Overview
overview
10Static
static
SkyBlade/M...tle.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...rap.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...ter.js
windows10-2004_x64
1SkyBlade/M...x.html
windows10-2004_x64
1SkyBlade/M...dex.js
windows10-2004_x64
1SkyBlade/M...min.js
windows10-2004_x64
1SkyBlade/M...nav.js
windows10-2004_x64
1SkyBlade/M...e.html
windows10-2004_x64
1SkyBlade/M...o.html
windows10-2004_x64
1SkyBlade/M...b.html
windows10-2004_x64
1SkyBlade/M...s.html
windows10-2004_x64
1SkyBlade/M...a.html
windows10-2004_x64
1SkyBlade/M...e.html
windows10-2004_x64
1SkyBlade/M...m.html
windows10-2004_x64
1SkyBlade/M...t.html
windows10-2004_x64
1SkyBlade/S...me.exe
windows10-2004_x64
10Analysis
-
max time kernel
166s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-03-2022 15:54
Static task
static1
Behavioral task
behavioral1
Sample
SkyBlade/ModTools/CastleDB/castle.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral2
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap-select.min.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral4
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/bootstrap/js/bootstrap.min.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral5
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/highlighter.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral6
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/index.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral8
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/jquery-1.9.1.min.js
Resource
win10v2004-20220310-en
Behavioral task
behavioral9
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/nav.js
Resource
win10v2004-en-20220113
Behavioral task
behavioral10
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/ExitNode.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral11
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelInfo.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral12
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelMob.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral13
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/LevelProps.html
Resource
win10v2004-20220310-en
Behavioral task
behavioral14
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Meta.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/RoomNode.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral16
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/SeededRandom.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/Struct.html
Resource
win10v2004-en-20220113
Behavioral task
behavioral18
Sample
SkyBlade/StartGame.exe
Resource
win10v2004-20220310-en
General
-
Target
SkyBlade/ModTools/Scripts/TechnicalDocumentation/tool/mod/script/SeededRandom.html
-
Size
6KB
-
MD5
228220fc23b7a980df7c9768607f6fed
-
SHA1
4b2303fad36dcfa29a0ff7a5c6fd9269bdda4e61
-
SHA256
0e43e137d02b835fd2a5633a16ff0defc3027f019286b84ee94fc80ee36f7f32
-
SHA512
43c8d4006da7690ea3999936be4e697a58212008daa1074434c82e1112c51373ebc88460628b3d12c681520ec5598da2a8e90b5837b82b5e952ee53276ceda29
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30949272" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306b1b8bac14d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30949272" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "78428420" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30949272" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30949272" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000f3aa25c571cb7ea553f35c65d359760d1a00639272dc91d89007cda129c48ada000000000e8000000002000020000000c1919f65a1cfd223aef471787c65754a8b5d560160e73c7d9c0e2451e6d451b5200000003673269afb430f68343f0524012831365cbe21cc0025ef92491ca50c1acbc0a0400000004463c1609eb30795e9dfe5245b48a958a243e31f892fef2bfdfd4dbecf103620ec3e113b9faa05903ec077988991835540f1089a09e258f00d4404ff1f8ef1d2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "52959825" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "78428420" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "52959825" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{132E2775-AB8B-11EC-B9A4-7A0680AE449A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f323031e69ff0a4483a9b6c67c2edc8a00000000020000000000106600000001000020000000a8414dafef0750c646db42cd3cdb3278b8fa4ffa0bafe2a63fdd9a492d3c1d45000000000e80000000020000200000002510143af3f583448342b88ac3f4f0032ff8994c129e20642fbf1f03eab91ff1200000000cf9d33f531411d7a4d9bd4464e2cfdfc983f327a31900837dbea07678197d20400000008942254500de82c8b1568f4968ce751f29476db76de2b2abd31b40c6de5f8a034a7190e2e41ccc71e7f6daec9b9c9feb9283f7d530a9416abeefa414327cdbc4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9015f18cac14d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "354902426" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2216 iexplore.exe 2216 iexplore.exe 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE 1592 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2216 wrote to memory of 1592 2216 iexplore.exe IEXPLORE.EXE PID 2216 wrote to memory of 1592 2216 iexplore.exe IEXPLORE.EXE PID 2216 wrote to memory of 1592 2216 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SkyBlade\ModTools\Scripts\TechnicalDocumentation\tool\mod\script\SeededRandom.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
dbf72784fc2dad614fa8cac21cccbf74
SHA1ef07eb1c2a31d64401e1a6b12b49e3b3a2b5d28e
SHA25654ea764e102ff6ff8e07082da488bb5504a4fe5400fdbdccffab18d1aa313886
SHA5120bbc2e638e39b3da131783bce54e36ff671f399775af8faa316d480edc4edb214f116c078577825d5cc29520f8d660469d5a4a5d5c73bbc86c3255e172508d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
0c2e13c2f8693489467fd11abac99b75
SHA144389a80b0b86767fb336dc3f0fbc9cc86bc690c
SHA256615b6433de535bfe1a461437e1af1456e32034c09c53eed73b849bda51bccba3
SHA5129ca156cf9a690923f5b5905705d38f81387d1a00b9851e35c071afd6d748ac12188ca0a4316785fefbb0477d9d62fe89d33146a405de8fe8f1af590c8834a47b