Overview
overview
3Static
static
IBRA_30-12...V3.rar
windows7-x64
3IBRA_30-12...V3.rar
windows10-2004-x64
3MODELMAPEO...v3.map
windows7-x64
3MODELMAPEO...v3.map
windows10-2004-x64
3MODELMAPEO..._c.lua
windows7-x64
3MODELMAPEO..._c.lua
windows10-2004-x64
3MODELMAPEO..._s.vbs
windows7-x64
1MODELMAPEO..._s.vbs
windows10-2004-x64
1MODELMAPEO...ta.xml
windows7-x64
1MODELMAPEO...ta.xml
windows10-2004-x64
1[IBRA-2022...o2.col
windows7-x64
3[IBRA-2022...o2.col
windows10-2004-x64
3[IBRA-2022...o2.dff
windows7-x64
3[IBRA-2022...o2.dff
windows10-2004-x64
3[IBRA-2022...nt.vbs
windows7-x64
1[IBRA-2022...nt.vbs
windows10-2004-x64
1[IBRA-2022...a1.txd
windows7-x64
3[IBRA-2022...a1.txd
windows10-2004-x64
3[IBRA-2022...v2.col
windows7-x64
3[IBRA-2022...v2.col
windows10-2004-x64
3[IBRA-2022...v2.dff
windows7-x64
3[IBRA-2022...v2.dff
windows10-2004-x64
3[IBRA-2022...v3.col
windows7-x64
3[IBRA-2022...v3.col
windows10-2004-x64
3[IBRA-2022...v3.dff
windows7-x64
3[IBRA-2022...v3.dff
windows10-2004-x64
3[IBRA-2022...t2.col
windows7-x64
3[IBRA-2022...t2.col
windows10-2004-x64
3[IBRA-2022...t2.dff
windows7-x64
3[IBRA-2022...t2.dff
windows10-2004-x64
3[IBRA-2022...ta.xml
windows7-x64
1[IBRA-2022...ta.xml
windows10-2004-x64
1Analysis
-
max time kernel
74s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-01-2023 05:00
Static task
static1
Behavioral task
behavioral1
Sample
IBRA_30-12-2022_Mina_2_V3.rar
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
IBRA_30-12-2022_Mina_2_V3.rar
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
MODELMAPEO-IBRA2022-Mina2v3/MODELMAPEO-IBRA2022-Mina2v3.map
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
MODELMAPEO-IBRA2022-Mina2v3/MODELMAPEO-IBRA2022-Mina2v3.map
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
MODELMAPEO-IBRA2022-Mina2v3/mapEditorScriptingExtension_c.lua
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
MODELMAPEO-IBRA2022-Mina2v3/mapEditorScriptingExtension_c.lua
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
MODELMAPEO-IBRA2022-Mina2v3/mapEditorScriptingExtension_s.vbs
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
MODELMAPEO-IBRA2022-Mina2v3/mapEditorScriptingExtension_s.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
MODELMAPEO-IBRA2022-Mina2v3/meta.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
MODELMAPEO-IBRA2022-Mina2v3/meta.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
[IBRA-2022]Mina2/chaleco2.col
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
[IBRA-2022]Mina2/chaleco2.col
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
[IBRA-2022]Mina2/chaleco2.dff
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
[IBRA-2022]Mina2/chaleco2.dff
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
[IBRA-2022]Mina2/client.vbs
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
[IBRA-2022]Mina2/client.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
[IBRA-2022]Mina2/cueva1.txd
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
[IBRA-2022]Mina2/cueva1.txd
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
[IBRA-2022]Mina2/cueva1v2.col
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
[IBRA-2022]Mina2/cueva1v2.col
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
[IBRA-2022]Mina2/cueva1v2.dff
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
[IBRA-2022]Mina2/cueva1v2.dff
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
[IBRA-2022]Mina2/cueva1v3.col
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
[IBRA-2022]Mina2/cueva1v3.col
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
[IBRA-2022]Mina2/cueva1v3.dff
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
[IBRA-2022]Mina2/cueva1v3.dff
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
[IBRA-2022]Mina2/helmet2.col
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
[IBRA-2022]Mina2/helmet2.col
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
[IBRA-2022]Mina2/helmet2.dff
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
[IBRA-2022]Mina2/helmet2.dff
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
[IBRA-2022]Mina2/meta.xml
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
[IBRA-2022]Mina2/meta.xml
Resource
win10v2004-20220901-en
General
-
Target
[IBRA-2022]Mina2/meta.xml
-
Size
371B
-
MD5
b8aff0d3a15ef9e4f2d2fb5061e071ea
-
SHA1
2625b7f1fd8630405d36425eed8dd7b18255d331
-
SHA256
6a19deed347a04ee8969b64245c5e5ea9c8b1a036c74234f17bb4ab88abec15d
-
SHA512
5576f3646d89e08303af2d1f842b5b66cd97c7198ae7cd7162684f3e5d9cfe426805d0b67a449bd30acf32c5addf0d27099accd31dd5bea5cfded46b25bbf732
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d4cc674b26d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9222DF61-923E-11ED-A064-6A6CB2F85B9F} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff5d81ba6c2228438fbfca15163ece4b000000000200000000001066000000010000200000003e9fed64ae3723db2b4d1cf036c898666addd4da0aa87b59ab7c887315961351000000000e800000000200002000000060f85259e73aafed4712ca60294fda877814bf33bdb7623f831353b573596e9b9000000013b6565ac23a3f5ecbefefcc6ee384b0170a85365b744bfe9990aa25941963ec407059c1f1175a59ddd31b6232652e4efc6e9bee28380893e6bf7422ec237e3cce0c35ab906b2c6760684e6abb9480a2ab2fd148ef07ba9dc10431db7dda8339befad7500d78a38c834ce5e087f3b4db1e400b862451bb57c34eb0eae981aa243901c41c647bb65163f55415e835fa5d400000002a2470966d86294797550f55099d0c72816c4d72011094142586560a2a37d2812a836ea9d9c68fb6abc92252b0d2effbda7a5c531b52f04e8848e0f9f16829c9 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ff5d81ba6c2228438fbfca15163ece4b0000000002000000000010660000000100002000000053103067a3c1e9bd616db94afa74dfb65a1eacf39f9f883b3c58a50e1d25d07b000000000e8000000002000020000000d1c94d4deea0cff2af4402ea4b98080c88f59ab29d96f3039cd738bdeab84cf32000000065075caad58696ca85a85309599ad9926e9e4c9fd33343456c706b5bcc7479b440000000ca467ef1c7cbeb2709fce8f4855bcef3cb3fb1901f912fad53de5492ec9477e9924715df17db376d7c311c09e516429d5a2058563862705551b8a95d38f34022 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380268277" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1484 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1484 IEXPLORE.EXE 1484 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE 2040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1516 1032 MSOXMLED.EXE 29 PID 1032 wrote to memory of 1516 1032 MSOXMLED.EXE 29 PID 1032 wrote to memory of 1516 1032 MSOXMLED.EXE 29 PID 1032 wrote to memory of 1516 1032 MSOXMLED.EXE 29 PID 1516 wrote to memory of 1484 1516 iexplore.exe 30 PID 1516 wrote to memory of 1484 1516 iexplore.exe 30 PID 1516 wrote to memory of 1484 1516 iexplore.exe 30 PID 1516 wrote to memory of 1484 1516 iexplore.exe 30 PID 1484 wrote to memory of 2040 1484 IEXPLORE.EXE 31 PID 1484 wrote to memory of 2040 1484 IEXPLORE.EXE 31 PID 1484 wrote to memory of 2040 1484 IEXPLORE.EXE 31 PID 1484 wrote to memory of 2040 1484 IEXPLORE.EXE 31
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\[IBRA-2022]Mina2\meta.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD56468a9f2d12372fdb98a8d3e6d2aa414
SHA13a89b6d51a2c379af82880d1b252247239c8446c
SHA256bd687b44a5ee778a209139a312e19f9f24f304d58e3cfdf9e1275d7b8d45766b
SHA51219bba332e50e1ab4cf05a4f8849f0c1f8cacced259d0668245a562c7c8200caa9e2c101f608fef54ec863a145d65bfb3416533c730159d7d1f1299d11eaeb400