00e5e4c53c99d62c722b309b6e394e3c53d47a23406730433b4aaf928e06512d

Analysis

max time kernel
11s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

6ff57c0aeccdf44c39c95dee9ecea805
SHA1

c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256

0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512

d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24
SSDEEP

24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F103231-ACD9-11EF-9E32-4A174794FC88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE
1536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1536	1980	iexplore.exe	31
PID 1980 wrote to memory of 1536	1980	iexplore.exe	31
PID 1980 wrote to memory of 1536	1980	iexplore.exe	31
PID 1980 wrote to memory of 1536	1980	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
630df5669f64444c2b577151c0258f8c

SHA1
5184e24f7dd83fe46682add4a9a57e604ab3eb23

SHA256
85caf898f49d8cef22b40ced8241e0d0fac88ddb9bbd0c0f9d112fb9a38cfef7

SHA512
efbddeeda5c1d5a7477d578ba3c4f1706c4b5e8795a211d04ac807ee0c22014688f71d7cab4b6ce61a46d0f856a24b7d010592ac43198fb442d3259020b9f0bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d2e27d6cab65e2908a996899ae62b20

SHA1
72ae18ca08a8fe17e4901829f88c3d12d496c595

SHA256
a0398d532a36d033f220b16171da150d117af926435337da976e4fe8ab7725b4

SHA512
7d77c45990b789db31c6ec6914bcd9639b83038c1159830e389968e51a528512520b7291f561fa3b53a8c43f3f28d4862dc7eed5e4020c4980f74c4ebd3fe796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24279cac4ea1bfb41ac80f1d8e5ff517

SHA1
9901e1133e93bd9809187b3451b84a88167a1207

SHA256
da9732451ea3402f60a3a7b521676b624865b3393100406358532fe4f54bd56e

SHA512
4efdbb5d44b936bec9ca78d548daf13f5fd98288d5c8c6edc1f09206b6121b9e6be3866f8857737021b1ed27d99981adf94f07c399eb7c82b1779e341cfcf439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9896934f976f978cd7bb9af21918f15

SHA1
12ca0bfade23bc53ffd8dd9da750a5be03420e9b

SHA256
d1d684e38ea35fb4e37818b7ec84dcd5ba0ba0d28507e779f263cb833b7aa485

SHA512
f07ed5904ab30d3959fdea98c964632d8710b3ea01ef3fc506a2f47b434fe27b0b06fc923b586279c4dec65f50d98dc2fa82731182dbf07a6a2c371de298d7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f5f00376dddfdb9417cfb66f08556a6

SHA1
43498cf8a3990d63fb47bbc37c489ec63c80fa82

SHA256
8b232e344ac842cdeda4a61018bd25100d6b29594b40aa594ce0824848429fb4

SHA512
f117af9589c53de7fd0503b6cc9e699ac812ba3f7ae5b0a31fcdbedcc76bd59c87a1c1b886b2b9742dc0daa1d39e0771be25c9324e8da5f7eb4673d62bcb7ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e8cef5d60e8ddb896e05bfb6c3b26fa

SHA1
fbee1df8728e2885eec0ee6d9698af98a5b801aa

SHA256
e9df53157093d04dc2851c8ee5e5cb52b23c222ea7e024294837089ca53bc4ed

SHA512
d6c5440b55b96cad5d37e4a5a7fe9e5134d1c5e4b1ce5233b6cc009edcfabca10402a4f629558b665d732272d9e5b99fa77f73ce403d1877e2fad1a656011b53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37d4595bc4f0dbaee1020f3eabbf54bd

SHA1
7337dd4a7851646801ec82d228bc87818dbce067

SHA256
780a688e6ebbdf5022cc174eac5d54d87a0cc85976dc9ee8aa5a4a63a2a01293

SHA512
4276ea0c81deb6a30883c2b72f189d3f15e4fedfb2dd1d03c22ddf8d665049aa0f8d136a3b504420e0062cb4712c891b6ab1b75fe4f668cf9af79c0c83fa825d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cccad21033d37a90f3f5c3e274722ed7

SHA1
a8e7c84251c95067f88e203a8087f8d1c92c50f8

SHA256
7e468f74f0476ff7370d55494351e896be8169fdc89652ba92ccd8af7ecffde3

SHA512
cc93e53dfe8520df4792881b92589dc09b6795c3c5400fb967be20af5f9afb1d35d2ba20f7dcfa8a56e8d57de3e82e34621e224628bfe6a32d1deb2b2383025e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3773eed349f00fcd8e6bd17a69e53491

SHA1
8856c035065197c5512f8466300dd83fb8718337

SHA256
198b990aef6c4052f3b4e09c808ae1ae95915e9e3f9b63352b9a709400ea5c15

SHA512
63710852d9cf45f95b6371903b763090196608a48dd138d771619a765043b8428e9c0f0f4ec8a4a2976ed8da40ee842d8adf10212763bd7e2ea1d5fdba35347a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1317.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1387.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit