a5f647be9200c9cd82fd0bdd8b86fa6a8ed958fbc7e1651ea7e921c282a17f1f

Analysis

max time kernel
133s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/09/2024, 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.8MB
MD5

0ff177fbf2a3873dd573077840e0b8f5
SHA1

03d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA256

c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
SHA512

3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
SSDEEP

24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B8D5351-691A-11EF-873B-E28DDE128E91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008797eded1efd93551a519aede400c451f47a50b72e35da212563d7d54e4c826c000000000e80000000020000200000007bcc4536c0df050382151db7783a23627996ec8eedeb2936ae5a0534c37f88729000000042722745e8e32923b626c6fc6c125fd33dec87383acc1a5e0db7feab2b82ac1a2438e1b0741178a0452715eb1c86596c4870a84c16ae545c09c647dfbcd60798ba2ec526a94d701eb272c79a2e583b0300a7126caa4471f2c3ca80a83895293833d22fa36196575d0a8947bc850308fb5283bc5c0a7d60fdde861debaf73417a422b66b53a188499f01232763c381ce5400000007f8520b928eb22d0919ec46b0aff79e5c7af89c8e00210aba3fca7efebcb817231ffdf29c633dc1632d4f7fd91b2ddcd74fe5b07866163d2893b8a88bb111350	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002ee11e0d9e56ee26501f45e892f61e4963930b7dc1152d6c57c2987d4e03066c000000000e8000000002000020000000230236cea3f7f344539795c433d6c2ecaaa9efafbaedab447cdffa6593e72b6520000000c1e6573645005dc52b35f3e1026d3c97fdf2990b4210de48135ed65e3934407e40000000198ce4ca2f48dbf7d532eaefaf78179bf83ecaedc6d225dac9774ef4a326e93a33647b410470f4672c3a49dfc447f2809addc40d243c4ec65ce47c5c8c156273	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309c852027fdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431436580"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1084	iexplore.exe
1084	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1936	1084	iexplore.exe	29
PID 1084 wrote to memory of 1936	1084	iexplore.exe	29
PID 1084 wrote to memory of 1936	1084	iexplore.exe	29
PID 1084 wrote to memory of 1936	1084	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302c166283f96a4bb44bca10cbd22649

SHA1
92903b93074f01c9d00060153320693112b358d6

SHA256
4abe10f7978719e40f32d8057836d1ad3276f5b5b9079a1faa11517805c84ed4

SHA512
47d1c0aab3c142775128d8fe3bab6ee66d9fd5e020bef34fecbe12e33bbc1ca61d6710236541dcee7ca4b82df9aef6de219c291b049e398ac9249cad0cdff472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2869a24a4dc9db0356a602b3dd60f98

SHA1
0eaf36cd5720eb19b7b22fd29d82de655da1db2e

SHA256
d9808195595fc6c84c984423efba0a9110dcd7b01e2f677cee48e1f7e73f1110

SHA512
387aee3288b400f38880653bf8d0da7f642174cd50b1ad33511ff87defce2552f0bd50429aeb95589d4e328a93e1f0bd17b4f960e9afe1339dadbc6e39ca419b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a2f48a6de1d17d95e2cbd168f229fc2

SHA1
33feb54ff813313619629f067670af8569a4c771

SHA256
35929558761de0b1d3120f4024d607e4b8bd460803ef45fab3b65599eb35b581

SHA512
6d6ea6b05671368a4eee35b0dfddccac491301650a9b8e5c9b8148ae5bd836325d41a62c69a40fbf45624546ac4882c5b9b0e4378f3032e38db38e265f3a4c71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5627fd30529234eb9f876b71a8d514

SHA1
7c16200a59108502d8b7441bbef7ccff0346d704

SHA256
7238c6d3f449830b2beea0b610ae2a73f2eaded0deced09a2fc2935fdf4cd6fd

SHA512
aaa097b53b703a5fa9b4e5279ccd69b58fa015c9013365c4ca73f6043e686f276e49f6757dbf77cbfd7da5c946775a6e59aec5a7e80dcb027a3683f9e3dd859c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d611baea8ca88d21054b06c22ea8ead6

SHA1
03587281eb32d6c7663fe0dd59649eb7e5c38caa

SHA256
aa62ee165b90c88ab7133d2ef46ac279074708d68f70d6b42b5868a1147ce34a

SHA512
424b5e6fcbc0636c8db46d67f0a0374b67aaf67b428745d9ba7ce88f147cd78431004588ef3d2db57e8b33a8137e5283453219a3ef866ca4cd6bdf65b6d4c4de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb6f4a9c8b586060b29bc3b72631a29

SHA1
c04c100201207d046c66bcc28c0a5bea651b7a8b

SHA256
9ee0d2f3387721b47ae9bc9b36d426cf149815ee43693ca08219695b217560e0

SHA512
cc76095039249380e9be9d4868fcf512d7ca447923b645f24450a89d9e47b90f17e4ff1f97bd9572f2fb1af358a60644b4d7352e067c02108f353b63e50e57ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0cb0ef284386c3c61e6983309cfcc70

SHA1
14bbe2fadcea8146431260821431909a77e2a508

SHA256
22593e12a98c2f42a378900a649a870e7965d77ab11edc8f98583130a5f888bd

SHA512
7bb9c163b7b0c861e3d69a7ca261cb657b17439b271a70c7179db390c2c8db4214220e9daaa6701102108627208faa70a19eabe21427416205a65a026f2defcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce968d4668bbe9c44ebe3e8471ed6786

SHA1
1f0e692861f58b46dd84465ec1d05b881f571aa7

SHA256
1509dc9552d1f838d4f7769b90028a8369d94b310b98e56b037ce85f777e5576

SHA512
2b82a87e0992604a8496a640f166dcaf8838abd15236ff32e1c9d2d9546a42d02bed5f4177fa64722d9376656b8061ce9b216e28b8205c797614f769e2ea0f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f85d86ad254c4028cd4b306ae4ab2db6

SHA1
b2c08380a784e706a469350280936a7797529591

SHA256
af4f2f7fccc00ad102222d6e746fc8fce3c652fd1581b1d7e4a591944f7a4c6b

SHA512
4be88b0a7012f4c417a290e6721b1f875fcd1455f53ce970ebbf25316909c3ed54878b750dd83399e515e2b189847ef6e53f8ccfa24f81155dbe9d4c789f47af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a22f18fb8e684c5238db0b3c6d422ac

SHA1
f913ad8b4d130a54d405cf723df3758c3feb2443

SHA256
e631c36ba257275f935e269df5579907c22825bacb31e279681a81cc3ff97e66

SHA512
ea1c37271f64e2cf3cf07ba23f6f9b6e927985df295d5eeaa1f15e21dbf7d8e99c3bd1c03ef444fb4a4accc26fa86ad7eac78201c70a28b6498c5512a5b81fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3972cad2d7c28635b77a0cb8800ed3b9

SHA1
c469bf1c7249bb4cca1a2089d0d750942611eea3

SHA256
88893244a35f1c776f33ddd5af759325fc465075891a2b5d5a6191181bcd9c1b

SHA512
a14a881b62bdda300d3758c4f21759433a86eb580987f66d79c1dfe5f20be609b1f77e9f37176a2867e504eda7f32bff74865109d4e5bc7fac11cd4654b3770c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84ada92a411c9f98908e58067e1098d7

SHA1
e5eef280c84ab64dd41f6ebb0209aeb76398a167

SHA256
2a799de579e962a479fd7e388d48a04cf805154f64f6ea3758c8005107c30b02

SHA512
3411ee4f86f3f28c04feb48624a7040f5f398f33f503e1af91c22c8a4a900e27947a1d6be637188283d57d923b5922bc90d1102f0d8189fec3ca50931a49db2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4463febe660c60ed3a88ce74e57dddc

SHA1
4052ca498ddd657ade0e8c674f9aceefc93c6f79

SHA256
5067c29202d92e5db6f302bf050327c64d45a1feccfa39e8441b9f8e42957e00

SHA512
9b1e4d439fc876446a33162105950a82a772bb6b5e98036cb61f7b539690dbc5e7474483264531192659557167fac2d87c63e73e90d96aa8172cb5f432b6ed58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
617969638e394a8c3fabbb9c0e9038a0

SHA1
582f99cce6876f319b226c47e3fe3ca927d07f29

SHA256
f8277ff7af39f699cb1534f9a4eabfc6cfb05e9297948aa81287751936133842

SHA512
d09db784b58483a71d5d9f257a5d75f728adf9d52fc35fb63ce32671bd57e9d90e4322f2b65fcb1073ffd90af59f1ffe0c71207e0e7d79a39a9a237de738e819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
374087c77dd4f96169fb4f8394c64617

SHA1
ff89b0f231c58a7662adface24485aa27460ff48

SHA256
f8b38d2c372358d054ec2375c4221a4188fcb6b92606f1c005aaaf3f863370fa

SHA512
149f78c6a8678cca73512f5a2bcb345736557827fc00a426258844fd37d8b2e88cd3785f878a153ceb3dc95ec97bbf023f5436014564efd56c311777632610d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD376.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD427.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit