7fedcec3a38dec8650ae2f64271b19c01372881ce83f1fe4597f85b26c4a0732

Analysis

max time kernel
117s
max time network
138s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

6ff57c0aeccdf44c39c95dee9ecea805
SHA1

c76669a1354067a1c3ddbc032e66c323286a8d43
SHA256

0ba4c7b781e9f149195a23d3be0f704945f858a581871a9fedd353f12ce839ca
SHA512

d6108e1d1d52aa3199ff051c7b951025dbf51c5cb18e8920304116dcef567367ed682245900fda3ad354c5d50aa5a3c4e6872570a839a3a55d3a9b7579bdfa24
SSDEEP

24576:2o9dQ06p6j6j1WOwRiXjYmfy6k6mjK64jK6gjK6e6cjK6feGjl8PpE:BFOeGT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439702140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008e0532b825a6224f9b539ad7cbb914a500000000020000000000106600000001000020000000f20a68f58e8005b659e265c037b89e2d5142a5cd23621d887adf61d66b588bdb000000000e8000000002000020000000a907cfde126a61e0348e363e023678d28eb4ac8ed8077bf923a7ed0f8cb0c44d900000005da8b657e444aff8d3ebaa399d4589d5fa0de86b3832dbd5a652184e6c6b13d948f4fa678ce90bebd391046785246f4aa72e189949f276a52b3f1c0d0f86dea151bfb22fc8b8e6875ac1e2e308067ad3f50f940a0dafba66c7af09d5230e4c0e945043b5e0bea244c12acb9b7738786722f8d6931882c08e5c30dcdb0155174b60e5cebc0356ed629a820c31e09fb1c740000000ca3a82490a6d93489b36ce53d4c1e9240a5bc2af3643ddead49b3d088232f785471317cf4fd926100a74d3615dacccf41b6cdfac5e72f6ba5710bc0e066c467d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CA1BA51-B447-11EF-B33F-CE9644F3BBBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09f89e15348db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008e0532b825a6224f9b539ad7cbb914a500000000020000000000106600000001000020000000f80b7f0d4fb971bb33e0bd25be78f21676374c589166eafce1dca85b4dd4a142000000000e80000000020000200000004bc58297636de517776552943391a2926bd71e601710a5feeeece2969984367420000000f5fd722ac4f0655e385e4a2ea353c65aa88fdeb7ab8347003775e6f5689df76b40000000b9ace0b13521f1b99d92e63df4fdab2dca5ce4b49c318b22ae89b003e68d261d7d2d6ada6fbfa098764a0b795f632634a44d8ba0a75a67f0c54734043f1571af	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE
1516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1516	2352	iexplore.exe	31
PID 2352 wrote to memory of 1516	2352	iexplore.exe	31
PID 2352 wrote to memory of 1516	2352	iexplore.exe	31
PID 2352 wrote to memory of 1516	2352	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1849409b95f9e7a62783b43ca81dd118

SHA1
1b09001a750e2cdbf302356c5ae5790c2546e19d

SHA256
4c57f0a1dd632db1094f13c9b9221575385ec52c90bb1a53820395e30f81146e

SHA512
164f97a08460a8b25d6f4456d1470610fc63db6c6bc323e0faac394ab3dac636587160b1e176b124ca23feb6a81a790ba2cd5089705cd721633da52711516e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed73fc62322b7cdbe21a5c929b0ac99a

SHA1
5d0fdde91f3afd08e3de895878203ea8780e5118

SHA256
9e8cc68f27e64c21dae7d85b7225753cecc52622909918faf9444c290c0ce45d

SHA512
3f00a4355f1065afcf8c6bccbddb10fde58e8d58872cd2341c37ee8e4fff0a1c4ad5f7e450af7d52864bdafee93ff9deacda387bba29f6a9a649dac66aecc55a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3b5d5ef05adfcb38e5984f31a1bef03

SHA1
f53cd1d1be20dd3e5afbfd586c075e8579630e94

SHA256
ff245dd6132d5c61f5cec40a071fc059bcea66269b3b496dc7876153e6c1cdb9

SHA512
19edb4bfc7397babdb9fc8a38b163a3a7a0788aa6f0f904f40f63d2b3ee872be74349d70274162075dd745cf2dc2c5cb747bd480349b127c2b006d95a0d357df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
342d278c43b54f99471957e9efec66ac

SHA1
bdd29a9d414f1190ce81410007225c4acce00262

SHA256
470a1cfcb7107d2e489f4dead7f85e1cdc185e53b226b31b1114326060399203

SHA512
516320755a65aab100a3a3889c806df2be54fe660b293eab96e59c9d22656aac23c933b5c05df0b6bcd6f24d96b2527996bbb68f264a6b34b49c22b2d610345f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44b0f484ba14b369162b8256b52e05ca

SHA1
62957e9292d421046f75d2fdcc66fd542f129423

SHA256
0d85eaa08cc9bcccd7eb31c923d68aba1cb2b4a4340aa582a10fc9a85812ae5e

SHA512
0e5b1a02b4eaebe0cf71bd706a237c57b55fa37898ca1f114875f1294d400fe537424495bbf32765351b4655075b3b22008a99e11472628c66387d6b17ce8479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a64158a2838db49243c7f2ddc3ed3c6b

SHA1
30623880c7f274bd497da0cdc917a6cd593a25c3

SHA256
b266387be08a59450710164d42ac566a9f35260367869207c4f905ade95abf5f

SHA512
49fd3a5c9161620ca3577846082db4c0b354413ae52132dc39e94a9f647cd2e1ddd1f06c7c04479e9b9f39e6fd30e939b3ce13f92f06a0d7b5b26e8554d995ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
129796de899cc87273f34ea2aa951b71

SHA1
05e49de5108fef66273c60bfce488acaa0619d9a

SHA256
915bbf9a4478960848d33ae77cff15564b55021f4ca9fb137640609a580b1100

SHA512
b3b1ef989ebac8bba5306e1acfdd77769c19ced7597c2dae3dae3751f9cb8ad6ffa1606f43f62635f51e9d86c5254bf0896e4895f6b8cfdc438e9db66369401b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9477ba2fcac34451abd94a82b352bde5

SHA1
6f27ef2cf82fde8c05a08659902d6dcbd3f08643

SHA256
15b6aa817a6b12aa719a02a1613a5ef05535aae547cdc1c9c5d4f6c7ce9dd0da

SHA512
0dec3cd9d5780236d70fa96d0ab05bd0268052f8c9076bf2cadbebb96c2a43924eb67850f763ead5d473b8cd9953ee90ba4912352a7b855bbdfdd8e2b7d403a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9cfd044985625a696d535cb497b929b

SHA1
49f049a880603adb65f97010fe81f2bb82bc1802

SHA256
fe06cedded3dd3df3f5bf2800135c62a8cfabea0935eac4f0f637167e96e0dae

SHA512
e2b94d51fe39d4dd7a00e5afb69c256ccba87861fcb5b288306d738cce9a1558ee29e8006a30aadd49b2e1a22c21449983a6e06f8161bb8a998c18b7fd643983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53d691426772a99232303da3d32a75d2

SHA1
16014c964c88d5cfc0ec49140479e97265defe1e

SHA256
3428e918329ffcf9f1e6e1002c4d25126a9b408a865cf5e08c2aba558e2b70d0

SHA512
bea9eb5d33623b0c0955db2a1159d9dee1e267348b68db33147a2f64670e31a8a8ef61f72f0d791b4e3bb88925ae42915c80b82913e3ab113008ca89f95f261f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
889a1d2210401d4a35df6d88d2e61233

SHA1
c4cec50dee208520953737af0d25792ae936682e

SHA256
20e86afc6ba944983dea98808a1e01225a2c13e1b223d11c631c85461b1edbc8

SHA512
67d940e124fb9daab51bdb1b195a42d05719000458fa0d138da37eee603e98acaa01adb0f93d175f5b178690d25cc6afebf85d54e9210ae15a2d46bceab2ee85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A67.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B73.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit