Overview
overview
8Static
static
4package/Pr...el.exe
windows7-x64
1package/Pr...el.exe
windows10-2004-x64
1package/Pr...64.exe
windows7-x64
1package/Pr...64.exe
windows10-2004-x64
1package/Pr...ll.dll
windows7-x64
1package/Pr...ll.dll
windows10-2004-x64
1package/Pr...64.dll
windows7-x64
8package/Pr...64.dll
windows10-2004-x64
8package/Pr...re.dll
windows7-x64
1package/Pr...re.dll
windows10-2004-x64
1package/Pr...ix.xml
windows7-x64
1package/Pr...ix.xml
windows10-2004-x64
1package/Pr...se.xml
windows7-x64
1package/Pr...se.xml
windows10-2004-x64
1package/Pr...80.xml
windows7-x64
1package/Pr...80.xml
windows10-2004-x64
1package/Pr...90.xml
windows7-x64
1package/Pr...90.xml
windows10-2004-x64
1package/Pr...01.xml
windows7-x64
1package/Pr...01.xml
windows10-2004-x64
1package/Pr...ve.xml
windows7-x64
1package/Pr...ve.xml
windows10-2004-x64
1package/Pr...et.xml
windows7-x64
1package/Pr...et.xml
windows10-2004-x64
1package/Pr...l7.xml
windows7-x64
1package/Pr...l7.xml
windows10-2004-x64
1package/Pr...00.xml
windows7-x64
1package/Pr...00.xml
windows10-2004-x64
1package/Pr...70.xml
windows7-x64
1package/Pr...70.xml
windows10-2004-x64
1package/Pr...90.xml
windows7-x64
1package/Pr...90.xml
windows10-2004-x64
1Analysis
-
max time kernel
132s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2022 05:59
Behavioral task
behavioral1
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win10v2004-20220812-en
General
-
Target
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
-
Size
32KB
-
MD5
ac29c853a64282340ef729348b8f1d67
-
SHA1
302686cc7c3fe0a66a3ed4256a962426ea9786d4
-
SHA256
e4ab45c17b706f7689e7c854f7b95b14ceb7f445344253e1e062498b19196bfb
-
SHA512
a3abc6c6eb93ed3dd57fb144eccd5313f4df5622db337c5a6151c752aef2befe21aaaa854d2e84d083e6ecf4168906f568380402695231f44bafdd4cc3e7f797
-
SSDEEP
384:53l2bYjk3EfI9S6J9S6KS8Y542cyRANEffPaWlDGAYwfDjY/AnM/0wz8b2:5l2l3EfkdcyRANEHPaWlDVYU/wz8b2
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989020" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d790600000000020000000000106600000001000020000000ba39cb50d0517e8afd29d90d94910d243b621da7296af0f9d34dfacceccff027000000000e80000000020000200000006c288e65f0e49d1bfc5ec7e6c76f491fb8fe6ff173c3c23337cf75f19a8b9857200000008f4db56fbce6b09f5b74ecde8fa8e72d6f68205b8fb7fbcf5535e79bf40b1047400000006470362579a8904a5319c28f9fb7c9f3d2b3cc919d7432839c19ca99de832ad1cce2998fb404c1396bd36780a5b7ebe7f8f0170ecebcee1f301d8c6a44d24ecc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ed0846dcdad801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043e2eb2e51ccf149ab640c8bdb0d7906000000000200000000001066000000010000200000009f921b36acf8cac41cdb48c4cb12e0913791a007933640ef07057e12f3012d03000000000e80000000020000200000002e050cd9246eb7dbe26ab19c27c7c9880a90f400a2c0072f897d610317190bc3200000006c6a3fc5746bfb613e28c8451784dcbe2320d245e144e5afed46c93b0d3c675c40000000a9d71934feac828e9a5413d0700a603411b2a6dd5114f391c7340c03848df6d379c8c7aaf75596b6208d7c89bfcbed31ca3586305b2c9f349eafde98bbdef521 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30989020" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1150614547" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{70139A2F-46CF-11ED-A0EE-7A46CE8ECE48} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1150614547" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30989020" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371974202" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a70d46dcdad801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1161085208" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2224 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2224 iexplore.exe 2224 iexplore.exe 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE 4808 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4268 wrote to memory of 2224 4268 MSOXMLED.EXE iexplore.exe PID 4268 wrote to memory of 2224 4268 MSOXMLED.EXE iexplore.exe PID 2224 wrote to memory of 4808 2224 iexplore.exe IEXPLORE.EXE PID 2224 wrote to memory of 4808 2224 iexplore.exe IEXPLORE.EXE PID 2224 wrote to memory of 4808 2224 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\package\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\Cartridges\sql2000.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\package\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\Cartridges\sql2000.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD550e10d0c1d47ed3dad34cfcd6a9d764c
SHA17ccc215400c6c89e794dcf3b8d7b7ed006e94fec
SHA2564e194f75beef2d97e3b4e3fdf4a49b5ce0b5f7f112097d3093b33d257b2912a3
SHA5127f67c1ac984e0f2de6cb3e12fe856a86a0e6f1d690ad668fa11c94932c5846f12008fc375187e0c93f40026613096184e36aa4804896f736aeb1bec27fb265aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD50836299d377dd0c6259824eec56bcc75
SHA11352ecf0fa3d17c8649425f0f97607343dd7f383
SHA256adce081617fe479fce5bf9189161232b9bb64a82051c32aaf215a685a10e732b
SHA512a8121e129b73b60cae3b240d50e5d50c6feee26352945c00caf878a12850e254511f96713ed3237b19dda3c8639a189a6e844d0e54472bad760574029404b86f
-
memory/4268-132-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-134-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-133-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-135-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-136-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-137-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-138-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-139-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB
-
memory/4268-140-0x00007FF963870000-0x00007FF963880000-memory.dmpFilesize
64KB