87da38c9d074d01908ba1629bfc4fd2473664a89e2d300ed5c9825b30efa5580

Analysis

max time kernel
139s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSE.html
Size

6.3MB
MD5

6e638956244aaded2c92b77f9d421a81
SHA1

f5269556b6fe04cfca5a1da21af718641708a666
SHA256

652457f1b5ec60a81c8aff095366bcc068402c21eb380ba8286366bc4e9a029e
SHA512

f0e173761a6acd13b6c1b5eb896c361487a770a54f1842ffaa80c8ff780b37a1e801169786776c4afa7d9c75cd968dbaddabff082de55cf75cc4f9d871d08bc1
SSDEEP

24576:nPVZ5W5WS95zHIlGMmfu626s6W6a6q5AHOeQDph:SMn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435150592"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000004bf405ea1b9285814d94bfc1db1bc6047bb2f677e9484da09c17c5735d732a0c000000000e8000000002000020000000a6baf4e398b23508716c005d1574638f5cd234c905a0af0293c89c19b534baf8200000008b268124f6b0bf978fc1b04358e6d24bbbc2af9eeee0913834e3be97d268660040000000086c1e7777e78ec8e04aa93dab6122bf5c585730c39d2ee61226816fa81f2ee44f1f9d024d00329aeed8b990b27f8db488b3ec75264342e82ed02824ff17b807	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000009443a427b8dc5f412ca8821d9a69dea1235da9cb4296ca986c339f86ca07ef67000000000e8000000002000020000000d9e0a67b334ed65eaad5d345efc7f3a4bc8c573c457580a7310d98ce569f488f9000000053d48a584c49ac205bfb9c43342324db9c438252c97a277e362c46bfb037d20fb369ffa0f388dfab850082dddbd44792dcbf5f59bd236c89b6a069d0808ca10020adeafb5bab228defbebf743c0df50b1b8fbe160f4a8e811aa9c9f30f34bdc97d453d055cf0d5493e63e1883fc215b4ba1ddcdc2c3eda8fe073c70a8d614eb4cced0e621b4d4ca4cac9f3642bf36c9740000000b2d438d772d425bf17f04e41e1da88b8744f2a4e0c15c738c0a603e9a97331805b7254448bbfd841d9d92c7dd3e4e6aef554d773713ae59da725d47236d9f58c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b31b79ee1edb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4519761-8AE1-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2668	2736	iexplore.exe	31
PID 2736 wrote to memory of 2668	2736	iexplore.exe	31
PID 2736 wrote to memory of 2668	2736	iexplore.exe	31
PID 2736 wrote to memory of 2668	2736	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSE.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa9538fee5bc7909adf36d0172ce6133

SHA1
1fa685c17016fb6301da3268781c5b58abbb0175

SHA256
929e6f886b708511a093328b973273f5391b035a049922411bd23360c060af72

SHA512
0e4f13b32e89b949d39ce6e4aea493c19c539f0af84053ab517bc5ed6ce0829938dbfa868c0eaed61f0e125e9b1397973a06972e1e311aaca0ceeb2d5d4ae6cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11af4dcf3c728dea6d27a2a2cd047834

SHA1
c3c6fd4b20e7c8c375ce3e8f69b4d6a0f63a3416

SHA256
5d0f5c9b7cab42950e12c1711cc16d8b71eeafc900b2f86f820b68577d10cf67

SHA512
18da686eef177f5776d3657037a1f505cbefbb00fd8ac211c7d107b6bfb73147d497df1de39b4b2464ff8b558ef486aad4c1e874b984397343ae6b02cea530e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92efde6b998c87a5d48d100ae4800881

SHA1
63bb61ef9bb06ffbbaa76a0935740a1a125a7b4e

SHA256
af580e40118af94ef33599def77ddef1beee3cc5ff31490d4fd397dcb8bbafda

SHA512
a61905d62fb813580617e502bea280ec43efe5fcdb84983be7af112093f75c219f2fb0ec46799467feb8b005b2b127c87d1ee2a34d21393af45d66f07fe310a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4e59e02b630f408b7c762e89690d448

SHA1
513868e8b22d0d854fd876f7e52f8b2d5a14a61c

SHA256
bb34ba22bc65a20cc782584dd9f61e7f584c20b3f4d516585ca18fae8e338180

SHA512
de84a77632d65573a09601106341337f67358afdc7c45c0edcf3417aa0d8a94e9d240607c090f9be733f9147c9e83af44c895494854459b6bd45f494826ab451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ff30d22f78ec8afc18b45ae9c6d4a5

SHA1
bc90fbeb22eba57f0f359173a14cfeea1452a3f0

SHA256
a48979e0f5a7efc5773a5a0675cf7dc1e0e53e0014fbea7d3f687fa647de24a6

SHA512
0a7f9ad390c8dc1e56d95cf0c70fb4376f4f23be5f8a74e871cc51e00f2eb09e14df684dd743b59de2e7f4c265e4bd3baf4f14ae8328144322fe6f67a15c592d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48154c8fbd2811de6a503371c1a96af9

SHA1
7e63dc53d06e3491de8ec5ff1c83745c2be529d8

SHA256
3b7e52e544a6834c1e347892ca6d8d00a8ca62f059942578d4dc19bb52b6e1f7

SHA512
6ef2f1b6e8724538dd59665dca24641dccf4c56b06d4f6deb8872a19e77001dfb202a9b13a2f28c8882d2a3fcaa3737a2850ba9fe097a4dcc4a63d71728e4f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6faeb70f6b52a3f8e9648a559c9402

SHA1
bbb3284a3706fd5b99b7e8538b9a29ef57d35612

SHA256
22f218fc5a0b705f85b5e07f5c625a63fc6831dcd345ad28c77ef6d35ea247ab

SHA512
d41ec42464e16fbe7d7a4aecdf1a23747617bccf1d0ce95c23bebfdee7550cdd563508f546ed6a9452b6425a3363d4e656d8ab5a8350eab4056ce98ef00197e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce2875a4ae682598d7b8302be7ff8f0

SHA1
5b855e1aae321a1b89c9211d198de7d4f8533eba

SHA256
95ba8c3f1510fdcfc654d494137fbe62df36f57c665f09b59c00abd82611417e

SHA512
ad9b8544ceb49c7ba813c97e41d487870c2ab051f5cb926f692616315cc86a706f5bebaaa563813ff9da56d9bbe6305e9e077be2ffbcdc41d2af935c3f71e771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e1d60c2338059a4946b447911dd7b0

SHA1
c09b8cef7ee9fb02734e0fb746294f3f3402d812

SHA256
49070b5d94d047ddf228c360c62952ba61e3439d87d9e776c1a3d4b72b8932fb

SHA512
e750a2dfd6c8a559ecd25ebfc60f69de3273e19af78a490483d2fb24d0d4a989d44895c9f1ad6cb7c3e57468fac6ee6fbac19c9215d93915f237ed12c6cb340b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf66060964b938df45c5c103581619b

SHA1
5d21713a0612d7b615422014bfb5e1dfa135e0a4

SHA256
4bc59bcb4d675affd3f0413154bd5753097e45fb2ee8b99e43c9cadebabeb893

SHA512
e2c41462245f0edd59a9219afcc05f3e93a0ce16dbec93deeaf50ea9cbb6278e3fb01c69b3820ea63b28df66f9bb09644a47a40ae22ac1831c188803ef4ecdd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72eb4d9db8376812ef8d01033a33ab63

SHA1
6b2689b2887466997cdf3f67475989f267472773

SHA256
5bd503c525e101c69b28819c395afc4c742669f07741388179b80a1b6d3b650b

SHA512
87e504073c486838059796f078ad2cd62ca3b9e835ca0305333d1fa9835368f53cac830142809de772ed4b3929500e89cdd87d8bf4b8681f6a6e9c1633e7507d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db7fd1cb3b186866710b0fc239efef9e

SHA1
b0ae0467982a0859d70e1a5e0b312653ce888191

SHA256
54bbe0be6e54c98d709511efaa30973fbe80e04fb20a662356f0bbb5a9f854d3

SHA512
eb1398f56d81ab8bbccbfe84d9c640a13f48b1ed63692ae7886ea3b6875d9989e23057dd32e8856587e5a2c91d956e98b93a7efc14fc9d1e69cca1846a63617b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec8a6d74e1e0b538cbe700e18aeecbe

SHA1
2ff3076dbe2bf3ed1dc07ce72438d543f75d4e3b

SHA256
c7c3ab5f2706326865e95910055015af64fd6d1b8e518e81076223e4220e97dc

SHA512
6c84f2ea32c38d84909d3364a97dd51e4d66e18e11970f7b9798d01a0e9fe8cda93ae1a45d6681257b9a930d827b310c1275a1b48ef5ec6b1ac6c5b3707a70aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29a1355067f771c1fb8032c808a9b7ff

SHA1
df1d44796ac278eafdc1f59d619db9b85ca75572

SHA256
06f47e3271c3525d345c8ad7ce3995806dc5a32beea1187867352f68c35563ed

SHA512
ff66009e8564d77485d7ed91bdb3eb1de5760b0a4a5502a9eb60b657c5b38f690fc62fc86b704781db1765a15bd4a13636e385483155ba0f6f94b5d1cee12e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2be0b91cfca94c13508059024538860

SHA1
ffb039e6b11f1078549895c46d52b8b0e39f97f5

SHA256
eec30d601e5da850297a6b1ba0ff8a66818844fc95839a4ab9d86530a6dcbeb3

SHA512
0b9624e5ef149b3eeece50acccc3fc3e9936ae9918b8ef5301be165e7c309999ffb6424d11a16baf42f94e580b169668810868ffd268123d99204faaf975308c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f83693d17c1fd0c599e20f6d835f87e4

SHA1
e4d6e8a204cf1334c96a4a8aa5325e83a5237f4a

SHA256
ca50a6de691a1b1d35b7490f9958f6d6b348201f3a74d0e068e49ba2bf8be8cc

SHA512
648446c70e2540e3a858cc96ae0ce5fb4615963a34606bd4d50565c7433eff73f361833efb74a200db946e781020d94d1436147be498999aa757809c5b402ad8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabADD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit