3260c1e806429a61577901fcdf070a19d150730fbfc12c626279fd032d1b0d30

Analysis

max time kernel
117s
max time network
156s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

f017c462d59fd22271a2c5e7f38327f9
SHA1

7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
SHA256

40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
SHA512

72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
SSDEEP

24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433128572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000ccbbf17b4343837b0d2b02c09c4a119f41ba1160be48efb85e6e81a60530aee5000000000e8000000002000020000000538fef3681b625468e19352fa44f9ae3be829214e08efd0a00d33dd6e6e83c9c20000000f1d8a65caa3720bac0b63aade70a429bb9d18ac4111e39cc6c6c140e9176792940000000c5bd804396beb1f1f17b5b733b59af8dc1a6686d2704b2bfe48b9b5d12fd3fb0277490aced38fd03f10364bfca52131fb6875843b82e32000bfa563cc4538268	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608191968a0cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C19836B1-787D-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000092123533448e30739bcba1392fae98900219aa61889ec5e969f7c4066b42d275000000000e800000000200002000000063d3f992630a0b88d6cc296025a2ab9152d2ac3639778cf4ecdb27532893d46490000000caf76bad11b9c589a4b1bd2318f392f79339763b7fe2035c5258df19e556eee1c5931b33aa59f44988a8f6a3b08031a2a35fd23651273f1d4dea9c3bdf67c05e7f7e507b396b9288052d4d193bb19b79c10a100170c2bd8b06ea21ad80ff54644b394602c436b7c61b6e4f1366211cd3722cfdd2d398ab0b3d0497a5e70e0a274bb1070b244b29d59afa2d93a0c9c0a740000000d7f5f56c4438f02d8e253468ff3846e898e1f8c52dae88c4a397972136e1dfd0b7c261ed030ca41e24ca856ba3b4e20db8333e6727c385a714d4bfedb20644cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6eb570ccb08a67dac2e75dae7cef70b9

SHA1
f483691fc894b6f718ee60b334694f18c2b77414

SHA256
9e770291de25218e12203b4392f379b540e3c8eba15458c0cdf55aff7e6d2db0

SHA512
1df4b75eff69b929ab0a844c9a95fee1c617a90f7656b9f92891dc4d07d138800860ace2a723b39016a9fc442f82cbe837956ca42e8566a6369f3385c3bc95df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a6c020d2bdd73ca1097446988d65fc1

SHA1
59b9993469b00ca287ed1e6e3612f7d2dd07e982

SHA256
9810652b291ead2395d9e5bc4091ac3b81bcbccaf15c2e95cb49ecef87d9ac29

SHA512
6de62e0a04930480878c05799dc26a86da24e7b0dd6a8d8374237fffa68c6b371f33f96d760caf3fc3c18cc95b2dfd3f1ec8d08b468183d2108a3b9b0d6b6b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
090717090912a15aa04715955b320f82

SHA1
0af31a368c25b4533cd8b47a012535d393c4a005

SHA256
b2116e8b1906044d05e372b027d72d982074d3a980b163ef8e7ab3dd63fecd4c

SHA512
d62cb9174d6a17b769ab656458258142c576488c24188f0d9239431bec1aab83576985e8fa5540f229cb6d831f4bb0d954e4d856df049536216f02f022a3e0a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
626e8d69bcd2ea5427977eb8d65a977f

SHA1
26a65d98e962d9f117e6a5403f0e82d3b52f5af8

SHA256
c061844d90e3da7aafdfddfea82c5cd356886ae393f8ac71dcc6ac4b780cc573

SHA512
77cb0445a2be968f4742ed9c5ea33b613fcce046a0b8374dd2375fd4b1f5ff9f7346737fc350d98b05bd7749bbacdafcafeda635b706c1920e3cb2b3921a8be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9562fb99ee5d49db0a8701b6b96ef482

SHA1
e6ef5fd5d71d819a9fa98dc3b49e5891ca1a4aa4

SHA256
ed68a3caaa4f5027faa9b2db176b60852dcbcde123d73daaf9999c6b0aada85b

SHA512
c83f88f9a9aa501b73817542e5210c00ab7b3a89b5ebfecb6002604f81ebe07bf3a707c16df8225bc05424ea1126285a73acd325d13b29f73a05e05a7da7afdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1499787dd45cfb7c5d4a36789155cb22

SHA1
f3ef2838fdbd655ccc2802531dcec35cef83e68a

SHA256
aa3e62ab25fc58574075f8cbc74990ffe3f158701cdc3a20688b289ac2d75322

SHA512
a4501217267b1d4d5fd6e60633d6dc6fe2f37414b659051e9c2603cb4b4538907f0879b6fe620bd14359c1ec5b88d98f984d0cec6bebfe8b5bcf5d2fcd42bdce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
914ca7abeaf9f9a0886c1a597724c011

SHA1
c115fb0e5bdeba9655cec275e151543bdbe5bd53

SHA256
5e79501d7094d33c386807d71105ca460c15ec88798ac99cda814ed5ce8b8687

SHA512
078e0540511919485c336e1ea1e04ff9349c37039033949810ad277422451efc2dcd642217a9afaaa1a06f8191ba7c77ef8117a4e290a4a1d9860ab5a534b470

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb19448337f5acfacedb65fb4e0eb806

SHA1
e810fa34ebd5a20c6ca8f9229f20b6c935425a7b

SHA256
932665223de861422b5e734ae0b9091c9ad1e307ae773772ab6c41dfffa0e99b

SHA512
31fee340b538cecf04a61bf6a4fe813aa56d4c19745b0ee72bf3abc9b2b32826833442e675f2c96b291cc7f72f3a1779c6c931b581c57f458eee2c5497d01b50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f7c47fca712e4965604b85dc8d9f2e

SHA1
9c25b8a15148fdd18873cf06ba8f5d9c7d8ac91f

SHA256
af5284128f9fce738f66ff7751d9f4a76af33a9586e311c8d0319b34123617b3

SHA512
4fde288bd2ca0adf2decf8c82a5a565e0ee6239f0ad01928fecb3df3aa885e5c079012080dc207c118160ca79aff28e0acaed2ef01039803426ba8a41fac0aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab32A6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3356.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit