Overview
overview
7Static
static
7SimplicLoader.rar
windows10-1703-x64
3CraxsRat.xml
windows10-1703-x64
1License.xml
windows10-1703-x64
1LiveCharts...ms.pdb
windows10-1703-x64
3LiveCharts...ms.xml
windows10-1703-x64
1LiveCharts.Wpf.pdb
windows10-1703-x64
3LiveCharts.Wpf.xml
windows10-1703-x64
1LiveCharts.pdb
windows10-1703-x64
3LiveCharts.xml
windows10-1703-x64
1World.xml
windows10-1703-x64
1res/Config/Pass.inf
windows10-1703-x64
1res/Config/maps.inf
windows10-1703-x64
1res/Config...es.inf
windows10-1703-x64
1res/Config...xt.inf
windows10-1703-x64
1res/Config...eo.inf
windows10-1703-x64
1res/Fonts/...ld.ttf
windows10-1703-x64
3res/Fonts/...ue.ttf
windows10-1703-x64
3res/Fonts/...ar.ttf
windows10-1703-x64
3res/Fonts/...ue.ttf
windows10-1703-x64
3res/GeoIP/...-1.ico
windows10-1703-x64
3res/GeoIP/...AD.ico
windows10-1703-x64
3res/GeoIP/...AE.ico
windows10-1703-x64
3res/GeoIP/...AF.ico
windows10-1703-x64
3res/GeoIP/...AG.ico
windows10-1703-x64
3res/GeoIP/...AI.ico
windows10-1703-x64
3res/GeoIP/...AL.ico
windows10-1703-x64
3res/GeoIP/...AM.ico
windows10-1703-x64
3res/GeoIP/...AN.ico
windows10-1703-x64
3res/GeoIP/...AO.ico
windows10-1703-x64
3res/GeoIP/...AQ.ico
windows10-1703-x64
3res/GeoIP/...AR.ico
windows10-1703-x64
3res/GeoIP/...AS.ico
windows10-1703-x64
3Analysis
-
max time kernel
324s -
max time network
435s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
15-04-2023 12:36
Behavioral task
behavioral1
Sample
SimplicLoader.rar
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
CraxsRat.xml
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
License.xml
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
LiveCharts.WinForms.pdb
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
LiveCharts.WinForms.xml
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
LiveCharts.Wpf.pdb
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
LiveCharts.Wpf.xml
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
LiveCharts.pdb
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
LiveCharts.xml
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
World.xml
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
res/Config/Pass.inf
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
res/Config/maps.inf
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
res/Config/supported_images.inf
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
res/Config/supported_text.inf
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
res/Config/supported_video.inf
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
res/Fonts/Hack-Bold.ttf
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
res/Fonts/Hack-BoldOblique.ttf
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
res/Fonts/Hack-Regular.ttf
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
res/Fonts/Hack-RegularOblique.ttf
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
res/GeoIP/Flags/-1.ico
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
res/GeoIP/Flags/AD.ico
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
res/GeoIP/Flags/AE.ico
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
res/GeoIP/Flags/AF.ico
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
res/GeoIP/Flags/AG.ico
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
res/GeoIP/Flags/AI.ico
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
res/GeoIP/Flags/AL.ico
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
res/GeoIP/Flags/AM.ico
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
res/GeoIP/Flags/AN.ico
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
res/GeoIP/Flags/AO.ico
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
res/GeoIP/Flags/AQ.ico
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
res/GeoIP/Flags/AR.ico
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
res/GeoIP/Flags/AS.ico
Resource
win10-20230220-en
General
-
Target
LiveCharts.WinForms.xml
-
Size
26KB
-
MD5
32fb534a5d1468039ab63333c336d841
-
SHA1
9881f184ee203e6e1f82883a4255801f8749cff0
-
SHA256
a39d20b8553196315005a790d0cee6636e123744b67ee5da88c8cc61a05919db
-
SHA512
e599fcbeaa5373829f18c1c153d7471c2e8262611f73341b50dad03b7cfa4efe17577d9e9950ca2d17e0ed018cca0597814b2657708e2d412ecb2c3c5941d41c
-
SSDEEP
192:895swXLeFrnQUFFCPggAkmmST7TzVDN9CTNr3UDUJ0Ja9IxzpPOx/1d+Sz3V/k9D:geM4T7T+r3UDUJ0Ja9SSd+Sc
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d00000000020000000000106600000001000020000000a72c01438dc258ec3b23c98aafd1fcac0ac3fd092a0ba7a312b820ebe93fa364000000000e8000000002000020000000b434def0f42655d41750472a0e642791b2738996153cbde7049707950ddd3d83200000005b2f89dfb259c29b7ae7410369f3388c36d74a5f2a9351562f17ab03964340684000000043adb270240c2b7e75dcfb36003cfec4763337e458faba6117e5a0961ecf04126fcd9fcbedb41d90c5baeeeda4c21d010b7fdafb6042dbfb22a463ee4eca1218 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = e9d1f8769d45d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388334499" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "388383085" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d00000000020000000000106600000001000020000000f94c76995c9c8ad578684e3dccca56581cbdee157bac28c754013dbb331be0ca000000000e80000000020000200000003f28b414478c6a452f066569e7e8018d0313671a130f66a851b9ea4a492bdc8950000000c828d7c9d52a27c8ad342d65084070380323b1b50ea1702a868415bf69c613d18bc4fa0c513829944e9aa8296fecbdd0f28ad317673e09655a30ef01bbeb741aa8eff67e473765eec5e1558c2a15df9640000000c0440299c1a905e19cae2fc228983d33a989ff4392ebb66cf65778a18413c82ac1265098699fddede1136db829b1e4ec14655cc4287d36af469265c778060b3d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d0000000002000000000010660000000100002000000080deaa4ca3a49fd6e2cf48105938f66417852a2653cde8f5bb3405f63fe72d05000000000e8000000002000020000000da096129a3bb151663b59f3d1dd35199838f18f2aa94e2da2296eecfe6f22f50100000009b2fec6b497a41da2a14a5dd766be18340000000ee3e846505b6b9c57652d3421ecf4cb804189f0834b6114557106abe67e984b57f7ee41093525bbbf4b0eddf992c86a1b56c4fbe4cb90df87815040555fa5888 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0488a0fa86fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "239941524" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "239941524" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\User Preferences iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31027112" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "388351093" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3957018B-DB9B-11ED-B673-EAEAA05881DB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027112" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e356a5b32a00045a8a80319a7d3098d000000000200000000001066000000010000200000002ad01a778847a63040e620aa1db95c358d67f0ff285783c8042b6ab58ba44895000000000e8000000002000020000000d9c665ffd7746e7d7cec9219efc0eae8f784b1fcc583bda951effd3bfbfe276b20000000affcb418baa4761ca12b8087c287088a12d5e90df8ca87c4d0c53b7a824a49d04000000031e019c966731ad01ff3b689d0dcaaa25b806dd4c3beaf131d8a648b1284b5ac15b1234f8572987c8d897587252f94a62e17286a1a469216fa346e46707ab8b3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d1a60fa86fd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4624 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4624 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4624 iexplore.exe 4624 iexplore.exe 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE 2244 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 3536 wrote to memory of 4624 3536 MSOXMLED.EXE iexplore.exe PID 3536 wrote to memory of 4624 3536 MSOXMLED.EXE iexplore.exe PID 4624 wrote to memory of 2244 4624 iexplore.exe IEXPLORE.EXE PID 4624 wrote to memory of 2244 4624 iexplore.exe IEXPLORE.EXE PID 4624 wrote to memory of 2244 4624 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\LiveCharts.WinForms.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LiveCharts.WinForms.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4624 CREDAT:82945 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2244
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5d92d78557e1e883971d3f17d8b611b38
SHA110918305fca58d5e023f8a73c73c1a5a66c0a07f
SHA2563696799c9e793c52481d7084e47f992f8ab85e64160950b82c203b38f8d0685e
SHA5121719236165e99075f596a00809a83ab758c82894b33bdf8c39d84229aa7f74b8337e455553555ae80900ebf523106ca1aa1816a005f286feaa5dfb58a1955c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5b6073dae1ba57950f9e9f080ba7463a4
SHA1df5b18d4fe57cf3fb80883a233f9b438888582e7
SHA25618b9bf4b08e00c85154dad6706271ca009a293dad4141c2cbc0918e7603809db
SHA5124e598710fb4af610fbfb56cf352916b6f65594eceff86b38283254620d10fd8a3184c0c701cec56d4369a69e7b9bedeea554da3fd6262bdcbc98b446dff8d6c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoFilesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verEFD3.tmpFilesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZJB0AHXO\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\2OW7BBJ0.cookieFilesize
237B
MD50aa567c8fbebe84510c80c2a831146e4
SHA1dcc2aeebb4a805ebccfe493d78199d658c3b788b
SHA2564144cb355db5557142d722f7b9472bbb7f39c39e7ee06a5a67a84dd2fb10a5d9
SHA5123ac9c8d6f242f348be7ed8745fd615944ca2351daa650980d57236e54da9638b0184e881bedc5030622dd13fbffaa755e82767538e42f47a989c54e2a87331de
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\XXL43G8U.cookieFilesize
604B
MD547951abf2fc507d7361351f67677c994
SHA1e7dfc7568286a54bf57b352ae75512051ed46d23
SHA25620f1b63e3eaabcd9069d1f7b44cb9043c663206fa5ef8e10ada4c71ab6c7a81e
SHA512e36d253c5bd74ad1a7e561270fb0cd438669de3a0d92cb623b3e43544b6183f495a5c87a83152009a51f2d6e7936e1cff36e29058067a1d2499f5a416b150b2c
-
memory/3536-120-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-124-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-123-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-122-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-121-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-117-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-119-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB
-
memory/3536-118-0x00007FFD0EA30000-0x00007FFD0EA40000-memory.dmpFilesize
64KB