b0a8330ad19fd4e4edc1a983d037524660364b00d5802d6ed90c2fdbeb651b3f

Analysis

max time kernel
56s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 23:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
diagrams/layoutHeader1.xml
Size 671B
Sample260811-3hrthseq71
SHA256 b0a8330ad19fd4e4edc1a983d037524660364b00d5802d6ed90c2fdbeb651b3f
MD5 311bc6230ba8f5d6480d47c4a5173a55
SHA1 19dd0e9429d0c8419a402c8c47335cf7dad74edd
SHA512 d0cef1bdac2e57f6c26f07a5221aedb9093571affa4d6083a713300d3fba56c0859877029545ae96fa96de6297ec457e2a5a0a56541e06a21c4f2075a536363e
TLSH
T16201FE9AC388DE1B8562301DF0C1784861BFBBEF12B585C994DB48196F8285885956A4
MD5 SHA1 SHA512 TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271401"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa00000000020000000000106600000001000020000000e7e174542061544fd99ea48694c6e001b3d0b0b60094a52016f77b33b2302823000000000e800000000200002000000074d963d47a6922f96d8c4cf2064878809afed7edb39d6696a1732bc9a859507e20000000ed945c60602d3a13bf05e009acc8aac6698867605b7c47863259f42310dbaacf400000004c521fa95305f5d9cdd85f4d7d21e93900cf1510d7c2fbac01126990df4b6bc27a97bb7dbd91615626df9245985a77abee8274e2c84ec9cde7ffda4928f7ad3b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00566a0df229dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D5F38359-95DC-11F1-BC3D-F6DD02F7A3D1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2869162846"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000784c95236aedec41853ce114ebdc6afa000000000200000000001066000000010000200000008920bbb9cfc90808dd8b3376f6abf35e77dd9dbb6b2a23e222c49fdde85dc8a2000000000e80000000020000200000009360fed70279ed6edce404368535428c285712dfb301037e5f36dd0131aee704200000005bbdffd3d4e28f83c2cbb54c07eb95c65adaa3c6ecc30d4df02c161b1a2212eb40000000fb24eb68526b99988373d28096e5824ca96fbfe36071337e3448751bd8ade749451616e0a01c5c2ea9500fb3036935403ac353b3aba427a5830cd3f7fad53ec7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2867599973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31271401"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109b650df229dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4276	iexplore.exe
4276	iexplore.exe
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE
748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4276	1912	MSOXMLED.EXE	85
PID 4276 wrote to memory of 748	4276	iexplore.exe	90

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\diagrams\layoutHeader1.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\diagrams\layoutHeader1.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4276 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 5b085f24998e833673793f0d49e401d8e22a1088784ee80f56b82cf16c0a9efe
MD5 c17c697b3284099ad07d9fcf4da2d1f4
SHA1 9fbfb46eac1c96c8bb7fa6bfadb62d36a231db44
SHA512 65136f309ecde79757d44439e0f23170569814fb05302241842f3f9aa3c24bd582afe4fe119544cf331ff590da1dcba73a59302fc576146437b623118a175735
TLSH
T131F0D487445C9DB15A93D5CC156CD179B431DC6F01A11537A11444F14D453D7222F469
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 5ea85e260475536dd1eeb7433c7edc4504e89d959e6262424f5d3fd8d0955f5f
MD5 1aca127ccbf8313417661d5d952b066b
SHA1 7812c243ebf1bfd5e3c707c2782f1ef9a64449c7
SHA512 5a652c858a71a4bcd4cbb646e35f7f733902b280b65d517e79cde32030c2ae515cd8f070b664429cd119d7c44504ac600cb3facff2b7989d4e2c8df13b317e1c
TLSH
T1E0E0C02411F6415EF5F4E5344BD977215569F036141AA3B42DD45B04E702600BC13B29
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1912-7-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-3-0x00007FFE1AF2D000-0x00007FFE1AF2E000-memory.dmp

Download

memory/1912-4-0x00007FFE1AE90000-0x00007FFE1B085000-memory.dmp

Download

memory/1912-6-0x00007FFE1AE90000-0x00007FFE1B085000-memory.dmp

Download

memory/1912-1-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-5-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-9-0x00007FFE1AE90000-0x00007FFE1B085000-memory.dmp

Download

memory/1912-8-0x00007FFE1AE90000-0x00007FFE1B085000-memory.dmp

Download

memory/1912-11-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-12-0x00007FFE1AE90000-0x00007FFE1B085000-memory.dmp

Download

memory/1912-10-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-0-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

memory/1912-2-0x00007FFDDAF10000-0x00007FFDDAF20000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads