Overview
overview
10Static
static
5Accessible.tlb
windows7-x64
3Accessible.tlb
windows10-2004-x64
3Cracker.dll
windows7-x64
1Cracker.dll
windows10-2004-x64
1Data/Language.pimx
windows7-x64
3Data/Language.pimx
windows10-2004-x64
3Data/Main.ini
windows7-x64
1Data/Main.ini
windows10-2004-x64
1Data/Packa...in.xml
windows7-x64
1Data/Packa...in.xml
windows10-2004-x64
1Data/Packa...ce.zip
windows7-x64
1Data/Packa...ce.zip
windows10-2004-x64
1Data/Packa...ls.xml
windows7-x64
1Data/Packa...ls.xml
windows10-2004-x64
Debug/DebugPPF.tmp
windows7-x64
3Debug/DebugPPF.tmp
windows10-2004-x64
3Debug/DebugPPT.tmp
windows7-x64
3Debug/DebugPPT.tmp
windows10-2004-x64
3Debug/Management.log
windows7-x64
1Debug/Management.log
windows10-2004-x64
1Microsoft ...ed.exe
windows7-x64
10Microsoft ...ed.exe
windows10-2004-x64
7Resource.dll
windows7-x64
Resource.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1update-settings.ini
windows7-x64
1update-settings.ini
windows10-2004-x64
1updater.ini
windows7-x64
1updater.ini
windows10-2004-x64
1Analysis
-
max time kernel
191s -
max time network
296s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 20:56
Static task
static1
Behavioral task
behavioral1
Sample
Accessible.tlb
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Accessible.tlb
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Cracker.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Cracker.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Data/Language.pimx
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Data/Language.pimx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Data/Main.ini
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Data/Main.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Data/Packaged/Main.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Data/Packaged/Main.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Data/Packaged/Resource.zip
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Data/Packaged/Resource.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Data/Packaged/Utils.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Data/Packaged/Utils.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Debug/DebugPPF.tmp
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Debug/DebugPPF.tmp
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Debug/DebugPPT.tmp
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Debug/DebugPPT.tmp
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Debug/Management.log
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
Debug/Management.log
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Microsoft Office Pro Cracked.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Microsoft Office Pro Cracked.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
Resource.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Resource.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
libGLESv2.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
libGLESv2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
update-settings.ini
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
update-settings.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
updater.ini
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
updater.ini
Resource
win10v2004-20220812-en
General
-
Target
Data/Packaged/Main.xml
-
Size
1KB
-
MD5
7b53ebd64e5781e02eaefb6739a6b556
-
SHA1
d5332b200cf5dcea0419afdb66a15d89b9eb619f
-
SHA256
b975c9251ef7394dcc69f49e54dc5aa5e8df32f9b5e8c687484ddd840eb94d20
-
SHA512
c4a25c07e19760547e91818ba6e9ec3fe89206c29429668731c7563b7407cb56d8c0adca519bf96dc82a1631e82cfe63b68439cad4102ea2a1df438bac8400fd
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9AFB16FD-6C43-11ED-B696-C264E7FE3618} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e84b8ea34b65849b27eee00a1a979b400000000020000000000106600000001000020000000857701e7b844a585b3ad7edcf33d8b7ed52066b8b8a878293bdcaa05cc89c2cb000000000e8000000002000020000000f24f92e7cac20b9e913462585e14fee1277922a683c5a9064cde09b2827d438520000000a0047d3cce5051c552e3297c4088d41ede1f212a6407dbe75fdb9045d6156ef940000000ae1d9d4fcff57ae2d1876ef68ad89712f0e162748dbda97fdec43298453e77d18cbb5f935368f62177292eef00a7caa1b82f785dc3ed400149f3fd66cda7189d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002e84b8ea34b65849b27eee00a1a979b400000000020000000000106600000001000020000000a6510be50b805836dc649f0323667fda3effd4da1df60d1090d002f5f7664956000000000e800000000200002000000050c1b6e0214fa675c28ad9d770ea64e85c2ec8ac84ea3c8e5953b9e7ae30068c20000000ff313d79b6222e6fb7c13f0e3e8e9631ef424234058beca59e71e581f81c0fb0400000004e4fa039171ec4748ffeffd85ac3cfcea8750714592534f635faeae05b433b5d9a4c1dfafcbda0ea1e65fa692564556fe28dcc3a87d2659e9d91b3dcf4a23dd5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 107787705000d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998608" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998608" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998608" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376092305" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1885741482" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2320896571" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400cd6705000d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2320896571" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1885741482" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998608" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3420 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3420 iexplore.exe 3420 iexplore.exe 440 IEXPLORE.EXE 440 IEXPLORE.EXE 440 IEXPLORE.EXE 440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4400 wrote to memory of 3420 4400 MSOXMLED.EXE iexplore.exe PID 4400 wrote to memory of 3420 4400 MSOXMLED.EXE iexplore.exe PID 3420 wrote to memory of 440 3420 iexplore.exe IEXPLORE.EXE PID 3420 wrote to memory of 440 3420 iexplore.exe IEXPLORE.EXE PID 3420 wrote to memory of 440 3420 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Data\Packaged\Main.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\Packaged\Main.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3420 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5870b615bd1f6e73bcd807d31b8678934
SHA16623daf15f495a66f0738c3c03bdbfd4bc7342d0
SHA256186f4707b61526047271661adc8ffa8357d7a6ac36776d2c3bd1afad6a511fac
SHA512774482b01beea35b1556a531dff40bbde7869225d9dbbde126b825b3bbc342e8529bcbb8f8c367251994ee6b28c41d33b2344bb6d03e82eae04bdee056b23c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5c8f3c219e5c35ead570f95385d6c080e
SHA11564468bf23715595af0130f38fce9cec4b4634d
SHA2564cf1f5138e9e98206368a03886a79a1c45a6910971f7321ba7ce3d5a8568de2c
SHA512a2924fba17469f37b60df067da86122bee800f92810a83663df911261af96947295e367666648032265916a57340fdafa466ea05353d94e1216d40e941841200
-
memory/4400-132-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-133-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-134-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-135-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-136-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-137-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-138-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-139-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB
-
memory/4400-140-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmpFilesize
64KB