ea881853f35b6971f49332c5d66e7388b8598e5ac5a0bca24826bc08f22bd4c9

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

f017c462d59fd22271a2c5e7f38327f9
SHA1

7e1bbeea6ac2599bd0f08877aa5811d32f1aceb9
SHA256

40f314c778851106918aae749d75b2d913984327602a1bfb7ef0cc6443ff2a37
SHA512

72177281486f6ec26ccc743b43481c31470c7dd53f17b0a67ac087dded190c2e3dde5570260150c2e9650186a515740af7f81e31965c95bb762340f9ac100c07
SSDEEP

24576:G8QQf6Ox6j1newR6Xe1Vmf86k6T6W6r656+eGj7dOp+:fG6eGd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6430341-8353-11EF-928D-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40652f8b6017db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000001c69b2ee2e15838ceefce4bbd6cacb1706dfb6c4dbd4cc8a04b089e2fb8085fc000000000e80000000020000200000003b65533f9274a6306051753cab3e6cc91ffd018e07cd9c22922d9447c88958199000000072fca4edf6f7ab304ab227ae72f93bf936f5c9794b8fb244f3b57528bf1d8e53bc4bde78367357570dfc26951041e879f29344c390417d1cb6238d7622dcda016bc4b2bf0388f863297f0a914d4c3b1fd9af1e27347a4a82fada64f8189bccfedd853a97beb2c5e5433440aa4f668b3fb34ecff2cd1e771a0485fe6b8eaad59995bf0ddc8b4b257dc49caf13d069999a40000000870bcd418a52e7d15089c32e682f7891d4e0f0b2ca665ed086654631d4342b4c542007c555929cc405528c9363bcdb1a771dc7ca6479b73fdfd3404990f9545c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434320016"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000095b904b5ee1acb9f31962eda9376d348a76eadb21cbb8f547b4d5f76183015bb000000000e80000000020000200000003eca998e65f465aae1b86325dcec881011d3b78002bd1be00348578055e9619820000000b8353bdd35687e66cfed8bfaeed71faf9ac1e3198c8fa5f191f757a907d49c29400000007aa3f76fdda801d15a7bc358b088a0694d3938172ce130f7edd74d418404eeb40ee2c62bcb5cef50d9aee612a9aa9f41a3ff206d0be3759216c7837060c89a24	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2376	2108	iexplore.exe	31
PID 2108 wrote to memory of 2376	2108	iexplore.exe	31
PID 2108 wrote to memory of 2376	2108	iexplore.exe	31
PID 2108 wrote to memory of 2376	2108	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac9237fccce9ff9f7196e951311c63d

SHA1
c44c43c48300bf17bdd2be0e41898d893e682988

SHA256
d2827d8523e41f9669f5c70d638e553f5e083726a7296c68e6889ddb6a34d78c

SHA512
d12024841791cc9b611593e2b24b1c018d0b31de3a83e23ab2641c54e9b461a07774b078e7da563d35dc62db2e56af12fc536a90f4608085be4554938af82d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
541e28c63991d70632857a88c3e6a96e

SHA1
5b1e9fc16d6cda34c5d84aa4d062f01cee11785b

SHA256
f6ace18c35c0f4672145299340b1ac82100d051242038b48034750352bc78637

SHA512
4ad0116773117771d3c67ca4c2d550b077b74dfa5cfdf6f8b438147a8a0bab473631ddad9c094e5cf2d8534b8cc33ed7d6ff1b64947031827778f47a627fe1a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6baf5382ce0fa69bb028921432794949

SHA1
96a3833c38e4b81d15d187e052969af6a128525f

SHA256
cba461de57d7614f68bec78d498d3f5ad0317d33b04af679480bb23632f841bb

SHA512
ebd2ecd02be5d3f9cc6c2ba2b226bf014afabc69458e8261529cf7689aed59fb7230ad3c5ae2c8775f38aceccf10e66a7dfb9056f05a7ee13eb2b9ca7a113890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85c9d193dac74ff1d40f8fc92d38cb6f

SHA1
43c768fe880edeced20e4176467c256ccc7608ca

SHA256
c0474a599602c92c609e8da7c6579d0b6905d445ba1d76605a593aae8509cf73

SHA512
744b1d6a4e524d0de4e70d434557c8ec075509178ef424761dcbd4ce670a9aa3b8de1d01275ce9628f341aa3431dad47eade8a113d03d92e45f50410fce18c35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
061c7a1dc860c2696403a019c7a20eb1

SHA1
89ff17bbb29959e58db2e0c974198359bb8cab08

SHA256
46f44f26556f9176f24fe64befdcb499fb9d21a89c874a53452f1073e36bb03d

SHA512
b4fc83772d5598029f323b0134a9dc989d3d72e8a283c2ae920400f30581199dc88a0b6d47e0c2bc26584905494d7fbc7b09fb0ebdb1db0e641b7ca49e0a447f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70413da8510819888fb139575337e03e

SHA1
1ad51cc8b94d03dae482a19269d99c9e7dbb6825

SHA256
d69d03aeb091afd07c030371f3319cacc007e2d745c90b65ed5cdaa3a7859616

SHA512
fff1ebb36317d3cc01869869137f57daa8644dc64fdf5e3f1f82ae12171015e2c1edef7959cc1b998520b0cdb27b4599be1a7a01b9ed1a6f27af7adb74650c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dd7a752d49cf9f9e7e208dc255aa332

SHA1
ef2b7d2210e0965a87d75a58ad305a326329825b

SHA256
b612191a8acfcb41f103d325a1f78462e3a5b9ec7a29c2fc5cbbc533aa0ce742

SHA512
da5f7a379876808885795d8da6214867227d1c38459c892007412b5aadca2070a431c43b46f2a5a7bcb8c21f33bef202becf64d9ea1ba50273ebad3628696b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
505494f35ee2e6874424aff9e3363886

SHA1
a59b8f6a79afc202c5ff9d24cb82524cb5c7caed

SHA256
686e00c2a843548bd269015375c300dd21c79581ed485bccb782f806317305ec

SHA512
0f17f1b31918737426e2ba479ea34794acd8823f3c8ce28a83a62742933cf5543a7228947462bce439ec6750f15ef72723eb9014f81277a0b3ec2e3b131304db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63980f3d3515794b200e91c1f218d6d0

SHA1
c59377f6a8c5888b15ab7de06a268b993cd8451a

SHA256
643d7e679085a4e42a7fadb3ad9323f019955a017f5349837c7aef7f4877adac

SHA512
e4292cba0ef3f38a217d5f9ccd05575508e1931a8e6adb66864083b127136137d1bac83af4651e876c6c288723b3a1da5ff6bdb5f933307247155f1d5a5d31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF45E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4F0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit