Overview
overview
10Static
static
3packages/A...ut.pdf
windows7-x64
1packages/A...ut.pdf
windows10-2004-x64
1packages/A...ts.xml
windows7-x64
1packages/A...ts.xml
windows10-2004-x64
1resources/...IM.dll
windows7-x64
4resources/...IM.dll
windows10-2004-x64
4resources/...sel.js
windows7-x64
1resources/...sel.js
windows10-2004-x64
1resources/...x.html
windows7-x64
1resources/...x.html
windows10-2004-x64
1resources/...min.js
windows7-x64
1resources/...min.js
windows10-2004-x64
1setup.exe
windows7-x64
10setup.exe
windows10-2004-x64
10Analysis
-
max time kernel
138s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-10-2022 07:56
Behavioral task
behavioral1
Sample
packages/Assets/About.pdf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
packages/Assets/About.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
packages/Assets/Assets.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
packages/Assets/Assets.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
resources/AdobePIM.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
resources/AdobePIM.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
resources/carousel/carousel.js
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
resources/carousel/carousel.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
resources/carousel/index.html
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
resources/carousel/index.html
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
resources/carousel/lib/jquery.min.js
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
resources/carousel/lib/jquery.min.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
setup.exe
Resource
win10v2004-20220901-en
General
-
Target
resources/carousel/index.html
-
Size
2KB
-
MD5
4ae648f880552834e7b1eb9cd143c974
-
SHA1
41b24162122c6f4a284e7fd48d95b3a600edb638
-
SHA256
3272e9022f5f25c56d7a54df2f03aafcb1cc8519e9db41af7d8d3a3c63e88cc2
-
SHA512
9ed106d6a490c195c708700a48bbf447ee46f496e6e53ab5ece90d5bc1cb18638b53ceea289a1b5b482f0c8bb7fbaa735f6eee7d8bcdec75c8c4f09464b1de3b
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000008a5cb5d6573b96847a76870228e6c3552d36e7b9cf954f1ee37560b9b83e6b0e000000000e80000000020000200000009ec833dee0d0112950f9b4333a9f095e257a25e840192e05de2a8d4bbf91308020000000144a4ea2e30bda7f1e36a5888f6a4b56e28ba78f237030b91f5cc3a81611c5244000000062067d38f341300f7711679e6cdf40c9f78cb0240595a7792088d184b62eede563d93e8cbbd88caa27edee70b498aa4eb3a85cdff05d231f8446cc8cd9df0071 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0074b043b4ead801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373716243" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DDF95D1-56A7-11ED-A6C3-FE72C9E2D9C9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000f54581d5be8e8f01418c1fd6d19864c4fee34907cb1aa4553edcd521ab4c413d000000000e8000000002000020000000bbb4352b913fe2d0164c2795dbdc66446cf614de879ab057289a7163270af000900000005dd3c1663f177297affe5186b8dbca4abf206470e5afc2ae67d21b0c04db9f88110cdacb9c6b5f7dbf9ef255190ae4aa8f87ed4a8b95d9fa9ffa325104f3dfff280630f5143ccac46988b87fecddee2a25c2c846d204f17e5e42e75ee0414867417f954758480b7cee9fcd3743b7f190568418076013dc6dd28fa6fdd61e1c2a41c09019d1608da09e8b390f3d62059340000000f463c54ef451875d5be9a5072f05b76c3b8668bdba5f56a717b92c311c37f4b9af3384768dcbd87bc9239dea3a219c274f868b4caf048b63649982b3b98d8ae0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1176 iexplore.exe 1176 iexplore.exe 1876 IEXPLORE.EXE 1876 IEXPLORE.EXE 1876 IEXPLORE.EXE 1876 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1176 wrote to memory of 1876 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1876 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1876 1176 iexplore.exe IEXPLORE.EXE PID 1176 wrote to memory of 1876 1176 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\resources\carousel\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1876
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IDUE75OF.txtFilesize
603B
MD56edd5ecccbb1e48b80a4b682f154f790
SHA134b2274db4b2db8512273cce5f986d157cd4da80
SHA256ea6bb7953afde09acb5000e3c50d3de16f1cbebed06d574e016b47b87008b7e9
SHA512540f05699ecea3839e43017eaffea0e46a9ecc1ace582b87d872fdbdbd1257bc423505518a0831433cdd6f98e8f64c91d14caf82baa0b922d8b3daae21f8285f