Static
static
wp-asset-c...ain.js
wp-asset-c...ain.js
wp-asset-c...min.js
wp-asset-c...min.js
windows10-2004-x64
1wp-asset-c...re.xml
windows7-x64
1wp-asset-c...re.xml
windows10-2004-x64
1wp-asset-c...ie.xml
windows7-x64
1wp-asset-c...ie.xml
windows10-2004-x64
1wp-asset-c...al.xml
windows7-x64
1wp-asset-c...al.xml
windows10-2004-x64
1wp-asset-c...ue.xml
windows7-x64
1wp-asset-c...ue.xml
windows10-2004-x64
1wp-asset-c...me.jpg
windows7-x64
3wp-asset-c...me.jpg
windows10-2004-x64
3wp-asset-c...go.xml
windows7-x64
1wp-asset-c...go.xml
windows10-2004-x64
1wp-asset-c...min.js
windows7-x64
1wp-asset-c...min.js
windows10-2004-x64
1wp-asset-c...rt2.js
windows7-x64
1wp-asset-c...rt2.js
windows10-2004-x64
1wp-asset-c...min.js
windows7-x64
1wp-asset-c...min.js
windows10-2004-x64
1wp-asset-c...bug.js
windows7-x64
1wp-asset-c...bug.js
windows10-2004-x64
1wp-asset-c...ar.ps1
windows7-x64
1wp-asset-c...ar.ps1
windows10-2004-x64
1wp-asset-c...es.ps1
windows7-x64
1wp-asset-c...es.ps1
windows10-2004-x64
1wp-asset-c...nUp.js
windows7-x64
1wp-asset-c...nUp.js
windows10-2004-x64
1wp-asset-c...ug.ps1
windows7-x64
1wp-asset-c...ug.ps1
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
15/10/2022, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
wp-asset-clean-up-pro/assets/auto-complete/main.js
Behavioral task
behavioral2
Sample
wp-asset-clean-up-pro/assets/auto-complete/main.js
Behavioral task
behavioral3
Sample
wp-asset-clean-up-pro/assets/chosen/chosen.jquery.min.js
Behavioral task
behavioral4
Sample
wp-asset-clean-up-pro/assets/chosen/chosen.jquery.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
wp-asset-clean-up-pro/assets/icons/icon-cloudflare.xml
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
wp-asset-clean-up-pro/assets/icons/icon-cloudflare.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
wp-asset-clean-up-pro/assets/icons/icon-ie.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
wp-asset-clean-up-pro/assets/icons/icon-ie.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
wp-asset-clean-up-pro/assets/icons/loader-horizontal.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
wp-asset-clean-up-pro/assets/icons/loader-horizontal.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
wp-asset-clean-up-pro/assets/icons/premium-plugins/gravityforms-blue.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
wp-asset-clean-up-pro/assets/icons/premium-plugins/gravityforms-blue.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
wp-asset-clean-up-pro/assets/icons/themes/betheme.jpg
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
wp-asset-clean-up-pro/assets/icons/themes/betheme.jpg
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
wp-asset-clean-up-pro/assets/icons/woocommerce-icon-logo.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
wp-asset-clean-up-pro/assets/icons/woocommerce-icon-logo.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
wp-asset-clean-up-pro/assets/script.min.js
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
wp-asset-clean-up-pro/assets/script.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
wp-asset-clean-up-pro/assets/sweetalert2/dist/sweetalert2.js
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
wp-asset-clean-up-pro/assets/sweetalert2/dist/sweetalert2.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
wp-asset-clean-up-pro/assets/tooltipster/tooltipster.bundle.min.js
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
wp-asset-clean-up-pro/assets/tooltipster/tooltipster.bundle.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
wp-asset-clean-up-pro/assets/wpacu-debug.js
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
wp-asset-clean-up-pro/assets/wpacu-debug.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
wp-asset-clean-up-pro/classes/AdminBar.ps1
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
wp-asset-clean-up-pro/classes/AdminBar.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
wp-asset-clean-up-pro/classes/BulkChanges.ps1
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
wp-asset-clean-up-pro/classes/BulkChanges.ps1
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
wp-asset-clean-up-pro/classes/CleanUp.js
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
wp-asset-clean-up-pro/classes/CleanUp.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
wp-asset-clean-up-pro/classes/Debug.ps1
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
wp-asset-clean-up-pro/classes/Debug.ps1
Resource
win10v2004-20220812-en
General
-
Target
wp-asset-clean-up-pro/assets/icons/loader-horizontal.xml
-
Size
1KB
-
MD5
4736ab1e105207ce7d8a62d29bce9b13
-
SHA1
6521eceda5160b4924c6e006d2dd2985abd1e1a0
-
SHA256
55509258846ba5d7f4eb075fd4f8fa4c2c951b6fc6d9dc8da49728b0b38a3fbd
-
SHA512
9a479c7b9d2b0b7d3b46711b51af7731a1770ce0ba06c4ce8ac6ee876b231be79eb29695f9aea5e5cdba3a95b57c4e985251b1139185584cf1bda0475f53a04c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000009276e201795d58b8cdfef0c8c970b5694bac50e6175dec244d194c19badfc79f000000000e80000000020000200000007736f1c182fafdc23fa6a32568f5f9c721faeb717e863626c9dd405aa225c785900000009725f34e311a80257ed01ec5a11715e763384542f36d84f413ec448335a9ec9f69be484e933b034139470e908da7c323813567f17578ad31288bd96572d8982e8368b7049b2ecfdeb0bb5a255d04134e7063da8d008dfeccd4b7880166cc5f286ab04b5dd0689435525f0ef1d4bcefbae717aa588e9492c5a864bc112783e7b6886fbdd0b9e962c0b7ad5e3f880ef88a400000006a42996c3d2a58c939fbcfb7699720821c2528f04f0e95efa3cda2b229645aee68d44948f6276d889bab149073517d1e142f7c999b8d7db018ed80acbb0f147a IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372606499" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000d4104230d15b19d02d8e26c90d2edfaa645423c769a55de1d84b3740e94e53a4000000000e8000000002000020000000687c939bfe4681bb32fb0eacf6f1d1c658d5bf4da82b6a9d397aa3df36c518e32000000077be307fc9375dee87ccf028d4aa5037d8ca7bae5dc36693785707c8c34a74e7400000007725a047f3d7418c2db8c018c995ce564fafe2d81adad09d6dcd29a67b29345f6f62698870cab7ac95ece2da39a1be17bf204089ddc97360054e960e8d66ab5a IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e45f669ce0d801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90769C01-4C8F-11ED-9201-42465D836E7B} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1732 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1732 IEXPLORE.EXE 1732 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE 1512 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1532 1160 MSOXMLED.EXE 28 PID 1160 wrote to memory of 1532 1160 MSOXMLED.EXE 28 PID 1160 wrote to memory of 1532 1160 MSOXMLED.EXE 28 PID 1160 wrote to memory of 1532 1160 MSOXMLED.EXE 28 PID 1532 wrote to memory of 1732 1532 iexplore.exe 29 PID 1532 wrote to memory of 1732 1532 iexplore.exe 29 PID 1532 wrote to memory of 1732 1532 iexplore.exe 29 PID 1532 wrote to memory of 1732 1532 iexplore.exe 29 PID 1732 wrote to memory of 1512 1732 IEXPLORE.EXE 30 PID 1732 wrote to memory of 1512 1732 IEXPLORE.EXE 30 PID 1732 wrote to memory of 1512 1732 IEXPLORE.EXE 30 PID 1732 wrote to memory of 1512 1732 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\wp-asset-clean-up-pro\assets\icons\loader-horizontal.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1512
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535B
MD53ff9ca3fb553417ce18fb340285faca3
SHA102412396423c2bf8b43e3733408b42fb0f00e8a8
SHA25639ce6e8d8149a68358465125699edb84b605604cd239f9d2d537d90d57bb7544
SHA5125593b4620d287347324133cd0c8497ffe9622861866a095c127848a90a691f96f77101e63a40340c42edfe7285d080749832262533001961d4d2ba085bc79215