d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279

Resubmissions

04-10-2024 13:28

241004-qqpb5s1akh 7

03-10-2024 22:49

01-10-2024 17:12

10-09-2024 12:08

10-09-2024 12:07

05-09-2024 12:10

04-09-2024 23:57

Analysis

max time kernel
1799s
max time network
1820s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

aaea51a605688fcb2f178fd60e4ca64c
SHA1

69d4791bf3cfedb68bc4d8f766878103578171cb
SHA256

96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
SHA512

d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
SSDEEP

24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000cfa8d83b2036e5f410425aaf5594d76cdb30475def7af1d464bb4d5f735a2b9d000000000e8000000002000020000000ddf2be42d4da0d03694419e36c874b0daef897ea4c74016ae75f63bb730b078e200000007084b1b343b80c0f600abc888f4b057db26afecd2bbce3077f5394441b40220940000000e077dcf33a8cc4cc0a3f873cb93b9ae61b91f946a7b839b8ed2969a57596a55080b967aa4b18d0a1a8af172ff763ad311faa7183689eccffffb353bf913f8fa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f8b73a2996c835be426f5c74ddcd526242dacaa8ecc22312cb4ae35edb51d7aa000000000e800000000200002000000022a9b0d45b4f2b9250e7ad78437774540371b0074030011b5da6fa7a691e44d39000000046b7601cbce7c930862bed4858a5bc02f372de8dacb5b011329ee73d50fb72e956785f2ddbc05f74e33f652b99d0f4615c270942c7e0d76778758118175d33d71add2648102e9cd89a409e09ce4a4e9b608e7cfd93b70f3b7e0a08a9eb60295ba628b24980c82eb979b310d6c3b7a9da73884046a9dbbaffbe18b1e62982a8388a3a06aae30cd5cddc8bc57c32dad0fe400000000a38c04fb29ad5125e0dc38714af437eb0a16ac9e3a928c989e8ac7f945faafd289c57b89713f634396e943d6231c1a2d1246b443cf2aafa9c885b56766109fb	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432154823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{895D9761-6FA2-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bd785faf03db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 3052	2632	iexplore.exe	30
PID 2632 wrote to memory of 3052	2632	iexplore.exe	30
PID 2632 wrote to memory of 3052	2632	iexplore.exe	30
PID 2632 wrote to memory of 3052	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd112062416a72c8c24e7bd930a85146

SHA1
e31ed88353827325143087d71652508158f4d4f0

SHA256
9c03b2632fb03edf986e24dc7eab3ce3c07c7e514d77fa52117e6a4f344dd801

SHA512
ce0b0aef7ed387ad701b92444f1ab5c3e4599eb2867f46e52a71c31908da5a90dcda2f2fe42902dd60198d13ea99782fbd14705ef2c31607ae851d618355e8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bf19fc3d2614eacdaf5de9f0065ea5c

SHA1
3fac79fa3ccf2989a14380b677639de44514678e

SHA256
0c27a05d86534a740f12b619665c111fbed65f034a4e4c482f583028a83fab1f

SHA512
6c01255f2423408ee9a49ea0d90d7a55753394c3aa2018309aae99e67c8ddad8780515e20b68d055d84690809eb7d0ba04dc180f935ba2677b6d0aec2c142edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bbcffb4fe1ad06ce2df2fcaf89d39e5

SHA1
1d0f98c7911c28d20986c23042d9ad9afece040c

SHA256
27b45351f109d6819b330148625174b345ab1f5e1a21e85e4f638a2dc7c85b89

SHA512
b7c5d281478ea0b5f91498f18f864a02ea5e38b911c72d42ad2623169538144af5a4cb1c7a667bb715d31ed70f54f06416591066c48e760c1b36ae22bf8d8aea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b66364b3f67b496b127f924605af5b4

SHA1
536e8680121b6e638628d5c396d3cc1413685f88

SHA256
3d9e2e38d638e8fbe99a8e963547c6f6f57db74e8dcffc92ad784199428fab19

SHA512
a3e3717c9bca11d4964c5607fc82e9697efcbda2be3e552d2e9af992c9a62b8d2a5d41ccc86ba5c208b7d7ff13f88b1da2a02c66be587ef8e7e520734f2b5e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab47e3d7e3485994c4e4f267c66facc

SHA1
86ecbe621b629102703d57a7e08a6f36b00acdcf

SHA256
b4af6bafa291fb957e7722c364f441c100fe2e7b4d4c4d759cafb9e555fbe8ff

SHA512
2db0aec8e15c626d365e1c4e11d6249a0db9bcd04b7a112a13027c2d643a80b43b34ee940db3ac94b0a808469d666da043954c07ffd6d148dfc25a11112220e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d163f9504e4506986defd63cf302863

SHA1
7eecdb6384c25e8c5fd0c61592ea654b94b714b3

SHA256
7a84bb44c9316481b670aa01df7923b07ce6b37e5b026ea52fe78d6eba3dce7b

SHA512
9beb53a3c5c600d9c26f11ab2181b1a5c6b72ee02ba722925c6da02388ee0f8dbdf3f37b2177ee9376392728ad9e063b106e4ad1f8243abe44f559ea613b4d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4390e799e4c4e72cf3153412513d9489

SHA1
1727f633ac324b62a278673f7de2769d35760e1b

SHA256
e59de98ce4948cd23d9c5db315c5a8091fd810a49f5454a76a9134d4d0adeab9

SHA512
4bdb92177e3d0042c3d9425cb00a3941a485d64624513c6a1f2596585e3e3e5344f0f87bddc4ad0fedbfa9e3a3fda334e64c43f783885537021bec0b6d121f6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f549e96dbd9b467a48d0686c195d7303

SHA1
4c7aa0a4ad6b34344b84761f4a98f60c82a40961

SHA256
5688710032858217fb1b95688d468e2b01170a02d5026706b70710f28093b904

SHA512
00aec2b9aa2f26b9334a2a5f5e044ffc00a96cc42e6f5faa2e797a812219bc98fefa1059762fa4899a7db4337a063ed13de4ef2e7fff4fc661f4fb5dcbd7c8cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69e201cf96e9addd2e16d9c253d8441b

SHA1
b7feccb49c67a2a31f8debe5bf4830746044527f

SHA256
361f4353ce2f1c137939b5eaa9d5ea6361d253f90a881d8a8e7ae2b83e20aa38

SHA512
179b0a5f72ff7ede9035e36027aac76cf74daafe56a8a6451190c7932fdaf8b9cf9f8a779e7a6b9316e551eb098db261539cb9d2b92114d7ae37f4350186de7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf92ecd7db0a4cd87b7ec687d9f735a2

SHA1
70a6e556bb61f09ade0f5f54769119b5520896d8

SHA256
584acc0033ea3f02ecbb2209567dc63540f270fdd3dfd25a83b4c23e0dec0464

SHA512
502490c26dca468b992e2221d9676e9fff742dbfb7bd0e3c256cb9ba921f7c0a4b109597026208c5f0fc071822fd900a7de5cd87ba2c10e9fe16d51d37d9e512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b21187582e4d0ebd086d7e7cb062d03

SHA1
7efff54af7328c5c12d2c5772bba5eb8c8477fc3

SHA256
6691749eff3a80882ba61a56c484d8dc8d4d528dfe55cb5f9fdf5a8b3f0c03b5

SHA512
a9b226dd8088cbc19b9d239b10fc2111f0c7aa8d104af0735d88e3c8c881dea2f874ca07888b00a01eb6bd3727e6ab7e76c27bdc29c5df8564128ba0546e1f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24c678a85967249657ca72b7e6286113

SHA1
ec03b1385154b3fd9a00d35812ad00c82f1aef21

SHA256
390cf478caf8d2b4670564671d75468d5b0fc4cab655def54e8b2b835894e827

SHA512
ede2d17e1a040093c88359f50313ade1da96253012b3b2869e2b352ee2350002202c655a3ad701922ad7bfd7354cc9ae7b34709b5430b8cbe8e1f9a71648f48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit