Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
b45dd946c0ca413fd845690388f82eb5_3a94473a7b1e84782eb7226a17ab0f7d_applepay-logo.svg
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target b45dd946c0ca413fd845690388f82eb5_3a94473a7b1e84782eb7226a17ab0f7d_applepay-logo.svg
- Size 2KB
- Sample261002-phl2dav1ct
- SHA256 be44ee4a33dba81e18c861673cb1c47398c51eb2dc215499d235c0792d18d239
- MD5 caf002d1c3f1edb21a613edb3797a420
- SHA1 a7a03b6e6b6a6e8e497eeeb06b1701d656f5deb6
- SHA512 a0101cebdc8542d678f093543fb43dadbdc0fd5716947edbd1ca578b1ca386d733a0f68ad7381e9cdaa9a25cbdd4b30f4590e65589b526cf5a2bd74a6a636445
- TLSH T1D74187F7A3DC67F89A0AE361A6553D3076175DF92B42C74442C0EA51BC510DD1C89C9A
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c714c97052dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497708568" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1718799080" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281768" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1724580679" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{91E5F349-BE5B-11F1-8007-7AEA9E30A60F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000025a08f147798edea6094675a2b0ea1463fdc5aaf0768bc1eefb4b628bf316fa000000000e8000000002000020000000847c4265a433043a00b96acf0df3065dca013b0b6560ffe4914f2eaefc03db6a200000004ebb22bb7d2728dd2228fdc70b6258e972f41a331b1d7b062640f94b36f0516e400000000a5464f78857dcd4d92586e3348619ae88479d38d278d06056f52277d451451da34a22cd15ca009da61604078af940d0ec9009ec22af6301ce3ea836c774bfa3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a919c97052dd01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281768" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000004d94608845bbc5054e20dd3a78ba9d00183bf9c44bf89dff3af958da8d43122a000000000e800000000200002000000069c969aaee0a4c149f1109cc22c61826a930fa7de8deb20047f0ca408be0972920000000113e0e6492f2295a7ca14c47419c2e8f3de18b5065283dad22f7e99d10e86af54000000016683368d9aad21a50dc4dd3f00bfb074e2f7ae05a751ea728b2922a0931d6dca6f3fd3039dcfea34d6fa30e8c08fc9b516604af962880fb6d9b3e1d487b0855 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4652 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4652 iexplore.exe 4652 iexplore.exe 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE 4872 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4652 wrote to memory of 4872 4652 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b45dd946c0ca413fd845690388f82eb5_3a94473a7b1e84782eb7226a17ab0f7d_applepay-logo.svg1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4652 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4872
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 06fe9ecf09fe90f243a993c5257ff5eb95fd9e57c1e8774954d7e247ecc38a45
- MD5 4193e41f442e7d04a7f3d0ebf4ba067c
- SHA1 3469d96329436fd9f3a2f68cdcfbc1e2c5f5aef4
- SHA512 40d5c9f3ff6db2369e45da7be83a62ce3f886ae4e62b4cf23b8744cf020077d8ee1f2047c08af2b3701ba6f10eedccc1388563f9b88282ab33951f1afbc82f23
- TLSH T111F0D4F341BDB8542FD164DC41BDD93E313194A7118342C1357D89E684593776F8E532
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 909bdd89e0674d0b8f9b8ef45f226e8390e99d1bdcd583ae317787928af44914
- MD5 ba06bd61f1bd274e28eb839591d9cf39
- SHA1 61ba753b588dc05748067e00ec261d7e18f15387
- SHA512 741e02b38450bd0e2de53ef3181f225ce43f64a79379d5948f617febf1c6cf38ad90e39c38259f2a37589df4e75acfe82902600180488ba421bb68721e96991d
- TLSH T170E0C03411F6035FE1F8E4348BD97431816DF1362018B6B46ED45B04A707900EC03A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFFG4FKD\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH