ab66f1d0e328f8395d52b853368b2182f05db1a5d2c193ed183a52c9f6e9f3c5

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-01-2025 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Collapse/infos/resources/LICENSES.chromium.html
Size

6.3MB
MD5

34999967f735b07e9cbcf6c397cea4db
SHA1

8001fcdd6ce0c6e5a3d91fd45e4c9726fa67f3e4
SHA256

c5a05048505c00af46c75fb5ca22057f09dce001eada3a756c3839d59011758f
SHA512

b6c2f722b6551231801e453bba8f9593d9f1a82edb305869ee07ef77f286968eb6ad5db1abbe750e88c8af973c362ee161aa5c591ea04ff39e4f4b34e6fa4baf
SSDEEP

24576:/PV05W5WS9YzHIlGMmfu626s6W6a6q5AHWeQFpD:F9n

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e488d00c1ef0a34d96edb32e4c62b575000000000200000000001066000000010000200000001dfe2dd4d49d07b994df8f09bd6a401f36a054ee175c270f918e6f1cd3c42eea000000000e80000000020000200000005bd51f60331b9d619a87a9d64940bedabd448910834b2a7f6534f7220c5032502000000062f08b02bb20b19c101f4480988bdcef9ac472c5a51ec1ad8191d7c7d2d1155c400000007a39304364e6e18d769be880dd51cc51d6aff57b4340e818130820ae5af8c791d1f85d85aaed263910fd73cc263fb7bb5fd382b97d7fefaedaba853360eddf0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DB927F1-CB8D-11EF-B9F2-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442261190"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ea84229a5fdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e488d00c1ef0a34d96edb32e4c62b57500000000020000000000106600000001000020000000c2c3b7fc0c200fec3c8925de6d1820ce3878478c820c2456f611fedb48f5f984000000000e80000000020000200000005e600a96a901cd615c68bd0f0df136ca1b5b0adcbebd1b24584848b8fa474f8b90000000abef04ecd35764db4fa1f64fffc57fbf568b4219a4759d1bbc1de969c4a25c0b7c697950fef311d6d7a9d22a080aa5c53dfd6f56b22826e815b4892accc0458b24f3ebcf2ce47342dbb2baefd3cb96b5741802b3a3ab8d315cf06bb99a05d3ec9e620366e3a69ecbcb2df8d4c7a632f474a281812262ad7f0887e860758a720081bebce44788198e10d563b89618037940000000ce4ec0c30561a006982718459dbeb4360e89cf89845f750e77d28ccdf76f061f4e39c618005a8bdf82290de8414ba696caf4fb4c01af9c9fad447033818f1474	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1292	iexplore.exe
1292	iexplore.exe
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE
1776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1776	1292	iexplore.exe	30
PID 1292 wrote to memory of 1776	1292	iexplore.exe	30
PID 1292 wrote to memory of 1776	1292	iexplore.exe	30
PID 1292 wrote to memory of 1776	1292	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Collapse\infos\resources\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea6cdfd52df03f0d58e6ab7050d47c96

SHA1
024861f7f3f462f96b4e38f6bdbcb167e6ec274a

SHA256
363a01d1ceb53dcb91735af4bacc5dc4cc22eabca6bfb5aa6bdf27de430cc6e7

SHA512
c99305e353e647c2f88ad24975937719b3521a1b6e71893b66f6f9cfddc8365b941c5cc2e0adac8ab344205ce9eae0ca844ef68d4a95f4756b3ccfbed2bf04d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bf139ff07687de1b532a38663037780

SHA1
23ffa9386aa411e1b3f97b7bc34af2fbeea8c7fc

SHA256
871ec10f45bc100caf920120e07edb96bd541737bb32ec16400c8918bab38843

SHA512
be401d05ba6f85f2b7e4c614bcd973d87dd7226565b4d1eb6920c9c41f749d4beee2ee3dd2989a81e2fded0e1a8a55ce354636a16ca4621b023be6a69a24dac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0df52cdce5ad37669af8599ee6ae9d

SHA1
305a35e50c13bf2ef0cd3f7e282387e74328aefc

SHA256
77328199f27b8c19392b069ed4b4bba8b2f99c53e880e6979fc0c08b54eb1582

SHA512
4e3188d3a7589d01b19380a66f12b59ec5bcc9819dfb8a7ccfdfa046ac109641e0057f2a0dae4a693cb2a17c80fddfde78d560438bf3e23f01c8c3ca4742cc66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d06d1f15483a063ead3ec45ac208807

SHA1
0ea14e567469be105ee53d7549a19335fce4aab9

SHA256
ca790fc7d0171a2706686d0d1e2706ea86eab464b7d6402a72d655a88028e842

SHA512
f76455e0d56425b1337647f9c2509f57d88b5e8e8cab7fb776562e31486c7fe39661bd0bd716e943b37b5e7389353eab4b7b7d94e3c3a961e45440b68863cdba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7096d8d9218d060452dd3e4c2b1ee923

SHA1
932d6017834ff7a153f6583aa3f6c7127ddb6c9f

SHA256
87ac360a885f149d0e5181d52877b4c675e46cc0de704a883fa1e36d46480931

SHA512
7ff4caa0515234a6fb98f4afe0676236968c65faec4eb636beac656a70c68dcae449520786164ba6d7f04bb8227cf5ef01eaa5f815d9ed85ef0edf47b488cae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19459df883078dddc3b58a423e2f485b

SHA1
b76ff4f4d3a86d01b77af3b80241768fbd89bc2f

SHA256
6f24ea57276db9687f2e6d0f6f02b581728377dbac2a0b41e71063b33bd3aa7a

SHA512
f892c5cb6344f8101c3ef90fe1669b3d6ea90ed228dee2493aeb7b004fbe0d6f999187938f32a7aad1a3a2c140d6cd87169815242838e263be849548b86ee43e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74c3e47bf239adf3067f5dbf0a34d9e6

SHA1
6c6d9074582d21917b2e29cc334ac02652cb21c0

SHA256
649ab4c96544c3017c36d9da7229f02952f881abc8fa8d14a609477b31bd1325

SHA512
a54db9eacd48b94a3d4068f47873901b61a5a4e53c69ed5fa12602bce8293b337fe9efd02ec71ad0ff7206ff06d4985f64be3116e900b58941eb589fb606538e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7812ff3cfb3f05fe462d78d93e1c548a

SHA1
b4e64e7e78cd13bb8f90ef4b8988a3beda34ccc5

SHA256
4785366a1c72d573e2b28f32ce0b6d2b8db7f329f0cfedb7975a2b9b01916850

SHA512
59ddbbcb3ccd4d6b4d66e9d17c2daa39fb0b42808b38594243205b21044b118b12fb09ef32b0c6183782dc11a96b3bb866996c38e47ffba8f6b80afd56a7ce0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47e4f7ad002326006847165f43bda1bd

SHA1
06ac7609d58b8564ac3b07afa55b1193fcb7ebb3

SHA256
d2c6a8de203181b6e63ae8b3cd6292a44faa05fe3fe5f43c3c55cfd5a60d1b32

SHA512
b4f34fc3a44d927fa6d01ee6263a1d3f084e7eceb501c8f51958be95f993254e1bfab9a567eab990097ac7818ec5f6deb28b5b0dc3ed2b651d8cd2dab8883485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28d8398a5837043497e2257602191e28

SHA1
96451f4a3f87fb7966a63f3e97bbcc96b2b33c2b

SHA256
8624f056f398fb4c7553b03bd8bd3a05c4aa3f58775f28458d699af6964babe3

SHA512
1270d1e9a3217f2f2c1f57bc31f5ed5671561a83e09dfee4ca00a8f3648bd82c9568f949722a262db8a62b6d62c20d05ee2cdd564a9b32d02501e651183655db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cbc4fb633d7aec812286a1a19bf0644

SHA1
8300ce2b7fcac6facca4193b544eb97d267a51b7

SHA256
7e97b63155d6736bb2dec09a9a9fd93ef7a24595cfa3ff7280dc4ce3293d24ac

SHA512
fb5484fa770ac5ff26d31ec5d689133c3a40f0773c7f90467569bb44d4c5c37372b3368189d4d389e4c2c5316b43df26276dd074ce4310c4cf36d17863995a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be944b1fa03c6dd6b5bfe45778bf9c29

SHA1
c489299d2bc5ef44f09358ebd53b340c495a2253

SHA256
f6931b5c213a6584e1c696ec1268962031747095801c9e1dd99cf4b1b0f34117

SHA512
1ceadb8727d03b1b13e5ae6425847f1e8100d3e13ea7928b8e5b89f5625d6dcf47cfb11a8ed09a02e6ce15b8e6174e2272de16db19a00f42d10b7094701c77ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0882ba9714ac106275119d7afd7131ad

SHA1
63aed0407f5aab4bd12300802512397e5c5495c7

SHA256
527ee492e176bfee3fb60ace9ff2704d0ba18884f163270bdedd9a9d062fd3cc

SHA512
e97f79725065d27af3fa996c3c8d0f0ca76ea337500bba3fc7fcbc466e20ceecc9860baa10d83ca94f7558307103479d4f154fe2b8645ed31c9d1cf2027a9c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dc96bd5d7bfc77aec25951a332c59b5

SHA1
0950f2295e9b262af1ec8807be389dce824199d3

SHA256
ef917c38b64e25e0a351c8d9d7d6c66152ce1336825b1a130afb3b8cfafe7676

SHA512
c845eaa6b8b4eaec072d0461096514708eb68a4be19a222f0f26d2f07a72114b684666ededf58f4876e2171b5a44be9c778ffe44ab2db831e6ff4eba087878f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c923821dc43d8e84eff327bd46d39c6

SHA1
f5e316166eb178da5c86ef16bdc7851df9ea3ccf

SHA256
5eb3d0a22db515da3d321555d85cb79f16c69540cf9102a9fe5bbac25605db86

SHA512
ffeba44d10125fafd6d82dab07d42c14bb42c49325241f23501893d1879c821d2c7eff60e1e872375a6d4aaceb00946d60dc312cb6c3e666ad221028b179bd40

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA83.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCBDF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit