d084d509baf552391d065bc19bff16b49a8f371f9dc49480516fecf2e7e1c279

Resubmissions

04-10-2024 13:28

241004-qqpb5s1akh 7

03-10-2024 22:49

01-10-2024 17:12

10-09-2024 12:08

10-09-2024 12:07

05-09-2024 12:10

04-09-2024 23:57

Analysis

max time kernel
1802s
max time network
1820s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

aaea51a605688fcb2f178fd60e4ca64c
SHA1

69d4791bf3cfedb68bc4d8f766878103578171cb
SHA256

96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
SHA512

d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
SSDEEP

24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2237591-8018-11EF-B6CD-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000005452c3672c6c48e371c801fce92f0b2699bc8da388412ce00d46202b48c7143d000000000e8000000002000020000000b4c08b8d5e888bcb532a257101dc69b97205835ca1049c33e375b28fd5571bce20000000c703ce2f7036f97293b8107ea38418588b06c0c0a343e3f1dca6f04af832e8e7400000003d735cd32a587b074145b753f6e6a0b3df865c7df4a377eb58767e08a5e4f84d6e13c65a33b18e137b011283878abaf61f2adff933d28cdfdb1d535ea8b80d21	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b0c4767c3cb54540d387e3d04bbc91bcd5d4fd2c59033a42c1dbf6792efc9152000000000e80000000020000200000005b82c95b85e1f019fb9e72dad869f7eb4d2d27b1d24a2ae8b409130cf84408c290000000a22cb351c9797628956e0c18dcaedcedacdce20ad732b85b31f62ec1ce4e95b385e4860d34e6c130d56e7d522a7b56efa20ab0434e9215d64c5de8c9c43fcf91ef7480e940d680dbc260cc9f374ad13c2610fba640811524aecf73334118e62df6d1dc5c9bd7ff131bf63cdda7d3fb87a9e045cb76b09b1acf98e6b75dd8ba1daccfebd7b3d16a3bbe5e3f00cd3fe07340000000967b044630e96e3547c1e03443c973429df385d45a7e1443c566f2f5d55a197178267523669f50538bf785231ba8d94ad5d59c051e24e7954bfa3dd19796a599	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e451782514db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433964746"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2732	2232	iexplore.exe	30
PID 2232 wrote to memory of 2732	2232	iexplore.exe	30
PID 2232 wrote to memory of 2732	2232	iexplore.exe	30
PID 2232 wrote to memory of 2732	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baec64d6018ba67204a209c16d758c3b

SHA1
d195765735815ab6b7e2b072885102f480e4b97e

SHA256
7553dec243740b829ec7863561c2a8aecb86a2e165ef425cd8810f95c5b3b2dd

SHA512
4f295262c0d006535c39e05ac51310e9312ed69634b0d70a5c49ecf9563fea4fddd0d0505fd1155af07cb7c24850cbbf51a36a854d6e4616e4828b598bed8eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f880df2e9184a3d12ceeebc3e8fdb0bd

SHA1
d88ce0dab31323774c7b7b91a176e23e379cc3fc

SHA256
ca6c6b562187290478fe8f755547b2dd018222b244bf4b8f8dd88dbf26323ddb

SHA512
e65e883da6f4f684311c14125a729bce1ea7468c0b0f3db4d486e2827499d99db2b4a399fabce3aa9126b0847b8658790ec380d73840ea9aaa74a29ac68f3800

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee5c102394e9d4969f4d36f0eac8ee1

SHA1
836263594d54d4ca39ce76859fbc9eaf10196ce1

SHA256
00324d084d4b7b1e2d1dd586710802c87672e1e6658e4ddf4067f2c29291815a

SHA512
ecf2d82b6af1e1bcaf4a548c74f1717482dfddc2a22431b755ae1a502f7418378bd73fe5f91b69117efc0fe7d115fffa40d743846540e53aff40e51e9cf550bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa8eb7cb8152775a4c01e40746e87c1

SHA1
67a95c199250e7cf0d750473d5925d6638a41358

SHA256
2169f8e7080d06ff4a01014824d9a4ee19d25942e162f342c7a9ba2f4e2ff5b3

SHA512
340ed67e5908c046a56e4e4d1ccac9952456b845b636435f8a5ddebf657cc22f93916de835a9652870d6ce8d00e693c4c878092a5523c0237aa675fed42287ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b642c5c67210777715386473fbe5ad6

SHA1
8002d3bf1a560ed2b94905f7163a0765bd6dba9a

SHA256
f36d663e1766b26c95e3853274573409fe0e2168501589c1aaa99359a82c8b6b

SHA512
d401b5a1c47b3a892b745c3f52d9de038948afe66abfe265f42555024d144059bad54de60ee71b7ef8f6b89aba46a7004f7cafd3c1fd954a6c5334a6a81ae855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ed93a7ae5c324e8c5a04e707332e269

SHA1
1ee23a9eeb8ea3f4c24621c10a8a20387af032d9

SHA256
9825bfcc40dc5130eeeebd024fd3020574b95062701b771cdef24dc34b10502a

SHA512
e353c7acf191b6f6e3aa7b6c4b92e37c8a82c6653fe8e284938189de55a93e0a61ab2aa77d0a47eb302c0e9c2d199f9d0d3851e9a62029b5582ab9e6a2b55786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38911712bbde114c75a823547a5d4e15

SHA1
fa01076ba7b822ad1d242150809d55a849e1e456

SHA256
9858fa2d702c71a045a1a2c4248d408ccc777279d416258c1f7a75181ece49b5

SHA512
2e14f54c887bfae0a0b3f18ebcbce59953940f86d6c04f6c12e4c807acd1d9e14730ebfb46bbc5feaba032e1af6dfd8e8cb1de63e4a8fbb095bc927377fdf2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4be7d238b506070e0f2a16ac8a11bb88

SHA1
75cba45a0eb7e7d4c521233398dab224e4e8f8ec

SHA256
a371ea74642edd9f7ca024d73a870e8d4239fa3f69131ca3a3e820c8da47cda2

SHA512
6db9aef4c5b75be7ed04cdcd7afd88ed620c20f6d6dd625b8fdd4092a0656ac364a31a3f3ba6739a8dfae4b35f88642385f6778bb10eb7821675f0303c97bfc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d8b2284cd8769814d9416a22e513d60

SHA1
6f6670f8f904bedd1da6eaea9ba412efd542d8d8

SHA256
6535ebd08eca672ab86b078e1db3f6a47cc21589559bf3208c1824474f4aeab9

SHA512
e71fad0a7f2116e6a404456685926802368cdc3905f44bc4a81201f9043e531f9416e3f96bf59454e632acc7b47413da556d5be24563595c5b27ec793f1e8946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8528e70eddab78f9972cff6b3f5c6721

SHA1
45a81c6f07c378dc43b19be70fbb9ed019212d22

SHA256
bb80140663ba166604ba741eb4a5cd65d51338fc0dd2a045bc0a61102ff40895

SHA512
bebaca9e28a761286df6c0a67ee546f0e4708c808f2f91ec77c32d35fefc55f361d08bb02c65c925b2b3627b39728597a382099690667f20067067a74060595b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b70df8502500c97b8c9c8b4dd46d2aa

SHA1
dc13909c168ee504549beb2ebf5597d5bbf3d1d2

SHA256
3868c0d8d5ad5ac189775447bc43a0bc13be3390473365a89af56d0b81694ecb

SHA512
bee80d9df429cfce68df194edcde0c0925e368e962b59dba7913b373e45ce9a132cde62dd06124c8da1bcca9a02eacbd745de095d038fe65fde7b1fcbe881e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bcbcf1e1e22b4c10f62ad277430d580

SHA1
06e908c2f258054d8b7f7cb5bcce9ce585a08d05

SHA256
b53d3c2f61f62ef5ab14fe63e852afb0be4e8b039d6620521ae702e57cb89d2b

SHA512
b8de83f35023484e5df66087ba37722d5bf76fdfe520525c138c616c045dc1ec6d8c53d8279b196a7efe1e42fe44ffa61e8e4bb4de9774099f9da2edcc090947

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC776.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC92F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit