Overview
overview
10Static
static
10virtual_fr...ds.ps1
windows7_x64
1virtual_fr...ds.ps1
windows10-2004_x64
1virtual_fr...es.ps1
windows7_x64
1virtual_fr...es.ps1
windows10-2004_x64
1virtual_fr...ts.ps1
windows7_x64
1virtual_fr...ts.ps1
windows10-2004_x64
1virtual_fr...ns.ps1
windows7_x64
1virtual_fr...ns.ps1
windows10-2004_x64
1virtual_fr...cts.js
windows7_x64
1virtual_fr...cts.js
windows10-2004_x64
1virtual_fr...ng.ps1
windows7_x64
1virtual_fr...ng.ps1
windows10-2004_x64
1virtual_fr...der.js
windows7_x64
1virtual_fr...der.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ck.ps1
windows7_x64
1virtual_fr...ck.ps1
windows10-2004_x64
1virtual_fr...de.pdf
windows7_x64
1virtual_fr...de.pdf
windows10-2004_x64
1virtual_fr...nks.js
windows7_x64
1virtual_fr...nks.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ler.js
windows7_x64
1virtual_fr...ler.js
windows10-2004_x64
1virtual_fr...tp.ps1
windows7_x64
1virtual_fr...tp.ps1
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...oap.js
windows7_x64
1virtual_fr...oap.js
windows10-2004_x64
1Analysis
-
max time kernel
143s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 07:07
Behavioral task
behavioral1
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
virtual_freer_v1.58/back/products.js
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
virtual_freer_v1.58/back/products.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
virtual_freer_v1.58/callback.ps1
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
virtual_freer_v1.58/callback.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
virtual_freer_v1.58/guide.pdf
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
virtual_freer_v1.58/guide.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
virtual_freer_v1.58/include/funks.js
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
virtual_freer_v1.58/include/funks.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
virtual_freer_v1.58/include/index.html
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
virtual_freer_v1.58/include/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win10v2004-20220414-en
General
-
Target
virtual_freer_v1.58/back/template/index.html
-
Size
123B
-
MD5
6b37309700ffdd85eed2431b5dfd3bb1
-
SHA1
2eaf914fe507a09f321684b8add29b94cee50db3
-
SHA256
c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
-
SHA512
79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b09150000000002000000000010660000000100002000000059fd3eb05224b7d1f10ee16c95ec6052224ddb3c6a1292e1b79774bb6b41b58c000000000e8000000002000020000000d9ffd434e1eafbf3363564398ef95ff6e5623b9ff39a66aa83a87fcc888b012c20000000737787839a0dee63dbbf7df3d8419413db92e88d5699f222abb08115c841b64140000000844a0ecf3d04831206806accb05ca2c339d7287e35ff00bd5ac965bf93435ac4d6a8b9be8234969d9045b543c0ce8ebeb780e70f10c83b18b8bbc23f0a137ff0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b09150000000002000000000010660000000100002000000084e5e5b861befd61962d99c721405e7ae9cf2e45059de648568081c45959acb9000000000e8000000002000020000000ef8c3e735f2d5cb4bcc1c7cec7271111f0be561381c13fe2226dd89a664fefad50000000a274bb44fcf905f2be171dd1724d35e732b09beb5235955e31917905163ebe1fc70535d0cfc8083b387eb64bdf46156e03007ef3855eb87038cb838c3e8d389900d165803b556a2518abeff238ae3f4440000000a821076ef8bbae55286e7ff1e3715f250cd261a36cc4ca134e026494595bc01db50b5a84a70df017bb6d56ada7650020df40a6f9f34a2df27338dd00ac31bdd8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b0915000000000200000000001066000000010000200000001aad8fd0c77380d757d20dd001f4bc3a34d43cce0c91b0f10ac2af02622014df000000000e800000000200002000000035fe0c6d281ba9d46e2a6595f155fb82a45e9f0e55252db862af2f31be62c1eb2000000092456e909e4e5718121b6b13bfcb8455d2164a920c26faba771345411b5aa7f140000000aedc95e0c91f517426efb077933b3b5448f1a79fbb2f9c6b802a916bef3f75e658d59a83f937abf4ea1809ede4385bb8ba1f3dc7958c82168095add6643c00eb iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f0dde2326cd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01574e3326cd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = f982cdb29d50d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359806815" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{06805BCF-D826-11EC-AC67-7E9F925D3B67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009ca67aad6973c147a14e4257979b091500000000020000000000106600000001000020000000ddba873d6f258b533daf70d98e78a37c3be57bfa3ff70460f40b637428746cec000000000e8000000002000020000000e484fca492e5398890888c8e68ce65689d36032890d620987173d6dcc514af9010000000aab554c0bdd7daeb3773c1085d926f2d40000000d4c8fcb562f67cdfa7716c1dd8c233aaae3f0d8d5accebf2327cc115ac271ca7054eb7795d8a89c838f7c6f44581beec261e658c8323c2c9aba174307a88a460 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4284 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4284 iexplore.exe 4284 iexplore.exe 5024 IEXPLORE.EXE 5024 IEXPLORE.EXE 5024 IEXPLORE.EXE 5024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4284 wrote to memory of 5024 4284 iexplore.exe IEXPLORE.EXE PID 4284 wrote to memory of 5024 4284 iexplore.exe IEXPLORE.EXE PID 4284 wrote to memory of 5024 4284 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\back\template\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4284 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx