0afab4b26c198530fcaba9dfa5ee813ea3afc3427cb7cef62e3fb624538bf894

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-11-2024 21:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

8303b3a19888f41062a614cd95b2e2d2
SHA1

a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256

9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512

281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
SSDEEP

24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5002c87c1436db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b13190000000002000000000010660000000100002000000057bb7a3c19fc5cfad5709257146509b2c45d31bf0e093f346f8363b009d1c192000000000e800000000200002000000006713e4482823dc07a7b082cc8bdaaf8f72ce17a1592a34eb312632ca07173df90000000e6401e3fbc92d6f8d0ecbb09fcbe385e35edf8cff4e0d53a121c20a5250f15f6a2ffa5631420b6b91bbd425807f4f2d9b4e4530acd53663a740dc1178df13cb1932b7feb99a571e5f59ff784b9ef20e00b49be7acc079157ff3319f3c056e85dad5676b7996935216510554f5bb71e6cca57c53e4bc8c824ad2f85362f3f7bcd6b3a2bff003929ab079b03d5f2de6b3140000000a0e6a7cade2263df85e4e59f09afe36883b952deae764a92754eeb85c3f4c30826b1484107b76ba544953678d88749a3b5a7233efff84d1ddda0654172e9d062	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437695789"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6104E61-A207-11EF-BE2D-CA3CF52169FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000f80bc74f98b1d4c18adbe754fc3c4f5f22798a1bd08978f23e5c3050d70cdf58000000000e8000000002000020000000090d9084172f3f296c1c4e379706401d474c2b1484ef3a7f0a8b0ee9769278b120000000fad6fe0f3689bb072fdf69b8c8f1d22f8fc0b6471aadde411fd83dd83a90f0d040000000e434274e1e8065628c68b6fe0878b72722100e56793c0a424db4a3381d73c80b7fa859495278028c282bb1d022fcbb65c18f7ceee4a04ea2683cdd23cd44fbd2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2816	2444	iexplore.exe	30
PID 2444 wrote to memory of 2816	2444	iexplore.exe	30
PID 2444 wrote to memory of 2816	2444	iexplore.exe	30
PID 2444 wrote to memory of 2816	2444	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6276f23c9fbe0f1866f5626484d3327d

SHA1
9d96a33304eba6aa0a9036ef4e44bb6e17281893

SHA256
75c0e84da83350bb38fc414e5c147c267b424c353923324699f1a91326b44bfe

SHA512
74359b40004f5936f55b71f76d34180ce0f361a0fa770a4481db8d4d344ea6293e94061c9fb5c9218cb91e4194ceb779b38c1b90b38d23e1b213105dc2128ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a47649b3f58e70a0e0ddd2c900738c78

SHA1
d9f4926dafecdd7347f6df6bb6295a58c1f97690

SHA256
272231083f52c17ab0f609248fb82374b66b06b2d74c66ef4d6cb55439e971c9

SHA512
c2b757c3f7c614e27990fcc96c8ab90548e68c25fdb5770db7821fa5a1ce50c23a902697b0fef6a67a69fcf31b6f5d2106ff514693f0beb408d995e7d0dce600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbdab5799cc2adbc0ac3c0156c2304d3

SHA1
25e6f9769843ab55d17d18694f743c476c907f96

SHA256
8150d92049835dc5cf4b2a791bd0d0af106223ff0aacb536f803902ece522528

SHA512
c886e447fff0ed86a61ab3f0bb42ce7c57656c8fe339b790286d43b8ccca8f48851715783191f3fa334556681ceafe8c5cc471db254b9b62599624bf352ce866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a282874754d03966575ae7fcc681c033

SHA1
bcdb32c04ba809b4c37224e0fa6a7cdc4d21ef58

SHA256
e8283a178208c5be45b856b9870bbb883df8953d728ceb3d2ad8f6ec26af5f1c

SHA512
e1a175f6c9090886f5e91d749423e2ed758bdc6c0e58a70e40dadea3da72bdb5f1ea265691250c690ee69f4a968bf681c587f88572b403b2d372cbe6b1a16ead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6990205676c967d5f6d1ca49cefa40a

SHA1
7b6153293a4731d8188e768b2b5d59436a197e3d

SHA256
65f983f94edf8b6a9a073f023ff0611736c0824ceb00603fa8e1fef46b0ac120

SHA512
a8c52bc3a908e2df5be4d34adbe3b101dd19617109ba2b3487d94b085c5d2c88e8c152607ad98c71675438d12979694947e39085219c519af53b21e5c6227971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3807d081a29ef40ce1d55e5654f739ec

SHA1
a9270c89d00e30713f2d74146ed31e402d224ae4

SHA256
eb442d533d6b1bcc18e1e83c87ef334ed3e4a9be2f5e29505e72abfd5a9fd037

SHA512
1b84fcdb68604ec2c99b659bd27fb873642a09ea9faed02a527dfab530d9c9dedc47712f2fd96d760e5b28424e200122a905c5920233adffdd3b3dd06290891c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71eae0b6112cbf4935ee61a8fcc65ba0

SHA1
6226b159cdb7057d6911503aeccc1171e98df968

SHA256
876f11aa3d0753c2f69de99af35b90bb62c15687ed1f4cfa4d3879fd28ba6513

SHA512
18882ff82f2dda8ba6d0a26cddfea426b4ca8a3fdbe0c9b71f97e9cde77e58719bf2fa3c7309f69a25761506d5f3c9ab98dba84e64731533b7802bf3f2cedaee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1667be2ff39c4ec92628e63b1858ebf7

SHA1
d475aa50b7d0f1c0cb62e3b6928b025e0f064cf9

SHA256
73ecaf8bbdc56a67fae390c255f58ab23801c8958a7b2cdbdab92c3b805e367d

SHA512
9a590d36c14bb1e507729c4817191ba6961a23e1fb3c5156682decbfb73111ee60b5d4679d0ab210efe25a914ab48a2b76a1db2cac409a550f94f85bd2a0d2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc8c240053f75931b077fe9321e037cb

SHA1
5f1ca20a065f0ae465fe5afc33df75af8fc30100

SHA256
b8ee0a1502d6bced62b384829aca72a87778e18a9b916ce1aa8de89c373eb86d

SHA512
92dff70ab7a5ea4b7b52264cd955c8be675064c4d235997e0b7fffc4ea83fb5e4feb56a432cb4dc78a321f6f022d27a5a52456e75a71092642a33d1aae0ebae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ac9b3916569fc579080b8bcf61dd52

SHA1
2d188ddf89a58dd669f58a769b591cec779a7a7f

SHA256
0418a351778180011f30ea97dcd72a624f5cfca7a230cd7c7eccc5583b4f3045

SHA512
14a56caa4991b5fd36d69b8766f29995a56ffab2ee4defecbe4948085ed699cfe087836267cf853611845e24a97bff931022e768c2138d7bb6d0db3d6d60d124

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49954bc8ac869cf56fdea04ea71823ab

SHA1
15ef728cd9c5748baba4900cf48601171db2a978

SHA256
991c13fa205c1cafc4f5fa66cc3075e3b7c3548928327a53b6beee5392f37e0e

SHA512
7eef6b3d28bcbdb0ad409ea4bace5269623d4843a10f9ea2f1667b5ddf3bb97ec5bdeda37a1486958e8a83a0812558b0daa33b904224fa6137c5faca2c640f17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7a7bdce63d38389feb8fb2121b069ba

SHA1
5b5282ab60996b5caa362c9d87dc2b2505f8691b

SHA256
3be3acfefe39c278805137b6b3b583ac3d1b48d60740b287c4c25e68dc255e98

SHA512
7194a603fa1528fd938c883a5e0b24a0a8edd81906f770f364e1072e8b99e4fce57288a96cd619d219c649d65785a93d43a93bc56f7f4f72130b59e38c64e61a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3bfd262ae7cc2b4de98a7bc69ae6973

SHA1
76fdd3b528867a1bf520be30aa9182f14ec751a5

SHA256
37906b7121c36b56b49c7141e4bb51bbd46a462cf4e9738f8c381750f15b47f9

SHA512
210064ddb410356140f0c28ade4df3c5286c963f4c83f977af2b45c9e391bf24a4cfc2da3de613f8e6e996ad6b46b1644fb6d658b3480ab7e660cc8f7297c6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9243.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9341.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit