423534090215d011e0a23286c3041bf6de3768d4e7841f82672e9664cd9c8be3

Analysis

max time kernel
134s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

8303b3a19888f41062a614cd95b2e2d2
SHA1

a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256

9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512

281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
SSDEEP

24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

IEXPLORE.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000084940fcba39c3ec36c55deccc34d3860c4bdacffec13f440ce00913bc50213ef000000000e8000000002000020000000a0f2b111f73d1b02ce06634837d05bb6116efd62ceea65a7defacc93c18ab3b62000000092c903ed70d83e0ede4142a68d76450acfb8d7ca5055cf0b59ff740227423e764000000099a6c308b9caa60de165cb57cefb08d0145f82af89cef5128d39908d31cc4d087830b221fb404dbf2313ff5edea3461941c8fd60acec5c5eb74065b09a173039	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000003b783d11fe383e6f5e1b8c487247d0081310eecbaeeccd9b77354f87e0195d000000000e800000000200002000000038497c93b41f85c00a309dc2f2adb797d2a66f2414ba8110cadfc2145548281f900000000708dc2a32bb1d469fb310da8ba0d537e3c0cbbfd9669f39cc0578dba7030ba4176abf603066a0acc951b795330722673bb9346759c8c03b7451af2d347d8d43bff0c70e2853f16ae5d3995c63d8a2ab3c1760ad79dc918b1659f1cf6a781d593c53ca9d95c6172406ed4d737eed47c64b796ce175c2bd325e268fbedb88eb1937a57f0cfadf0198977b3e60541927284000000005a18136726f030d5bd27ed783f3936709a99067e4e4747d6fde5f67944f2bcecd6857270f635648a024f9e903295cda455076c997200ef7a6bbd1a209497285	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438219649"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10666e30d83adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B4CB3A1-A6CB-11EF-999E-E67A421F41DB} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2436 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2436 iexplore.exe
2436 iexplore.exe
2776 IEXPLORE.EXE
2776 IEXPLORE.EXE
2776 IEXPLORE.EXE
2776 IEXPLORE.EXE

pid	process
2436	iexplore.exe

pid	process
2436	iexplore.exe
2436	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2436 wrote to memory of 2776	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2776	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2776	2436	iexplore.exe	IEXPLORE.EXE
PID 2436 wrote to memory of 2776	2436	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8157b53257bdd060d143b972e06bcb8b

SHA1
e5ece0d96ad1f677f20d60c493c757090eb687e2

SHA256
c80c2479bc96dac46130db0ab95b4bb720bfbb6fed427246370c8a3aef650442

SHA512
bf38575d410186dadc5891b7c44f611296e13add237c742e46aa07962cb67222df90a7912ded307d65138d33302836d556ea8812240882e46cb995b4963dec26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e213a6b077542d67534c295a3bb9cea

SHA1
535edc144256e7236d7179bd0334b80d96fe5a8f

SHA256
a414e8c83a94238a6f6fca64f6423df63656476051a99a90c989e313c445b23e

SHA512
2bd3bde9460d182d12ccdcd0d75b2fd428972bdbac470eb7472cce72b2f09e03b42f25247880880e0d85f81972613d0c8f0145496f0de67410d434041533a1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7a674d4e0f260a02fd507def31474ab

SHA1
7f49bfc185ccfc824433f49a358a5c3218371ffd

SHA256
8a6462da37b583924aa14a08dbfe669e042b9ea876cedba28ea1efdf5342f804

SHA512
6bfa4ba8cf262d3a0131cfa4f23e22db23300142a875018f22ac2ffc50c44901879cc2060c1362e258e5a81e8c3c174d292e72d1a5e5553ee857fecf1488efeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
299c4a24e4d56b34f043af54571a32a6

SHA1
3cc0b4cfea36259cb283f065272bdc7ad047c1d8

SHA256
e1d39b9b194c48864585c402193e44ea092e8c256606088d1e10516a74605184

SHA512
03cbfbc2acab88eb6811ab63d2c16ad0ff44f5e3e6f542c8b666393e65910dd6d3bd1b3ee960123418c845232419871b22433d62d9e6ddc4c1e31706d35aa277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cbba5b953cd79ca241f9a9e58c1e877

SHA1
ff27dcf77f8c3beb009e2649441c45ef3007df0b

SHA256
dce3cc85e4693519099d337c87772d85427deedbc173a4601ff7610d51bf6d8e

SHA512
d2809cbf3609bb28cea7b177e8b265fa43c26d2baceb9509c74ed71eae486f6ca9421e682c3908652dc03e72ced9152b74236cf4550cc6075150795775e5bfb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eefba6446341865cc2f3f9dedffaf9f

SHA1
748bfa251d7484ddc2e4c559d0bfceac0ce90aa4

SHA256
9a4026628c011d632806a1ee3d93e311c531c8cc99f9d7a63e2a02c301f3006c

SHA512
134c3764839a6ce09b1ab42824a6cd3d42aed92938cbd3d57bb9109b08447577b4e8ed1c99f1df3dca7bcadce64e80db8cb05e4a2b93fa5e7ea68892f8df93af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e3c8f1f2904dbe99bef07e7250af00b

SHA1
333faae248eb90ec3957358684b3287ad384caa7

SHA256
d11b9d1b17dcb80457dd3b262700c718e8dc90df9679043e1bfafec1583727c1

SHA512
b0b39f94878eafc51f222b17bf42d65b6037807a0cd69deb436f52da02516df633cf987910e0d517dd9d4988e66ab0732f1745e342af5dc9c12b3f36e4b5374d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323fa873d04c2e22eec7fcb792259015

SHA1
4e5e045a6b44d1672e9c6df1a8b8b86fba1b64cf

SHA256
63855968c686a705ab465a658386d09f229a9a751d37e9e33d2cb5c80f6cfe7b

SHA512
115c9e0d0a78109b3fe9aa8d66e7de3e530e34874a475170ebc4d5b12b0bc327e1bdb38b32dce6a8ad9fc9331fee234e3a84f79c37e0a3c30f101adad3c3b43b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72eeb4357a3422b0684af4e3a725be8a

SHA1
26f1da0fdc9ea04e702c520ba0b7848b862123dc

SHA256
a326a24127441cab022cb5de3577fa8e8d5712ab6513da87e0fd2f8fff6eddc4

SHA512
08a76aadbff60e13429c6e49294ca54fcc27c918e2a8678de19e22305f8a48424222e45036aaae60cb5e05aa574bd496c4fc50922ee88491c88768e2a1ac79c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53832e8d8eff5326c3c68f11f3797de7

SHA1
3fce1ef87ed0847589dce18ecad9ac8a32ccecca

SHA256
9e4d2439c4d230bfdfe32cd9d216a33240b79ecf0dfb3a7b18cb4582298061f0

SHA512
b80c4584faee3dacdee484f859daeefe71cbe0a33f677b441c1384226bd04d0427b7d00d82583aec7e018008f4ce7b63f3a64234c9ad7d2af06ad45170daae8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22bec1b357c12e0af366372a17f7a505

SHA1
a25403ecffab5f10c0b3807470dffc68436803eb

SHA256
35e3b4ebfcd15e31cab74d2c20431e5483ccd4578cbec9edd9b627f201d5dd15

SHA512
fcd2d9603e8a08a77b1fa6018c9494a818c7057ea692e664552be16951560e58d22e4debc6fdd925885d430bdb7a396ed35b2bbbe4bb05103baf3509871e5b85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab26A5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar287D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit