Overview
overview
7Static
static
7SimplicLoader.rar
windows10-1703-x64
3CraxsRat.xml
windows10-1703-x64
1License.xml
windows10-1703-x64
1LiveCharts...ms.pdb
windows10-1703-x64
3LiveCharts...ms.xml
windows10-1703-x64
1LiveCharts.Wpf.pdb
windows10-1703-x64
3LiveCharts.Wpf.xml
windows10-1703-x64
1LiveCharts.pdb
windows10-1703-x64
3LiveCharts.xml
windows10-1703-x64
1World.xml
windows10-1703-x64
1res/Config/Pass.inf
windows10-1703-x64
1res/Config/maps.inf
windows10-1703-x64
1res/Config...es.inf
windows10-1703-x64
1res/Config...xt.inf
windows10-1703-x64
1res/Config...eo.inf
windows10-1703-x64
1res/Fonts/...ld.ttf
windows10-1703-x64
3res/Fonts/...ue.ttf
windows10-1703-x64
3res/Fonts/...ar.ttf
windows10-1703-x64
3res/Fonts/...ue.ttf
windows10-1703-x64
3res/GeoIP/...-1.ico
windows10-1703-x64
3res/GeoIP/...AD.ico
windows10-1703-x64
3res/GeoIP/...AE.ico
windows10-1703-x64
3res/GeoIP/...AF.ico
windows10-1703-x64
3res/GeoIP/...AG.ico
windows10-1703-x64
3res/GeoIP/...AI.ico
windows10-1703-x64
3res/GeoIP/...AL.ico
windows10-1703-x64
3res/GeoIP/...AM.ico
windows10-1703-x64
3res/GeoIP/...AN.ico
windows10-1703-x64
3res/GeoIP/...AO.ico
windows10-1703-x64
3res/GeoIP/...AQ.ico
windows10-1703-x64
3res/GeoIP/...AR.ico
windows10-1703-x64
3res/GeoIP/...AS.ico
windows10-1703-x64
3Analysis
-
max time kernel
381s -
max time network
443s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
15-04-2023 12:36
Behavioral task
behavioral1
Sample
SimplicLoader.rar
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
CraxsRat.xml
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
License.xml
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
LiveCharts.WinForms.pdb
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
LiveCharts.WinForms.xml
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
LiveCharts.Wpf.pdb
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
LiveCharts.Wpf.xml
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
LiveCharts.pdb
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
LiveCharts.xml
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
World.xml
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
res/Config/Pass.inf
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
res/Config/maps.inf
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
res/Config/supported_images.inf
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
res/Config/supported_text.inf
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
res/Config/supported_video.inf
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
res/Fonts/Hack-Bold.ttf
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
res/Fonts/Hack-BoldOblique.ttf
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
res/Fonts/Hack-Regular.ttf
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
res/Fonts/Hack-RegularOblique.ttf
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
res/GeoIP/Flags/-1.ico
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
res/GeoIP/Flags/AD.ico
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
res/GeoIP/Flags/AE.ico
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
res/GeoIP/Flags/AF.ico
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
res/GeoIP/Flags/AG.ico
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
res/GeoIP/Flags/AI.ico
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
res/GeoIP/Flags/AL.ico
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
res/GeoIP/Flags/AM.ico
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
res/GeoIP/Flags/AN.ico
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
res/GeoIP/Flags/AO.ico
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
res/GeoIP/Flags/AQ.ico
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
res/GeoIP/Flags/AR.ico
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
res/GeoIP/Flags/AS.ico
Resource
win10-20230220-en
General
-
Target
World.xml
-
Size
112KB
-
MD5
28a1e2b477ebe7de49df597a4117c28e
-
SHA1
a7cfdaa2e2307f443bead3b1f02e6936772020d6
-
SHA256
cbd20c5ccc5b11718b782547bb5b818fe368168c1794b2254fed7333959757da
-
SHA512
087622b16c9165f8007455b161df4f2e6bf1a5de787c73e3beeaee4583c5bad2b2bdb6320ff61e9b036543342045ff3bed6fc3aa1ed885ce7afa0a619967b38d
-
SSDEEP
1536:qu4P6sZgrZzXA/hmK5ITweUbPyTOQnSwBnN1RSC4OHKtPrAnyfUZyUtDl5+jZ4uq:7
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "388351103" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "388383095" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "290524893" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "349900484" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027112" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "290524893" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e29a19a86fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027112" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 43f289759c45d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f020b519a86fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d66200000000020000000000106600000001000020000000285bc51f136c1af64344c3e2362d29ac790c658cebd5a5ebf5a2b6966c6e1d17000000000e8000000002000020000000d53df973a71f26db7101182b1b106f4a875b210487c37c3712ab7cc0c5269af9100000004eaefa78819d4503493ed82146a4e31e4000000079de0a1c55562a2aec21543976a4c8c2e049b85ef9edc025404ac62ed6fb33fffeb8290f19ea0d6f6d9314c15ce57d7dba6beeb2d7a6e0ec714512d4b15bebf3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31027112" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d66200000000020000000000106600000001000020000000cc5d5d415203c1668eb4bbc0d6276dd0c6ab7b1bf95eaf661013b414171e49eb000000000e8000000002000020000000334dafba3fce81e1a35047f9965711421d258671d19b4b5594ad6b94cae26bd32000000054edef80b5d87faf01557f9805ab4ad3bfd2be24fd1b11481313be72a381a03640000000be695ed61ecdb9f6898a640a478eedadd456420b4428297fc45d16360cc4490124ed5074e0a90e493834de7ea3095fcb9a19a76fbe0137c6e57ea94710e01d2d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d662000000000200000000001066000000010000200000004b37256fdd553f9b380608c55b5a28c72188e8b4367abd78652785a7048890cc000000000e800000000200002000000050323837683d71065fff4b4db7cacb84a2d9c66d1354b557de60ba62081e4e7f20000000fdaf739372c16d2df5257ce7a1d548c76447a7eb84cd49d3adb9a57f1f528de340000000ce55bcf10e2e90694bb08add9087c744f7158f43bff56b9a8960d27eb1dff5591a3ecd618c88c76e78409b69671607edae25583f070aa3808c6ed03073bc909f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000997a23a2ecd7164cbfc0800bd950d662000000000200000000001066000000010000200000006151d5ed1468f4838dfe7e872ee48ce3ddf5df502d5de9107fcb3878e74032ea000000000e80000000020000200000002a799a9b93b1530c63238c4a4a936167de077e625678851167e0f1cf286a819250000000b63d94cb3dc992d0da0db5c9645dc198565bd622c241a06b61b52c98449b03bbd25752d5fd74c14c741dda813a350d5418f2abde25f59229823948a3b190ca20a9353b5d90db440c297e445383265a654000000031d833cc585b5ecff98d4db9592a2ff4a34e6b688b751416266312593b907cb91d5aa7cba21eb7a1173865343bf7f35f1df8470878171824f90303e5fb0bf96d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388334509" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3816 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3816 iexplore.exe 3816 iexplore.exe 4928 IEXPLORE.EXE 4928 IEXPLORE.EXE 4928 IEXPLORE.EXE 4928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 4120 wrote to memory of 3816 4120 MSOXMLED.EXE iexplore.exe PID 4120 wrote to memory of 3816 4120 MSOXMLED.EXE iexplore.exe PID 3816 wrote to memory of 4928 3816 iexplore.exe IEXPLORE.EXE PID 3816 wrote to memory of 4928 3816 iexplore.exe IEXPLORE.EXE PID 3816 wrote to memory of 4928 3816 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\World.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\World.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3816 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5d92d78557e1e883971d3f17d8b611b38
SHA110918305fca58d5e023f8a73c73c1a5a66c0a07f
SHA2563696799c9e793c52481d7084e47f992f8ab85e64160950b82c203b38f8d0685e
SHA5121719236165e99075f596a00809a83ab758c82894b33bdf8c39d84229aa7f74b8337e455553555ae80900ebf523106ca1aa1816a005f286feaa5dfb58a1955c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5a5af68290588e93db081bb9a18039503
SHA1a821965eb5579f5a4392f89b3767de83db204571
SHA256ee81bb38a0feff5cfb65c1ced8e9559e1627c9ce0e687f4f7c22b4c7e7936592
SHA512edde7da168a78f40f9b38b15e42a4145fe1eef9de3743d888ae8edde74cc4a87155e6446a6200efaa6d17aaa2a5cc0c2c5c6865ccca72b93bf3b5b82a4faa697
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\480JMPRZ\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5ERKHJ2B.cookieFilesize
242B
MD5f589a67f35a110cad23568453bdbca22
SHA18c70e8577fb82444716d0c8173a5ab3b126bf8cc
SHA2566244576b59c0d73f015fa0d1602c4154079f7b1ac2e7127b9a07c03b8f680462
SHA51243903b6a90cc616f7fcce23b0ddc2dfdfeaf872f0aaa51d594ada1bf0e4c2c2744fe7608e6fa26c5db17c72aa6e3d3dcc620d735ce1e6a1d4637e7d6caf63965
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\TEAU4HDP.cookieFilesize
609B
MD5a35f0cb17643f9592bc6003336b82607
SHA117bea62744a5c3cd38b51980308aa3b0394cc185
SHA25600b1804cf99c7b63eab33ac7fb163c055cd5e352d4ea44990fd772fde9aa8f5d
SHA5121b8e513b8b879ec865b04dd028689c541205f60a82989c02615dae7a82601a4f8b78971c1bd2f34a31e74797ee63e1b6d4fd30dbc8496dc8bbeecddc355090d5
-
memory/4120-124-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-128-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-127-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-126-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-125-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-121-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-123-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB
-
memory/4120-122-0x00007FFD1B510000-0x00007FFD1B520000-memory.dmpFilesize
64KB