Overview
overview
10Static
static
10virtual_fr...ds.ps1
windows7_x64
1virtual_fr...ds.ps1
windows10-2004_x64
1virtual_fr...es.ps1
windows7_x64
1virtual_fr...es.ps1
windows10-2004_x64
1virtual_fr...ts.ps1
windows7_x64
1virtual_fr...ts.ps1
windows10-2004_x64
1virtual_fr...ns.ps1
windows7_x64
1virtual_fr...ns.ps1
windows10-2004_x64
1virtual_fr...cts.js
windows7_x64
1virtual_fr...cts.js
windows10-2004_x64
1virtual_fr...ng.ps1
windows7_x64
1virtual_fr...ng.ps1
windows10-2004_x64
1virtual_fr...der.js
windows7_x64
1virtual_fr...der.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ck.ps1
windows7_x64
1virtual_fr...ck.ps1
windows10-2004_x64
1virtual_fr...de.pdf
windows7_x64
1virtual_fr...de.pdf
windows10-2004_x64
1virtual_fr...nks.js
windows7_x64
1virtual_fr...nks.js
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...ler.js
windows7_x64
1virtual_fr...ler.js
windows10-2004_x64
1virtual_fr...tp.ps1
windows7_x64
1virtual_fr...tp.ps1
windows10-2004_x64
1virtual_fr...x.html
windows7_x64
1virtual_fr...x.html
windows10-2004_x64
1virtual_fr...oap.js
windows7_x64
1virtual_fr...oap.js
windows10-2004_x64
1Analysis
-
max time kernel
97s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 07:07
Behavioral task
behavioral1
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
virtual_freer_v1.58/back/cards.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
virtual_freer_v1.58/back/categories.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
virtual_freer_v1.58/back/payments.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
virtual_freer_v1.58/back/plugins.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
virtual_freer_v1.58/back/products.js
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
virtual_freer_v1.58/back/products.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
virtual_freer_v1.58/back/setting.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
virtual_freer_v1.58/back/template/header.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
virtual_freer_v1.58/back/template/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
virtual_freer_v1.58/callback.ps1
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
virtual_freer_v1.58/callback.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
virtual_freer_v1.58/guide.pdf
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
virtual_freer_v1.58/guide.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
virtual_freer_v1.58/include/funks.js
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
virtual_freer_v1.58/include/funks.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
virtual_freer_v1.58/include/index.html
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
virtual_freer_v1.58/include/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
virtual_freer_v1.58/include/libs/class.phpmailer.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
virtual_freer_v1.58/include/libs/class.smtp.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
virtual_freer_v1.58/include/libs/index.html
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
virtual_freer_v1.58/include/libs/nusoap.js
Resource
win10v2004-20220414-en
General
-
Target
virtual_freer_v1.58/include/libs/index.html
-
Size
123B
-
MD5
6b37309700ffdd85eed2431b5dfd3bb1
-
SHA1
2eaf914fe507a09f321684b8add29b94cee50db3
-
SHA256
c703afa89e7517dd5020ac2960b7e14b44d4010ef02d5e0f6e34b9629935a3ce
-
SHA512
79211ac08ef90a01c9ab0bbb2f2bc437b696c9f5b1193c1d98659428ea3ba5a1db7a6659d8b14f5c4184c577ef6caff456439654b84c986740e7a2a50bd92060
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7065af08226cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960674" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30960674" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359799585" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000f628be00c4d2ac01b21f8f699d6d3699fc213079a98d711029b74f7471c8deba000000000e8000000002000020000000bd32d5a70ae4171aedd7e38da2d9ec8448a726d842a9dde50be8d88064513ce520000000e795ec907f3d298ec49c89c8c833f7e4fa9cebd42cfa165cb2f10e5d0a620ff740000000babad4ddb4b9aa2b415174bef28a255c4ba90cfbbcfbdf182379af6ece29dc7498c082372fc5684bf442f0a171c3c4c04c1ae2d65f1204d407107ea6a3061a19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50bdbd08226cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce100000000020000000000106600000001000020000000c92d116b8eeec32c7c07bf47ffba3926149ad1e845a4bfa77547e6e0a9b52234000000000e80000000020000200000004606eca4d2906df9f15ed326240b3d1231bc211543815ed3cde66e2f88f7a46720000000e9005e8b909042c823712d5adf8fedde5d4958f41744e23141a5a0049c3514a7400000007b7734f22619335c8c625ae269a2ddb617e6a270d7863e62960294c5be14a52880c4c44f8c49d5e348b966e68b27dcc7d4192047d80a5e2eb7eee7065f44e83e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "121811484" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30960674" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "121811484" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "135716425" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{32D95C76-D815-11EC-AD90-5E4EC20DECC8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4148 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4148 iexplore.exe 4148 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 4148 wrote to memory of 2004 4148 iexplore.exe IEXPLORE.EXE PID 4148 wrote to memory of 2004 4148 iexplore.exe IEXPLORE.EXE PID 4148 wrote to memory of 2004 4148 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\virtual_freer_v1.58\include\libs\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4148 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5003a496cfd41526dddbe8b00273a047f
SHA1f59d563a2a66fe14a3f7787a00e96359aedb5ab8
SHA256c7a19cd00fd53275f30a71c8f5d87161e5caff68207f4069079ea1448a9ebf41
SHA512e4601d093066d6b28e0d99057218f7fb2501fcf24d59b46e0b7babcd24408f4cf0739873b5e74580d6b7a49df6af5ddcc241875ab4633a872a2262b7e7e0b191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD565a3c0eaa65d22bbee69bd6813ccdd25
SHA168b3f904dcbd40b965d5f1f55dfdfa2e3f832430
SHA256c3f93e2f5dc5c8adede0b61ef4f237897f7a9c1161ba53043e6caea8a30c8e88
SHA5127769b347b5ea6d3e518ccb8d7615fba0dfb73868fa776a9f4b2f85f87400bfd15ef6d27eb0cd30f5254a7562e3d742a92be1ede85a7d2d5cab4b6127736f7bae