Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
arrow-light.svg
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target arrow-light.svg
- Size 886B
- Sample260721-w1pcsagm21
- SHA256 705ff3240de004523ff9d628b28aad705ad3f0ceb046312495265a4042c67570
- MD5 552eb2e04260fc0733e5633d15c6aeaa
- SHA1 0a9efcc3b0ebabb23a49a00061fd8200eded1613
- SHA512 16cd125a26b1604144d6a64f45d1064ff2a71da412cf61c829914e00c2e4aa275a172d0872a9533f79d5fc2d2be82a7dfe3fe5f12048c23af927a7cb35d571cf
- TLSH T1BA11ABE816FD4428E015C721E3F87546993830DB42C440E8B29D2A68BB290A20CBB2A8
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "479291617" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa501600000000020000000000106600000001000020000000344318cc1a3f4a6988f148d5fe0782e95202239b826970023817b1a518d9e360000000000e80000000020000200000006c00df1d910feb8f4ae9701526e258712562e231e73eff08ab906eb5a145ec0720000000b666e785106705bdc6ee788153c57c16c3e3a42aebf89035679bd5f58ecfce3040000000b32b76aac455b6f9ffdf5abbee50e316648a719256bf5048801e06a2c7e417ad3e277984a79833356473ec9866cff33f4d5a5e95d6098f7159386179fac854d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7015ad951c19dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4776E1F8-8531-11F1-B03F-6E95C79F7E05} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31267134" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "491423187" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "473510284" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31267134" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9ec78227512df4b9aa25cb090aa50160000000002000000000010660000000100002000000027ebdbf143b739cfe0f238abcfff38f0a5caa5fb7c04e93d3b20a60521bd184c000000000e80000000020000200000000756e9ebe11faddd24a3780d9fb325e2f7c7520f1f8a82b9a5868ec9863596b5200000001886caeeff21999e84efcb3f3ba0419538d0a2f6c63f2ffd89f9afceeef4dd1d40000000909f06d36674fafe95ee42e8a7390e50d63f25d3ee51ec8a72104bf3ec86aa6cb0b75006bda16970ca5f51b4a3ab7aaf50b59f780a115e0e5464e68d4d67ab37 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501ab4951c19dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3448 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3448 iexplore.exe 3448 iexplore.exe 4088 IEXPLORE.EXE 4088 IEXPLORE.EXE 4088 IEXPLORE.EXE 4088 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3448 wrote to memory of 4088 3448 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\arrow-light.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3448 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4088
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 397100657df866aea6f5625f37e25c5dc09aa01c1df5dec2725a2b62d0e49b5d
- MD5 c51c9b79518bda26ae784f4a0bf707af
- SHA1 5eb8f33d16091b791d13ce56355b524ebdaf7cfb
- SHA512 e2bd9dfb59dbe200380f72fce49935565c0c7822f49d6d5661de32cdb8c8e89652f565a5b0a542c4f8f9c040976d51b4b9d45f834c38610eacbdcb987cd15b97
- TLSH T165F0DC62A5FCEC526AD288DCA0A447BDB5A4F1FA04868146303C06E8942975BBA2603E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 9468b8887b359ad085998f06da5ad6abb449a63d5be79e10d4b87948708aff25
- MD5 522e543622d681723cc99db544117c79
- SHA1 8c1fb80cb49b10c31eb49c39977d346e63a1fae4
- SHA512 2bd07daaffc5e5a19a2561dcec70895388ac365cd6bf7b6862c936342f9598380a9d4b0a206d8229279bfb0d77c335de1b1ed5084a0791173e84730cd6e2215b
- TLSH T1B4E0C02411F7415EF4E4E03457D57436659DF03B041993F829D49B08BF07A009C02965
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8TC3VSEU\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH