Overview
overview
10Static
static
TS-795WP.iso
windows7-x64
3TS-795WP.iso
windows10-2004-x64
3WP.vbs
windows7-x64
10WP.vbs
windows10-2004-x64
10header
windows7-x64
1header
windows10-2004-x64
1metaphysic/choked.txt
windows7-x64
1metaphysic/choked.txt
windows10-2004-x64
1metaphysic...ts.gif
windows7-x64
1metaphysic...ts.gif
windows10-2004-x64
1metaphysic...ly.ps1
windows7-x64
1metaphysic...ly.ps1
windows10-2004-x64
1metaphysic/preyed.txt
windows7-x64
1metaphysic/preyed.txt
windows10-2004-x64
1metaphysic...es.vbs
windows7-x64
3metaphysic...es.vbs
windows10-2004-x64
7metaphysic/readme.txt
windows7-x64
1metaphysic/readme.txt
windows10-2004-x64
1metaphysic...rs.jpg
windows7-x64
3metaphysic...rs.jpg
windows10-2004-x64
3metaphysic...te.png
windows7-x64
3metaphysic...te.png
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
TS-795WP.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
TS-795WP.iso
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
WP.vbs
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
WP.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
header
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
header
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
metaphysic/choked.txt
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
metaphysic/choked.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
metaphysic/imprints.gif
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
metaphysic/imprints.gif
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
metaphysic/possessively.ps1
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
metaphysic/possessively.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
metaphysic/preyed.txt
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
metaphysic/preyed.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
metaphysic/privates.vbs
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
metaphysic/privates.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
metaphysic/readme.txt
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
metaphysic/readme.txt
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
metaphysic/simmers.jpg
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
metaphysic/simmers.jpg
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
metaphysic/typewrite.png
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
metaphysic/typewrite.png
Resource
win10v2004-20221111-en
General
-
Target
metaphysic/imprints.gif
-
Size
24KB
-
MD5
45a891a5bbc4c25a91a77a06d065ff84
-
SHA1
831e6c38e6153f269cbde79d83ba6765421a9ea2
-
SHA256
32a6cc08ba7a30f462b37a8dc7f71ec0b40318379040fac318dd3a6d43ef9a17
-
SHA512
1287d8c542b45afaf3be53ec6fe00ac1c0c4f1af7a5d95e824afcabf842a7bdbaa2bf86468023c6640f43357a24066f352d24557a7058f943a513f25f7415e89
-
SSDEEP
768:vtqRNUQeWOtaMK7MpIIfTgVCQaDbqKab/iLylG:vE8Qeztan7kBTgVC07WLyw
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e70f9c821e485499698990c21c1a39200000000020000000000106600000001000020000000f2d69908a095ad30cdb596ffff220c022f4d096355422ef72b8a32ae7f089fe7000000000e800000000200002000000018461bee292f83c14f0e939f18536d5f9b419bf910c032ed61e5eff2e182fb3120000000edc059d225f44937e08176bcc66528094d53a7f131d9b4a6cac4165e966cb80a400000003df149ce10911b112390e4c8390c46861e59bc90b50bf3132e280334dc40a77f58ea3e4e453d647d456f2eb9c0ab88be993c3bcd8404d36ba0631e9429b4f1b0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c64f3bf604d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999798" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0104136f604d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5F2B6758-70E9-11ED-B696-E64E24383C5C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "908994569" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "908994569" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999798" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e70f9c821e485499698990c21c1a39200000000020000000000106600000001000020000000a31d4f23d0d1c9c30641ed73450e6aae140cdb04682794c2a7464360c31c97e8000000000e80000000020000200000003bd1b9bf4b9a559eec87be8d9b8b95a99321061477f3ce93368a3c58714d10a020000000877d8d7e8a1f5d0387fdba43dcf91a7808d435e6dd9f8f2a30e3a318b6c0312640000000239509a1558ebc57abeaa505ddf6efeeed87644fd359a7e0a6125567855a8ea8acb3801ae91e78a9cae73b600c3eff0eb41ebc781d8bb62b54e40b16338fb225 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376603302" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1052 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1052 iexplore.exe 1052 iexplore.exe 364 IEXPLORE.EXE 364 IEXPLORE.EXE 364 IEXPLORE.EXE 364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1052 wrote to memory of 364 1052 iexplore.exe IEXPLORE.EXE PID 1052 wrote to memory of 364 1052 iexplore.exe IEXPLORE.EXE PID 1052 wrote to memory of 364 1052 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\metaphysic\imprints.gif1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1052 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx