a5c8e0441c86b2488f9281921e190d1ace8fe8c3214231d5cc77de7841df11bb

Analysis

max time kernel
298s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Moirai/data/levels/town/main.xml
Size 4KB
Sample260727-x9z2bacr21
SHA256 a5c8e0441c86b2488f9281921e190d1ace8fe8c3214231d5cc77de7841df11bb
MD5 1b8283551281c1f7f534fb34c4ac5453
SHA1 cddec797f0799445c89ef4c9be686123d6932df1
SHA512 54a2cc1cd4748311f93d04bc131c277077fce7dd3dab29f14008d89f7ba6c145d7bcfce008a4388ed1c6d2efa9f84239029f971aee1210dc2f31032abc963b2a
SSDEEP 96:vsspJdp/tSikq8OqKVqfjeq43yT2P+wmMNL:3cikq8OqKVqaqJ2P+wmMNL
TLSH
T13D91D905D5F8DD3BC01662787A23D8863DA8B2F7C2544B55B1CCC8B2BF019A52363AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e46264071edd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0025e64071edd01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268351"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31268351"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "491945841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac8221300000000020000000000106600000001000020000000353614322fa66492a1d4bfe1120030ce0d1e3d8a24a24d82b750a18780604946000000000e800000000200002000000024bde08df8d9ab3f750c1652f04dfb6e4ca03b56651f618680beb59a9c65d73f20000000a0e6ebfb14c327fb3aa77df4959e7dcac560f9effdf9d64e987c788c38d84ba7400000002131c3ed71895b45486982072645565bd30085d98865b9acc60a143b47a525bbe1a0d7ea2cc36aff4a649d0cfe698dc453f1e4e267cc9e08d38ce7a63ef68000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2CB05B46-89F2-11F1-AA2C-7262BE72A49B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000994ecf19d48ae9428d4805a6fac82213000000000200000000001066000000010000200000008e9e804f23c1a8e0fc3cf783b8066ce05960c6035b8d63f939fa310f44a71484000000000e8000000002000020000000d9d3f3da78f4ed24040b401ce632ddf1ab5cf84fca3e4495771d59d031dd74e6200000005c4333f9eb5175247fae2e9bc1cdce7ca09398ed5827ea0cc95e1c54d5e81b444000000047199c59ec50254e1c20e8a85f95a123dbbe0561298b180e9701e90bba7ae0c2d033ca6a74698b56b0b70c196d6af29ecd79d688f5f32fa63d5cf5d9967a9818	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "34881543"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "35662270"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4252	iexplore.exe
4252	iexplore.exe
4680	IEXPLORE.EXE
4680	IEXPLORE.EXE
4680	IEXPLORE.EXE
4680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 4252	3636	MSOXMLED.EXE	84
PID 4252 wrote to memory of 4680	4252	iexplore.exe	89

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Moirai\data\levels\town\main.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Moirai\data\levels\town\main.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4252 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 d938b0809e49c46714631a29755041bcc9db5abae52be410bfe124075f3820e6
MD5 945658bcc71798eec14fabb44d32463b
SHA1 4397731924da9bffebd2d5a1dcdc6acdf8bb3f12
SHA512 0f2570ace01d4c02e47b03ef623aece0c2a2c0a821037d0c2a96a3045d6b3941483f1da83ca6f38b6139bb67209b88294626e6f0e9ec3a8c7ddb9bd4f6c3575a
TLSH
T1A0F0D4455099E6817981FDEC01DC0B6D393575A730DE0021603C8AB057726ABB70B435
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 a62c67f507bedcb783783355b6e2d7886531b3bf5c16dc60085aaac09f81b1ce
MD5 458cc3e7a544432f5630d8f244c176d9
SHA1 b184508032ea8a62c1b4046519fe54cc3c041cd2
SHA512 bf1cbc6148236ff110e384c4a79e684f7825733a1f36ada543422014bf05cb2027ae34d0d18778a81ca4a316fdc4744d6c5341d99a04620c76b1f511244b118c
TLSH
T1B0E0C02815F7415EF0F9F0385BD97431845DF02A042893B43EC88F08F706A40AC03A65
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDAHZAG5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3636-10-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-9-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-6-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-1-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-8-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-0-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-11-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-4-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-12-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-14-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-15-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-13-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-7-0x00007FFE13910000-0x00007FFE13B05000-memory.dmp

Download

memory/3636-5-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-2-0x00007FFDD3990000-0x00007FFDD39A0000-memory.dmp

Download

memory/3636-3-0x00007FFE139AD000-0x00007FFE139AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads