36aa89d834f7aa6b9ff21b34727cb51efa04cafc32087a4f21f5bb8e1684a8e1

Analysis

max time kernel
137s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Launcher-3.17.0/Launcher/runtime/dialog/offline/offline.html
Size

874B
MD5

696067989a83f7b99dd84db6dcff51f9
SHA1

b509aef97aab637fd2ae15ff6cbf6d59f2d61088
SHA256

74156f706fae9ff6d80823a16ad78cc57b3c78c98638ba07c8906ef861ecefc9
SHA512

1c626a5bbc1818982f8cc77a3270952d8d3dc13f74ded65255f72e33570a7dfdaca3d389c2e2745b9d0879bd5e6120077d8df2e5fd41b65e0a421117ca7461dd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432327999"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008945a5b3686d6e7deec46a6770420a5dca773f3e9d2c329429d6e5b07bac22b7000000000e8000000002000020000000010694deb4303faa2982766eb73259273e13c8a38e164d890049f63f801462f22000000079327b6263e68d817fb0b5c64f75cfc59eedfd4044540738ba0e2b4b2e9d673a40000000877c9dcab183d266b676878007e7f3c162d768d8c67e744518cc2821ea3c3ae7910c1b53850dcaf34d69485b39b7898154005bd7028d4ce255f1391df6a11f8c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C82695C1-7135-11EF-A641-5E10E05FA61A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c079aa9c4205db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008fa196d1e4f20a342677aa0ec3853d710d5bbfbe82a005ebeb71485881bf02da000000000e80000000020000200000006d244d1266380f0fe3ca2cf294f2de8bf0e5bc50cd82a08586267b1d84876f3c9000000053a6d026390f7df2572fc253d170ae9983e3574c076b6ae905f01144108734a11876b4a06045aaca98a87c3edbaf5130cb670897a18572e1a03a3c108079836dfa5867f18f2041009a4f21a7c44eb82f81a5ce4df0b88a02874a5575b21800cb2637dc3352333b833b385a89396e7399b2298b56d3ad6d8e5d816554424dc62a8406dcb554fbbd944ca518a638efbbe3400000003047e07f791c28bfec9af42f9d3815201034519a3107ed57ce7e714dc871d3b73167f56d059faaaf5af447dc34a06e43d26038e0cb2b95eb2106232082370784	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
528	iexplore.exe
528	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2800	528	iexplore.exe	30
PID 528 wrote to memory of 2800	528	iexplore.exe	30
PID 528 wrote to memory of 2800	528	iexplore.exe	30
PID 528 wrote to memory of 2800	528	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Launcher-3.17.0\Launcher\runtime\dialog\offline\offline.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:528 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94afbb481d842692f916cde251810477

SHA1
ae969d3453fd9507fb27a2bfc1f1ce68bc75fa46

SHA256
35136d5362e0b886e1442bb37d85b4bec1c824986747a8901ccb093bf1f04dba

SHA512
6e54dedd71991a11fe327a9cd1932c418db9624c81b38ff08e8d8717f7201c8715bb6d7eb7c7597a530eaaada09320d37e4cc9a91ebf0626a76ab2d534b4c654

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56d2883230067c79e2672cc5b0e4d1c9

SHA1
47d78e9af3af703663c449af0c16df49f843cba8

SHA256
e32c3476ac21e9f47d82d64302ff98f25d5f17b4c875c10247d3b217524d78e3

SHA512
0cef1a9c4d4eea449f779c4180a1e2d86f209b5e34a82135c013a8dde4bfda4c61a9ca5a071be2ddc36328b67e521bed6f3e79e54266ac215b25835dbae6b1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e8edad6a29d313269035709b146791d

SHA1
23776bde848322f6ac9d252b3bc8df715d293301

SHA256
33fd93f440b723576445f9e67f63f820c0c2cfa89220a861f431fc27221b5e58

SHA512
0c1df22c01348398c62c583c00a57b27bbe7ec2af707c4c8bc2fae6f54f1caaf3903a971be5b74ce6919e0f3ff774533db28c0011ccaece622a436b9c440c6d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51ca7a2346640716bb02b5894fc19d40

SHA1
544dcab869da7169349360b59b5cf9b2941a9839

SHA256
72d174e1bad31a4d6406af68e70d59c774eb71b0e0641324a11dcbac76d08968

SHA512
7d6888bfd158ef425d46ff0ab39aa6d155c3dc4c257bf2d2f5b19200e51d3c3e886ff27ac2e2869e64346715b82f590bafce7a40d47b86e58927e4f4e5d07b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc2ca8f70cf1e240128d8296d568d06f

SHA1
abb1f856346862c329e5899706ce533d788b66fe

SHA256
182ea23c9de9db8ab5261625f9605b6ec15b5a0a28043b6fcdeb0f1e2eacdffa

SHA512
13b690dc6233b834da8b20e45a3a44e9bb7b4d41e289d6b903104a553da7d28b87c8bd42ff5633641ee8a3cbf229950631d104857181eeecd88afeffb0058cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df573190f1c15dbb2390ac3b027f6192

SHA1
4b2bd5253d58b4a8dbc2cd84039be3e90c904099

SHA256
82f51d2f4cd4d05a00bf2366569ffc544bda05ed07f8f803ce681ef7d584f450

SHA512
2f29a74eb7cd25ca73dce6da7f5f50c5ec9718e490e700f0ffd990d049d7f7baa330d918eb73656d8722caf60a26d784e107eedb53894c624ae7e5c21e47ff3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da73e69fb6b05bb186ac5539547be553

SHA1
03067e43e9c4890545b96508c828a6ceb3cc702b

SHA256
a68c0da8256354b3ecb32ec1a7c6f2ce341a26baba5641afe36afc5a06e0b7d6

SHA512
fa1bce4befd2969e0dd1d1aca5429769ea4e0c1a3db2ece51e7f6d4d1cb9f9f31326aed5f0975166eea38c1dbfe1233c7d12d43464350904f106e1eead0cfb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f46f38fb6cb3f0cc16e3c71083438938

SHA1
8931a382e6726d7e2dffaca850ba0fbdd22ed2fe

SHA256
d8d3ad25d04d890095ac7096c25d197f2fcd5946b42116eed871a2ec65760dbb

SHA512
18733b97a2169165975f405f741818dbd0a2c3099b49e8b3187101f43292a4b01d8f11f7015d0d75851edd4240e2311a0d5cba09412c96de023f8494a3331657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b474e0857f615a07f384150b1edb1d7

SHA1
da7426d64fc7f745622befe52c40802e161d58ed

SHA256
0a7442e6f04d8426d4a04a377f815369269a04602e5bb7ea78c5b351e5c45873

SHA512
914e60230f4b782a1d1578e5c37ddd6330eeea903829b28684aa2d2a843b80b4890032117b1d376a069389b3fd7718d407820f1446f3feeb493851acf0cb70df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1f64a4e24aebcfa2aa56d12ee2f63d4

SHA1
9c36f7f16b099e3b98ac843b10e626f3eaed7086

SHA256
97ecc8bb8bc0e4e4376652e9e6d00b571d090ac7c1a9b45ec5cd934e83e1a059

SHA512
0991528c6b7f1950bbcc82cf2b0ec9c99e085d04ac7906ec30b4bcf045334ebd6640cc0b7a9ca0fef518a6df12d741d13aab5cb40c2c0c1f38f0f7b6875ce921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf083f9fcef333d474e364e34bdb071

SHA1
6138e95745a9bf25b35ba6d76396deb2aff11196

SHA256
20c72c8b2c47131c15e6c8aaf787bef712b5ae15436bf836e79d9a2460157163

SHA512
afc14f4251a4e3cd67de4b45de5010e31235fd6620cbad15a4a756952b0d29bf2a655645959b45987e0ab59ea10640c202f2eca667417306cef1828f719a8774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4589f487331a6c15d7b582a0eb807849

SHA1
f086791a31621e0a485ee4d4d606c1092e5c382a

SHA256
fe104fa3c4620ad8be46bfaec4c1c96d4cb2fe2c61863e1f96421aca0073b85e

SHA512
af04a5ac40bfbb80a4e6bba19f1fc5df1c5ee2f556a9a1c569b11b6b00f309563b5f6aa688356acfe6706315a662f9f24d7eb5c59f580773d5583d15bd5f421a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96726b5583658f1311f4f7bdeea5bfc1

SHA1
680447cb21777d0d5f0d464037037d0b1ce3785e

SHA256
26ed562e98bb101d79d2995a967f5f6b91df86e70c5ac19df21fe1a9bace5c93

SHA512
03843b651f62f809f79b1ee1c635a6f4ead58bd93410f259de31609c938982dfb9d32db46ae103bf39df26a7388251b5a95706566e0e8559a1b9b2aba6bad930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6118ee5fbf56a182524a418922a66e55

SHA1
6972171a6250d090b45d7d13682f60335d790032

SHA256
d93c7c43eeeff833e8f6ba101b4f85feaa1e585e2f6eb4889010af992eaec100

SHA512
de639a5c5c043f3bed2bd73d937aaeb5cab494ffad32194341c93398cbb2fcc4d617ca2536d84fd25cf4ce0fcd512236ff66f7ebea6327405e389bc199bf29a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2c3e706eafd456f518b12c5c7f1e7d7

SHA1
68dd1d0215094789b0a3cc4d7c0f853b02cd1855

SHA256
ec219c89d5d906d7dff00a7aae4e19eb7c9a6c12ef91a6ecd735f2adb0f7d51c

SHA512
ab0479fad4760a35f8f730b9a545645b3f57f2a5ce84e08faadfd758adcdf33e360fafae6f941c393d21a5187c8529f789e13168b1aad3c9b19700b905c85be6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1d9eb2809ec6ad34e477ec13e90839

SHA1
ac7e0bb14d2c83dbed1f4610bae22a78c3e2f03d

SHA256
769708d8a0654c760de823b9204f07ecf6fe9cb9e7be89c553d8c20ad3fff62d

SHA512
f1588db2aa4b2aeab1349ae86668907a2de8b2686eeb162173f73741b39a846984871c237e805058fc031b3a52aec14a1246c13113c5061235260743c70651e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9512.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9572.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit