d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 23:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Microsoft.Web.WebView2.Core.xml
Size 566KB
Sample260908-3hlx9shp91
SHA256 d2e44139c2e8e30fecb99112516964143be130c58960a2c65cabc6a2a7c35ca0
MD5 d1757131496940abcc30af78d34598a3
SHA1 446944afcdfaee9c22320e1f80e9ff43de92e6fc
SHA512 c779c90b4e6b6d54bd745954185659e9eb5c76e72cb2222f373a3b0d3ad3de4307a5b306e6832a4d721b2da3836851b05655c6e90f944488674cddbc5cb66ae6
SSDEEP 12288:rWynTLhgqUDx4OfmwT2DRG3Vt5InEvs//BKoeUvSRyGOtQ/AgJSeLdLGz40cS+jw:CNcoUCF2
TLSH
T1FDC43F01668CD6310DF50ACA69B8B6D8FF2D666731D3AA21348C0F570F739A2E1BF591
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277034"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005dbb74381231054b910f8e664d91bc2d00000000020000000000106600000001000020000000d769feabba6bcf9540af57e78e035d7713d5607cbe71e5f58748915f17658611000000000e8000000002000020000000263825f7df313d299340107f303002c089732526c85630d5a69cb55aa078d7612000000087c6e8457d0df5220dcf6e2b5a610dc79a1ed920adc72a5fef76692dc63688bf4000000066bdfc6eac52aaa548c3c38b804bddd0aa208d2f0ae777e004d77f008ce50379e5ba5d75a7663598694d413a8b7b03ada65e6bc247903763ea7a966763c199b2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005dbb74381231054b910f8e664d91bc2d000000000200000000001066000000010000200000005da15adc79fa6f4f55a1fbc4a8ed73dad3ebe91e67c422ed88939dea4c602a4b000000000e80000000020000200000009d17b84f88d86e2b520e24d211736a8cbf143211c58bcea50279a69937f9620a200000008b40269b18db3e7f86697cbf50efb45004bac799a98306154baa077ba5f35cc24000000085e195e9fcac5aac8d240e13b362fb3d98859e70183983cc213250c88088674ae4321df5a7a066f32a058426f46656723d18d9e147607f80f90922172d42ab51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ebf9aff23fdd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1299169170"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b075f0aff23fdd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "495072216"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1303700901"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277034"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{788F0004-ABDD-11F1-BC3D-D2B4DCFC1B56} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1208	iexplore.exe
1208	iexplore.exe
3988	IEXPLORE.EXE
3988	IEXPLORE.EXE
3988	IEXPLORE.EXE
3988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 1208	3872	MSOXMLED.EXE	83
PID 1208 wrote to memory of 3988	1208	iexplore.exe	88

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Core.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Core.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 99bea925ba784cb64c6e07d2d4f49914580ca850b9d8a34db5c37093ff0ba1a4
MD5 05be47349356415ec9bb717b208f73dc
SHA1 553fcc4d185d97250f4ed4945e3cb3fd716246b1
SHA512 43782a036fbe95340263d4101461d23a8161d8f01031e45840921416bf9787cc30504c562102697ff7d05c2b9b6a1348d883574e5c51896132193861f83bdc8b
TLSH
T1F8F0DC4650BE9CA16EA2D9CC22FDCB7E3430D07F71811901FA3868B0475A3B46B32870
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 357b34419bdb158ed02ebd1615b175f372778cdd3e22ffc4e9972aa72b2ace96
MD5 8583cd2678cdba7b191e3c8c4c85dc96
SHA1 5e4ae5b7b092705a519bebc489320ffd4f8361af
SHA512 053d696d7a60d0c76f7af4690155f84c4ee1e6fcca93510b06c0f36181ce36a704466cb5a1ae0a6738ad0090403431ab0d8422f25563337ab406d269f13da10a
TLSH
T167E0C03425F6411FF4F6D4355FD9B425495DF137152892F42FC4DB04B702A409C02B25
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3872-6-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-1-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-5-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-4-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-0-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-7-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-8-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-10-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-9-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-11-0x00007FFBDF510000-0x00007FFBDF705000-memory.dmp

Download

memory/3872-2-0x00007FFB9F590000-0x00007FFB9F5A0000-memory.dmp

Download

memory/3872-3-0x00007FFBDF5AD000-0x00007FFBDF5AE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads