12825a95358fa23d8d2d93201ecf325d0fcd781f811e260485201404afdf9538

Analysis

max time kernel
149s
max time network
89s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
01/07/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Coolorus v2.7.1/Coolorus/assets/coolorus_big_header_light.svg
Size 7KB
Sample260701-p54vpsex2m
SHA256 12825a95358fa23d8d2d93201ecf325d0fcd781f811e260485201404afdf9538
MD5 bbd7db1b7c12e665070a5a3a255cc06c
SHA1 d448a0caa29d3d18b8c2315fc08bcbf535cec7e9
SHA512 1afb5fb1eba9969314b6c026ecd8e728a8d7093f3c5a26a8f777bd04fcae8eb3a02cd1bd776958ca4c4fecbf3a28ae8a0dcbc6d95eb98e021ff45b79122a4cbe
SSDEEP 192:PSUDP13nUhLZhB8jrYNPBXggW4A0RXzeR3/raSO:1DP13UhLZk3adT9RXze5/r0
TLSH
T10CF123EC1313496EF98EC6CB74E212481CEA70E7AFF443B0E58CAF1EAE254B15425E51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000973339492349c540b64e61095871a23400000000020000000000106600000001000020000000e686bb8c66c6aa658df0ed826e8ac67800f136d6e2a2bcd232c776921209f3e6000000000e8000000002000020000000da73c1df47f0e214b81b8f74fbb6a82e4fbcf936681786715ac118bd0ad1159020000000e097666cae1521570c8221c701c61c1b7f106ae8fc7225559b21614a6370ab3a4000000035533fc47f0467bedb38af2893669511c4ce764aa5294f05c01bfa0887e0320ebde395917d51b219b3c65cf3c057c4cbcc69326315a9e9d1a9df73223cd78d91	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{46F58966-754C-11F1-BEF6-C6451612C5D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0251e1c5909dd01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "489072467"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06a191c5909dd01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000973339492349c540b64e61095871a23400000000020000000000106600000001000020000000f1c1bd413a566656240345bf6953622e54ad5ba7f216f97a980e6785b83b04fb000000000e800000000200002000000021ff12936f29aa614d77e7d46674c1162f75263086628c363505d479352e5d5720000000e1b17633e5886bc9c7cca1f0e2b0c98d8ebd885ab0cb48f8161cd21f4c8045ad40000000387d5ee6c65b77eefdcfd49cc7c2d15edb26327d7043a1af7032fa837b9e37c98fa97e7ae049febe83b0ccb18f197e3c15f3c73166b5066c38057bdae5d2c981	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4420	iexplore.exe
4420	iexplore.exe
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE
1200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1200	4420	iexplore.exe	82

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Coolorus v2.7.1\Coolorus\assets\coolorus_big_header_light.svg"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4420 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads