536e8b1207df3afebfae5d4d9f19e33948c04967c322ae1c02fae00bc3695346

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10-02-2025 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bootstrapper/LICENSES.chromium.html
Size

4.4MB
MD5

ceadeb2ef45d9689c77dbd491343df4a
SHA1

285147815c0c173ab965a3aefa2738d87fe02113
SHA256

7c40e8639f24a7f2a509cb4782f79848c9af1dc985f17a09a6d2b8de3518271d
SHA512

99475ae5e9d41081efc4aa8b710ce31be5c0960507ad9ffff90bde8bf2d38f46e34a1db7a17369a618199598292bccd0a2b590f7282bbcf886151f2354fd7a50
SSDEEP

24576:cwEBqmnLiLRK2BrArXKzCXkUZZAwi7Qx7uj:1cqmLAZNe6Whxe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1CF21C1-E7EF-11EF-A9B2-6AA32409C124} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e984b959809ea448eace476ae1c37b60000000002000000000010660000000100002000000023d1a663f2d673cbfab5e288c315d1970edc1272745e2d79be28fa897383101c000000000e800000000200002000000089eac0193acf9c858d7eab23f8e693b084029218eff6d567de5c91f57b094b7f20000000b68a1239508c50b0e18e6977cc4c5c2ec5bc83b7ca44d971f6422c394f36735040000000cb45f844986c1cab25bdf1574b1874753e916281b6cb6cc795bd69492b3f6e8fb0d5bf68e889bc9888e25885b0781ec7621899b138441b6e2d0363b65b077d6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10516796fc7bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445382118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e984b959809ea448eace476ae1c37b6000000000200000000001066000000010000200000001128dabfcdc053811ddc543874c2f73178bf8318d9a2ff0da3147c87b15b118b000000000e8000000002000020000000668cdda743b835905c7a7a6aece0fe3a7fbf7cdf4fc0f74488a84b85ad0c56869000000099802fffd39f798470a68fd3bbf4e09beababa0997be48f975c8191e899eec4d5141165437bad81c3ca8ef20c7a169281dad0a2b438ecf3757c22de65457fde3662fcb44172db9d8fb15c7f463473d77d1b183b7fe90e654d806d3f160722f552389ea07c2facc79b53bff9b4db6c26beb14a487142ac9970f2626000d136935efbd24a7c2997dea1c57fcbdd01a820b400000002a5a5e9c6f29fe46c2c79113545ac2cf88799dab1b106a07a315c7eedd4b41bb46f1e95fc3855c7f584ad8e81ba164628f4366ab5e87254aed5cd4ce76807688	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE
2984	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2984	2316	iexplore.exe	30
PID 2316 wrote to memory of 2984	2316	iexplore.exe	30
PID 2316 wrote to memory of 2984	2316	iexplore.exe	30
PID 2316 wrote to memory of 2984	2316	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bootstrapper\LICENSES.chromium.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55e5c197a418ec1cb53a370102852bcd

SHA1
cd845788984281a70b812af356d63e2b0b7b3b3f

SHA256
9903bf354ff7157db20c0347e2d6d2b14d3fbc451d21929e82dc848618f01a3c

SHA512
dec64059f6955a1f655df9ad954a4cc33529d77994d56e76581c7556edcc3e93687441e4ed15ab042f8530e3093acdb236168280a2b8e9a26545543fbb7f9a4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c81c72779265f9e1a903718d321fd7c

SHA1
7142aebd50fa136b886734b76b99b4e236192152

SHA256
3bffb561b38c76fd2639cfcc2c63065b98c5fe8a2faa95814dc881adddcbd1c0

SHA512
d8f29f4de56b45f511d9cc11ecfdd24f3933e20a15480a2b6092d6181d1bfc0a778cfb55a6aaa8e6bdffc1587019699c3fc61244282b628f722bf044a400eebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cef6e4555be4963926279a88430f85d5

SHA1
1224e1c6e3d8e531134b705928b4c110469b6a95

SHA256
5fb7b21ef3178d522d863667fc6d09d9faba73a89671f12fee163708a2bad1db

SHA512
b0a2cdf9ebeffbeefafbf1ce781dc0cff0e78c4a48d7df3549cacd957bdad914a08b4914d2040bfb5fa397abb998b69a6a00bb9875438b2639c28dd0b38bdc67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c1c71125d994c76a9adee5be2b8c24

SHA1
91f08ad2c75540da0f5c71e1a057a3e3c217212b

SHA256
e515cee110d0e782ef1f3c27e555337c1a94df0a230526d950b343d225dffe8c

SHA512
52ce6a981cd3dca8918837435d3050fb6d7686cdb3d980f6c0b2f4491cf0a6b4fe2d47e8ff604aa269d39e078dd099703f05df9a54e2e9037162068fe98fdb5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f259297fde14c0637b73be40b14c7455

SHA1
bb4f7236f11806f9af01fcf96f1af2b119a11c04

SHA256
0d3b9c71578c57fca20157da8152efe38fcf90c6b5f03a38f9d691345dab422b

SHA512
003f52caec3456fa3c41388ea5eac25507838c7244454bb2cf0a7d2945e2b094362325585c5656f545a5c4aed637d68c17cc1c2fc1b1cf7f5f5eba86f1ce2bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83e93b55d5f058720144cf8f9751dc5b

SHA1
fed4bf8326aad17ebacbde176f63eb7762be57a6

SHA256
c209f35f6ea87feb9537fc6830d35ff948fb21ee89ebb8a21d1c35bdcce1def3

SHA512
00ba4ad982f6b42fbb807d39fa06719012d1790db1a533fef195e78384acda08ade9625f2ab050660461c9b40055fe51a3f569acc1e2b71fb2fc102d6447a3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF846.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD1A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit