Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/10/2026, 23:24
Static task
static1
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
[email protected][email protected]
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target [email protected][email protected]
- Size 512B
- Sample261012-3dptcsswfx
- SHA256 f9bfeee788a3e1c4a48d8d0a8d8c9447593c6b7688a09062889a9ee35eddce7c
- MD5 fa72c476b56e80497391d3273dc83446
- SHA1 c103de063638ffd3616f5b61003f81a3ea67a1d4
- SHA512 239831c27eedf94161bbe8dc72c941d0b6406f4b41d98434cc79d9e1cacda91dddec244316a644a977800443a4b6380c730b619247e9c6649be56773311bdeda
- TLSH T1B8F00EA400CC5220823C8154AEFD3EF5FFC208438F546285EBE16E97CC324C16811A4B
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498612423" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{05786407-C694-11F1-8D83-E2EB83378A00} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3659995315" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec9800000000002000000000010660000000100002000000090b82aeec4c075cc654cd0355902470e492c08c03f195506d255ef711316a83c000000000e8000000002000020000000256134728b9ed24f532fd8f95105842527611ae5a9e2b6927c8a46bd44b46f32200000005211beb7e11af5ad5b893d7dc128159051b8a0244a11cbf483b788fd52f1a4e440000000e29c173b60e2eb51d64117f4f3bba10116cc6930ef7176205880e802251c1c5a458332f98b9a81e7fdc2d6623ea6f9a50c5c9f2b95d1b99fd1d33046c770aacb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a6bfff05030eec4a8a71250cdb1ec9800000000002000000000010660000000100002000000099a7a669e1ee4fa3be80bdc79ec16c61b5b074ae0167bf593cfd83f479791cce000000000e8000000002000020000000d70063c02764a5468d96e9491c51343276b751428d1c538f52be80d160b3ee7a2000000070f30bef971f82c3c8b1fcb2a575f1fc67e3b2536961807fd4da80d5690320db40000000ee754773cf0d71cdb9d6a58937e86ca9d163cf0481c1689b746001430d36bebb06e24899073ba08b91b57458ce6ec59a9229ba95bb13b65951539726969b8b4b iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a027aa3ca95add01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283872" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3664838816" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283872" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e2ae3ca95add01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE 1836 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1836 2092 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\[email protected][email protected]1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 77f092574df221fef3caa5611bcc1a8c78381ec8c0c54bb107e6cc5355c4840f
- MD5 5163274101cd2a42b5ea54c9cb7602ff
- SHA1 60b5fde304e075da3de47020d42f3bfd5c322f52
- SHA512 df38a3009056658dd88ffbb976737d1bd9258f76ab6e6bef8af1654e7ec233d041b4ed4c913734796d3be5635e2b80c93e1da128d63e2269be61d7205c7195f8
- TLSH T132F0D4D5A03EF8602D5798FC62712B4B603191E62C61147435781DFD48567773E5E035
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 c5550cb6ee7037413f401b657b1af5d5d96e3c20979eede363076d0cb3de933d
- MD5 c5e5c2502f6837919b19aa8d695ae7e8
- SHA1 10576fe63a8db919940dfb9754a417fe2e863ae1
- SHA512 1d1bb38018fb8887772d0935d3658a6d181df7240cdf2d28e3c568a1ec9456d58402e00813e8b8661b5c76b74d2d7b51ac1e1875ca1a8e81c2ab38cdf0186816
- TLSH T152E0C02411FA431FE6F4E0398BC9743195BDF02B141993B42BC99F04BB13B009C0292A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TY6HNOHQ\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH