb02810fe817dce3d3678a21048f991c3fe290e1c3e473a16428ede6d88ab320000000b1c51da719a6a7007ccee8911997297340a6e2e5eedccfae7eea13be3b9732ee40000000b41981ef17fbd20ca15b113689e33fe36f770506f677db4854db500c5b96a94cd534574cb803cfa703fbcecc137657f5f0a4ff5b3c4617dee50cc712db94537c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3786698237" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7047ad431c0cdd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "489975684" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31263763" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31263763" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504cb4431c0cdd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015ec7194f8c8944e8e3c279917e59d0e00000000020000000000106600000001000020000000232ccd2a72dcb8ef978a434ff5db933b28e8808a479e49d576a1018e4808fc7b000000000e80000000020000200000002b8dda0edd02cfff9c3add8f350a10bea7308bd5f8710ffcd3d7893ac02a74df2000000042b096c037e9519ade3f6880d30c165c447ff94cce850f82ab8a4610fcf2326d4000000076ae9c5eb6d8e34bf59db2ffd7f186941109d787c1baf2fc08b86de96b4b9152adaa9a9fc25a8d61953a48cb8cb952baa58c10e4ee3671f2ed4c7b790a622519 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3929510644" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0C981180-7807-11F1-B05C-FE415EB581C1} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4624 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4624 iexplore.exe 4624 iexplore.exe 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4808 4624 iexplore.exe 88
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30bg\images\sharepoint-portals.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4808
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 bccee836752b73a514690cb4b52c11768f215c71c4befd2bec61ebe40b82426a
- MD5 519507dccc4fc9f28521ed0d97bd005d
- SHA1 2d0737e06e11154be088a5027bc2984ec41def34
- SHA512 898d8ff0d0a3c36ffd3d5eabf067441e8e98414e42724cce36131f6fdc122c742307b352e917de4438c34c56466301ff370cfe01d67e7f65cf5afe67574f5948
- TLSH T19DF0544144FFECC8194295CC70D8C77B3013607710554157E0780AE04D86B9739A3055
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 42fb2c161964a017193a03a9b9f7a64b8a2862439f50993d18d198e5e9baab14
- MD5 99e82a014a3f3b8a3d3b55d9587307c1
- SHA1 37c54879681ccdeef523afc6f4f57ec10afa0cbe
- SHA512 093cb4eed0a9fb003ee656a9c7b9e921114f31bcfff94a5c98b76130895844ed8386d120a15dee2a2eb5022aaef71768c3a5d971c9dbc1a4eda143e8e4671285
- TLSH T1F3E07D2415FA421FF1F5E4354BD9B53584AEF1225529A2F424D49F08B702A409D03F39
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GI7SXTIE\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH