818d03cd6f348268d6609954eb3b4f9cd3ddc5e16165cacbb8fd416feb2d3d1c

Analysis

max time kernel
118s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

f017c462d59fd22271a2c5e7f38327f9
SHA1

7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
SHA256

40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
SHA512

72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
SSDEEP

24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431839359"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000ab4b75e69e8232e98777499d0a70fa1afb320f0775fa01dd5112bfa5fdd7468c000000000e8000000002000020000000088bc2f18bacb5d5285a83cba494a24b9c6c7eb017dfaa461c744e944b400ad620000000107585f2b9815d5701281e1281452978b941c3f4a3fb6bd5596d32c14850ea6d400000008dd0f5af03ea770c06b9660332d1c4e04f711ea5e9fca56f094163b9d23506b57e982f9c3bd207d6787cd9f410f73adae3b724da09ceb5cf917090fe685d8bbe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000e854d60dd4cde118a8dad2ee8179cf33b28536f71dc240dd86901bdea2bc7d18000000000e8000000002000020000000cca3757fe4ccb94ca88846317c55c1044611c585022aa75246a0a00b399d2842900000009f1ccfb9b13d483592067da463762ab1de987629e31c58d5552e65456591f58d3f052e80a5c31d43f37ecdffd34c7fa5f9337b7957e500bb0fe26130c5e7722c5f1a59bb1ff4de24c102faaf475a75fbdcd1c3ea22d02f4183c9d987b5b28aea7e0a5811c9ba83005fb2d5f6b5c1bebc4404ce79a56c2fa85de0bc940edd8b168a05cf5e4f8141ae39c2063191b634e2400000009441f88cce4807cf8a4dc346cdc4a5470436d999a9698b71e3a1bc6c43c50b6708aac7afbb194dbae57d19f2bd26b421c771e30f6f04bdabfd57d81bdef6afbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16560261-6CC4-11EF-8F2E-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bf56ebd000db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2696	iexplore.exe
2696	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2692	2696	iexplore.exe	30
PID 2696 wrote to memory of 2692	2696	iexplore.exe	30
PID 2696 wrote to memory of 2692	2696	iexplore.exe	30
PID 2696 wrote to memory of 2692	2696	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db5187dd79265b178daab148769386e

SHA1
7fdfc3e34f95ce43ecc0b1a1946911eaa8ab951f

SHA256
cd7582aabca87202c087a80c689c5d218d46e677ba5f6b9dfe60933fdea169b0

SHA512
6f119533ff7b251d8d0ba002ad36bae9912a7a4fc01ff05111c1bacd40248b4296e4572400147fba1463d29b97e0bc2500ed0fd1f29cc0217a485a64b9cf6b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c9871a8bbe04c1b0bb900de02ef22fd

SHA1
b7c6b3c8bc37c278a4c915ea9bac68848f9e44f5

SHA256
c17d2c9a7280eea0e1016a410a0a2a30080628056ffbd11e087358b37965acaf

SHA512
5a1d00dd7949798fbd706baa2381b38b99c7554d9067588f0de84c2cf0f1b7e8e5ab0bce8e2cc672c29e4a05effdc20c1cc99db2433f7fff5eb2dbb1fb1cc70e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18f06f245833f3ed453006dfc7b7832

SHA1
f86bb316e31572ba61418f04577eac75fefd1e49

SHA256
07609a31ae09085dc13c507d4ddbe912d0b1a920cfdcc8c1da7b59d7329036b3

SHA512
0321e7453625fe29e106c354c8d10b0d45e6c64e0a1b1c83698b2787606462bbc87beb49bae90756df6d7b785be408925c2d99bc5a1bc0eab990ba514fc611e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46dc856cf9a9f1ee982c0a72c60cf926

SHA1
ec2ebd344ecbfc617ebd39e2b0ece129fd0c353e

SHA256
68cce2e7e3166172c0557f5de374df0c2a94c25821e1c96130249c77eae77047

SHA512
d4010083a128a9894cc7a06665068a09906d077f63daf373d8112b5be89baf2a627bed2323549b0795ea0b5b8f6c99aa1c1dfe2cd2afd477730404bd1e44dcbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e372ecf058c86fe906695f31fa487b0

SHA1
f610af285f647918c126ad22b11b9f3b4c47fd92

SHA256
b3f3eaa57505a00ad527b4f38adc158966f574102138fdcfc4b9dde361beaafe

SHA512
22fb3ab9b64e30c79f2062b1262767350a4b7fd276b746c7a594b7fd0426077de244afc30acf6c371793704b7328cbce56f3a0cb86059d1ff3c6cd452734bdda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fef3edaf44de9ad3a3962c9ad5d880c5

SHA1
0c4601eccf521e698777f7375a60d9ab59c7b689

SHA256
b8b1397f522a6505e210c1675f08637e7702cad73cf4c5bb9bbd59be66bff2c5

SHA512
3b92b8ce615872f6a944f5d3e9c342c41aa48481e494fe70b4babbe06e2ca9afc69ad2e63268df1aea98d38e4cf19d48395adbf9c8483f3007a2ffc2f9497cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f3abbe56068eb9e47eb88b40492edd

SHA1
69e903c7e8f5f0714268a96dddd06e36aeb0d126

SHA256
9d5f95ae8a95c336b1eb3b9b4d49cb1eb4d95d37c31be28b2f52fcb86e5b395a

SHA512
55cac50a0228aacf791bec531ca2226ea14b9395961ea4b08e36a37550be05357876003ff98a3a6c3ad4dc8cd653fedeed03bc5efb561133e903ed1ffa55f493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
875188979223e7d703cf7a5200f0d547

SHA1
0eab092a9754074afc45c8679a4b6110fc03df24

SHA256
9f5e2ac2670d4bfab9be90af85bf5d851facfac52ed1b819b94ce80d8aa6cf2c

SHA512
733660979b80003c192a55637d4445d483894ae9246430f2395a23be6ec128e97d85b38183a7d7b5626dafb336b2246ac3aaafdfa2915ab12f4c3ceb6dfca6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b66cbe14ba29c075c7e3e76e579f2c

SHA1
4d334019f1464183874403b9b8d8a64876a85e29

SHA256
5808569de8210a2eebcf240732741400fa3de1c956b541d74c1283d80863d9fc

SHA512
69e158ecd692f49bafda5921266b7c98029fd34da4063daa520a179532fde32b6901c24476d9f4eb7ab5af1cd48e2f7d05018553f5a218cf2fc293aacf308506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed48438753300f8f22f4cc75a152eefc

SHA1
fe7faf80d1468a442e29010ab7b1b18d49d47788

SHA256
9f0796b888118e549f81824bf0620a73fec737826985d223af30193f1b6b8e0c

SHA512
f54353b46f3309b592a64f1905efafd929bfeaab9d7a09fe6c590554d882f843c79d1b1dc8349f121e5b07d153ac28f35e9ac6a65678587de24ac2bafc8dc3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e470712e67a6fe466b0694b0b7186ee

SHA1
ee9a8e267f603c5839cea9608e903c3fe742422a

SHA256
4ea9b963f41996b2ad8dafded7891901b533917917a54865379dc549b3929025

SHA512
335adb7cf606810bd5a328ef7f774ba07b4bcd64beb390281b4eae0b10641c5cc631e18ea55e2e8141a8af5e380fc98fb95e0011a9bc30eec9f596c3cdfabaf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c80766d6059f3c9825d4a463c68980b

SHA1
39166c3260b5e7815293f60afecc941951b88cab

SHA256
a4da575dc6b062977944ac47894851bca520fc81e4f3757a8fb4523cd125e5b2

SHA512
3e39721705e9c1385cc6f87510b9d3c656a7a48181204aed2535a1f1dbeb8e8c229d4fde3e62b97cfff52de1c884a6a760dcd77e2edb50f8c7defd1bb88e20c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C17.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5EE8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit