c1bcbc47df990fdd6df4a22821921020c7a10a4288a5a8bb5a5b167289b80ee8

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-09-2024 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

f017c462d59fd22271a2c5e7f38327f9
SHA1

7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
SHA256

40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
SHA512

72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
SSDEEP

24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000af13937d4ebbd40ca1ec4da425ab0e59a004c48a7b37731994dfffdf7a0db6d4000000000e80000000020000200000003acebe9b4b551868202bd1062acaa7834c0ab4d29c6693b9089aa0ca183526fc90000000a1f35782d6bfdae3f47a25995412d0a28b61fa599d3eecd03026d77a3d9affe00a374516d5f236472ddb8cb7dd0647936378178872838c0a659ae6a61c4de7dd996844c8feaf0e0f0fb26a795bc2ca8b20e332f472e083752c219f6e349ec05884e7941e169ca60f0ba1e232eb81c1547b4c830b56d8bc02749225c2ae7e904ab8b9b250e2d09415790459340b1cf25c40000000d0be8178b18ef346dd89a215b5e6a01cfb54e6f9ebd62fd6c275495b3cb66753e03a3bc6b369b7e94b3c36635db6e65b102e2bed41640ade19258b482b54b014	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a6994379f2ae664906ad37f0ab6d262b1f68b1b1faf59dbd892e1e374e2ee58f000000000e800000000200002000000013e74d1ec05def3d4af4d1b97e789e2d5f5c0d8f4e5e62f8be42525fb44f4aee20000000fe37ed270f39426520dd6d889675a370c420066b7171ede1d2ef46776f73313c4000000026a817dd5f28f25da5220ea403b4fdd2729fb5ba61da04e051ffb5f53bee14c7eb19b796414429620c568f85bd49c2c54a541f7979d51a66206acabc6b2cd4de	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{686502A1-7592-11EF-9733-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b057303d9f09db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432807584"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 3044	2340	iexplore.exe	30
PID 2340 wrote to memory of 3044	2340	iexplore.exe	30
PID 2340 wrote to memory of 3044	2340	iexplore.exe	30
PID 2340 wrote to memory of 3044	2340	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b56f1fb54fcf917982a4e34c763e6e

SHA1
d2752951122989c81f9a1489e6ea3f7474c05694

SHA256
7d67d162b5ba435b83d474ed47a2dc5ef35896674729198efb8178314afe1cb0

SHA512
6fbb5fa9a188d0da0e10968781241757bd049b267557592ed565ac809421e51a908e9efd38b899fe1f535240ac54753c9b9c5cc47025b481b1e9af1c7f6b7865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a417f29589ae08179a574b17c198da24

SHA1
7f0c208fbf24112d24c3b6b3ee4525a7d2384a34

SHA256
3d7487a58c0674853797ab2165d3cd932e6c3a6296326186c57c21eac2498bbf

SHA512
b4a8fc398795f271b14f81996dd77c159a358aca3841d35b533893570de05af80f72334e5a6ddf1e73826abc3f4c70e0ea6c9a68e4d411e5a803e94b44cab8c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
451ff05a995d3f09896a9e5fff0961c9

SHA1
7a29d8b05da07c4bacd3431f631a31b210a09f27

SHA256
970e7907edd7d4d2d78b572d786009796a3eaa181c08f83923e4dbde32a681bf

SHA512
039e592da5d7d70ef438dbddeaf119de19517ac954acb545d876472317c0f0ef164b1c16c899bae076d181be6af0127600cf6fe9542298444792503e9f3f25d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f55763ff00e5ad1c0031e91e25c31856

SHA1
1f34c3ac7267ffbbad69862738c81dda66d1d644

SHA256
68d3644ec9d380dd9c8fb5bba79f9e10d14da1729b9a7ff6b3fb0e686c96ff22

SHA512
c9950db3ce417c325217417eda1d19e64caa7bc20f60fd2f04dd68c508e8fbaca8285b1d0c7ac14234b0e55f9c7f4010ccba53051d7e4eb1ca3d75460d809b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfceba30db0e2bece043be00ef3089e7

SHA1
b11abfd3011567fe7a99a7b0025d5af9be55e37a

SHA256
c0add8b993bde1a3e4fbb8cde8ef14f34a5cd449549735217cef9b2c811de02a

SHA512
2924b5153bdbdf59883605b0614977ab66bbf5687964b1ae0ee576558839a3fd0eb4edde0e229e38de55133bc314c2d1f6f308e4fe1ea846d0bae1d76673e22a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73480cc1ee084a9011a2a95e39b3de19

SHA1
65ba47b80e80f74eea72b48e65c713fd0eeb7483

SHA256
59a1064d1ae62311563588a6e8ef6ff1ff86f836cc94d13e4c9dca32848eccc5

SHA512
9cb67ffe64986e9f87e0ec7ac3c9417e8e3c3147f40a430338262887388290cab8e8ff71ae659bbd69946feb8576a0652ce648e634dcde9e67ff53c49ee67a95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47190fc458f67b637119dd3404bccb0a

SHA1
ae6e95856bfe8b81945fda5556eb57c73924acd6

SHA256
101606f6910895161397b01516812e697883b6a8a98a279ed3f4f275513c9add

SHA512
02f1fb3529172f1eab6cc13b16d9f50209dc50c293aeafcf9211d87df0b574f37aa8ce79a1f40101aefd0cd3028538b3181731ee73f3f5a0a3fd60bf8781b03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8db843a910c127c9209d2bc2618497f3

SHA1
1f8ffbbc5c358808fb4da38d202ee6a3d3af162b

SHA256
16f70dd9f427ffa79375ac0dc0ad37d067314c877217cb68615de6aad8c2f4d9

SHA512
648ee8a7473b913abccf90c3c3f97780d58f79236f7b30b5a110a58eef36a9adedd78d1171fa96baac3947f4f5f8d847a066e06d3cdc66aaaab6c7f7ac215dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC18D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC3B3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit