46c10aa92727ef2b884868b96fd8b080286275c4f901daeecbbe54c4865ba8df

Analysis

max time kernel
72s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-11-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

8303b3a19888f41062a614cd95b2e2d2
SHA1

a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256

9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512

281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179
SSDEEP

24576:dbTq6T06T5kJWSIRWnBIl70mfT76y6E65606F/HXpErpem:t4scj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b1319000000000200000000001066000000010000200000002ea3e18ed0e24071167656cf6a01eb9e8599665443b740b01a2941e8c7d94c1e000000000e8000000002000020000000538d6726a525221a84c2e635f7caa681015858bf71a17cbe84339617887437cb90000000510fe4d1e670b0384b238a02f237c2a792de60eca641b9c91d087ff9320ddabc0a910e8a55723b60a4cb61f7ea5d5a143d1fe42aafc7b1eae359ca1618a40b78ced26f527b03b2a8af12f82b4a218009daf4430889243f36fa319f02b133ad4ada1f1d69f8bb49044647b4238d22700fd1c21ea7a6425d54bf7c0a8b5e7232f7b62e4aecf008fe7292b451619aac2bf4400000009df121e79a1d3ccee0b31b1a18c0fec1edfaa84c6972daef5ffc020e595038caa59a1b3fbaf3d21736e4a462a60c7c0c4594f3fe2beac64f8bcaf7754bdd26a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8024055cc93adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85E6B2F1-A6BC-11EF-A7E1-668826FBEB66} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecf3e4259aa05419b9c0951a15b131900000000020000000000106600000001000020000000013ec281c1b90c908a1acea70e4ab7425bfff2c9e0fabc22171181b89941d274000000000e80000000020000200000001af62d6dcdb0f6eb64f8b7f5343af98beb02fd893cd44e2d8b5443a6e9404e6a2000000097222df51e1190d71e6c0506ebac3bbc40b4d81b0f8efc9afb50702c1d4f95d540000000e1d4c7b3be1f257f738458eba461c5718e854033cd83eb1451e33f5aad8d39bc81227eae35f4dc910b8af337886ec4e90a5ca0d9c08bf7cc5819c87076b57f45	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "438213279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1356	iexplore.exe
1356	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2816	1356	iexplore.exe	29
PID 1356 wrote to memory of 2816	1356	iexplore.exe	29
PID 1356 wrote to memory of 2816	1356	iexplore.exe	29
PID 1356 wrote to memory of 2816	1356	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c6afdf8bf0b02f7583a9a768a97aa8

SHA1
d626568eeaa6c278314f07cb05acf98a07a9af29

SHA256
4c5a0587ead9db0b21e972cd830acdc7e6411f8383da40f680d02b0f75f1388e

SHA512
b19336b1ab02a861776bbf1aac5cf37fbe7e237c9c8ca8e4e4a6e0cb2133ed782aa708eb5f98b52cec2d84e69c1f326c38bba2528f6b88f36496bbc2c92a9aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a8cbb63af7c0ee9b37d3a320390a3eb

SHA1
6dbbb4946b40cff35a6b7dfe9c7dbe9c45642a7d

SHA256
fdeb974af11d82bb425501f80a690f40a8b3137b8e48d68a8bfa19ade108eeca

SHA512
91ee2a3386993ac9fc10c0cd035e6e198862d20467093956b1a25589ede94dfe74f35859391559aa76fbe346624827669db385c6b62df827a94f4e0dce5b94bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f2604a2095c45ab5d6696a46ccfbf6d

SHA1
230764dd7d076f0278d85bc2c1fda6ef9613fcac

SHA256
b3561e623e73f632a33ec4e765bcf4a3f35388c7128c6da7c0270bc3d60bbb36

SHA512
3aac4da0f66617b5a76d7cd215eb7735c07c4264958bec6e0591c4253a6781947eee1c52f066217c8ea8b04e10ab5b062c46c9dcac28dde2ec0e6cf65c598e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dde8c0ec0f73bb5509263714beb6883

SHA1
db3393ba7c727bfc11af69231053e3ac51e8b3fd

SHA256
b5262b24f4dbaa1cf903fee30124eb6e350c589a24b30276484979a922019064

SHA512
fb54f405825441ca56f6e783237e805235e883f0ecdba37edeee0f5f795451bfabe7cc6046f002b36ec363b44f81f4c493cb3d4f4f2f8dfab40485b8862d543c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0beb76c15ead906cdcf460f9c465b186

SHA1
eefe9776f9cfd56ddaeb2890f3e4d5c47f7f03e5

SHA256
3f304b61430afe16300df68d11922e12c625af05fed03304e3de3d5fdf9b4d7c

SHA512
933e27d1be5694c14bbe4d78f0c7c6b30b77fe0bc656767672380d257882068a85b1142d11df4fc797003cf75fa24aa94fc9deab7d9f275f91a8d7a087a48374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2c29d30a3534952a0f179a0b6e57c07

SHA1
1b8545da9d087658a7a67c129ab165e661bb7da9

SHA256
7e0914ae94b8f151b930d65ab5e1b91e872f77d9c35c1532cd270882ff68cc7b

SHA512
9ad6b122f3230afacfe81eddc1f45311043a84b1fb3894f81adac3217dc18d8ea915ed24c61d64c69d19dc4b7dbec786ce056c2736acd21061bf97db51c12c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f212ce1ea356eb553d4ed48dca7761b

SHA1
ee2c05628e26c1566894997d6eb4d4cb87e68cf9

SHA256
b1d72f67ae3b150dadbb74bc9b8ba5eeddcf17883015f28b0587875b01e90178

SHA512
85cb14966ace47a3d41401506921319c3434f2092feef04f4e8b566d7d33964cb5113f4c5bf5f3a6a4e5c3b90c0af0353952151a3856f3f07b343a071512422f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82cc18b33f7b7311c5f52b2177bed1a4

SHA1
33b748984335e5ef904e1b9160849997d75d16b2

SHA256
e9ef978d32c83657d866b3173c4b458adc14622af430fc476d3940f401715ef4

SHA512
ac311da40fc61e44d159f6c94ff468c265339112b43d09ec1fe49049915485f02754ccfde207843d944597c334ee5b5c34e71630c2b7648552f232ad2609b4c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b29fba8d8dab3995eff7f0267c2ec6

SHA1
1383fb1bb8e62b93d5736ae90c3f1d720baffb23

SHA256
771c8ee8c07295ebe3e643ae6eacaf8bd8e2b90c49fcc7579d62076bb18dcf8e

SHA512
8a4fa8c58b465010198e182b2f6541f609666f2837c2f1c9a8006e1caa4b15cd649819dbde0735d1bab8932f3790a6aea0f9537535c4de68d09e611a9360aa17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
625ecdf294e6df7b611264427a20cf30

SHA1
ba45f809abc8d007dcfcc5605689658cb5b45438

SHA256
356072c8366a16ffb1e2de38f59cd563531aba15bb3a0cca7f2a2debfb65cbf5

SHA512
f5dd7d859a2bbce66bc6eb412754894ddf9da608e796ae2bfc37d170d9f060d6a2a9525e5421e824ec8be929a0910cb53b5cf32c3114a5bba65ae15b2b9645ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbd89de70b8f661e764ac6b8eb96f8b6

SHA1
bdf6188fd10ec2f705d1627cba50b4297132b1cf

SHA256
d114ec08f0731dcf38d8410a0c7879ae123933d010ae81a0923b8422e1ebe4a4

SHA512
2478522c6b7255aaae67b84454ebf741fe19b8cbc2c22ccb1fb593e4cb20e94b0dd7e88ae3e245b1579064b1ba54d79e2d9be06837d39488762e6bedc4329e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec8ee47b0d936e25e161da318b6bb221

SHA1
b261915809f26477cdae72c3f6a002e684641f0c

SHA256
3976603babba8f7edae4d32c6875decb7e68ef76f97fd265415380b344938a7c

SHA512
adaacc875af5f4179e951d6a1fa4857bebdef2cf4288a132f9edeea5553735f6a5a7f51c79e5f523fe0dba169f38b581d7dc3590df7da71a9def6b15ad8e18fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e850eb2b02cf9102ad9ac3f7590cd701

SHA1
7a2d7c1a0c2cde1df1b85d04c4755c1b02ad647e

SHA256
6b4b84c74870ea44f1f5aa6a686367f503508d4b83980b786cc9cf97a7f1724d

SHA512
9ab7ccbb61e5ffea2bd4f0aaa197469633bd5500ce776dd315994d15026817ab2d6966a8097a687d56a1e76ff43d641fccb467207b1d294b1c2e9017a5aad044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc05d47c7df26128105e3a8b9e41aef9

SHA1
472c396b3e1489c25b45638cd284b058e215a751

SHA256
7b90db04f896d8740e2b99e1f97d4ec8321977a1f6f3d1f97470072804198074

SHA512
34081630baf5caea97c431ce9c04dcc1b4e7123c67f574c9589fecf85bb9c792d30a17a024a123d9c1d019df1038d6b963b58dc63a0be8727fc058b647ba3357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b196d7a276c495b88ebec5c1a5367176

SHA1
6083fb36c221c8c61e5cac9c891f188c5c368dc3

SHA256
f227f4bc14c77e8c3a13d83da226e74236b4c97480a6a9e7ca55ec6d918e8282

SHA512
bfe71c0e83fed4e92f97daffdf965a3a2be3c18b6d6bb03f5b5eb40ba02c34219dd26384f57f4ddec71471b978515d32cf4f9cb6f69cd85f0ed1e0ab79dc97c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e56c4c7ff00b4e47593d5644f8c8f6e

SHA1
94604897732f36ee504e18a559c70cb944d2be50

SHA256
d8f766ca314c66ec2361e1826abacc39b2f887d596303b384c10c29f87380443

SHA512
eae65256003773b2b80fe82b5914fca464a2e177af895b4589fc449e0c2d9b8fe89fdaf3889b6889f8b14bb8aa874f10d5377f9ccd9939174567e6291e12dcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab95DB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit