Overview
overview
7Static
static
7InstaThund...12.apk
android-9-x86
1changelog.html
windows7-x64
1changelog.html
windows10-2004-x64
1collection...age.js
windows7-x64
1collection...age.js
windows10-2004-x64
1collection...deo.js
windows7-x64
1collection...deo.js
windows10-2004-x64
1collection...ate.js
windows7-x64
1collection...ate.js
windows10-2004-x64
1collection...age.js
windows7-x64
1collection...age.js
windows10-2004-x64
1collection...deo.js
windows7-x64
1collection...deo.js
windows10-2004-x64
1credits.html
windows7-x64
1credits.html
windows10-2004-x64
1libs.ps1
windows7-x64
1libs.ps1
windows10-2004-x64
1webview_error.html
windows7-x64
1webview_error.html
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2023 22:43
Static task
static1
Behavioral task
behavioral1
Sample
InstaThunder_Clone12.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
changelog.html
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
changelog.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
collection_ad_landscape_image.js
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
collection_ad_landscape_image.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
collection_ad_landscape_video.js
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
collection_ad_landscape_video.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
collection_ad_list_template.js
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
collection_ad_list_template.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
collection_ad_square_image.js
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
collection_ad_square_image.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
collection_ad_square_video.js
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
collection_ad_square_video.js
Resource
win10v2004-20230221-en
Behavioral task
behavioral14
Sample
credits.html
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
credits.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
libs.ps1
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
libs.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
webview_error.html
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
webview_error.html
Resource
win10v2004-20230220-en
General
-
Target
changelog.html
-
Size
610B
-
MD5
8d9e3140b5bfb57987ec926cc572cf32
-
SHA1
10cc07c00b97bed8ae17a8ee4aee51bed28170ef
-
SHA256
ea944962e34086eee28548914cf2d9aff5c2f1d45806765e691ba20ccc953efa
-
SHA512
8f809d12359e98d31723a14065e7b54bd0809374126b96b2926b00c5d18885221a3445cab1393e40d26b402d664b95934d66cf94fb70b22f7089bb0308d354a8
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1116269463" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035243" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1063cb456b8fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6E0C50D7-FB5E-11ED-B7D7-6E9A6C474791} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1151896048" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092aa7dfd5903724d8d9575f04dadcf3800000000020000000000106600000001000020000000a1d8605ca17ebd0585950df83fb5e23a2aa79472560dfe8f0df8f1cdf77b61fe000000000e80000000020000200000006f5af4ec9da7ebb20a0c4f2578315021b6b1fe70c50ac1187b4948bf914a5ce7200000005b338ac13df45027cf524a4d08892c55fe014f3f7bc5fbbe4a830b0b357387c340000000578328387071c69bbcd00aeac8f971748021101631555c07f0bc4f3e9516035ab10169ac15b2e8d2b63deab14a3a0aee4bf0981d33e641e78f41ea92ee60528b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31035243" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1116269463" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391826829" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092aa7dfd5903724d8d9575f04dadcf3800000000020000000000106600000001000020000000e01b1b84edbc2a9b5a63914f416fc734fe1699e542b36b3ef6b0e5ba30217dbd000000000e8000000002000020000000be53333096fba0bd5d65d82f79b9c026ba6db59b49f774cde5513f06724eccb020000000e03f6945d8d9c9077b3a4cd152f57c4e459b3d0f76b030e405a2054a3018e11840000000be68f076ef3b7551783605c5da2ed4eb5e81e32c1c929e5aa46c6ae588fd09ad5353275e4e7611f29b5fdfc52e4700c1bc4f32615f8bfdf660375e141b034520 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035243" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ebe7456b8fd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4260 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4260 iexplore.exe 4260 iexplore.exe 3588 IEXPLORE.EXE 3588 IEXPLORE.EXE 3588 IEXPLORE.EXE 3588 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3588 4260 iexplore.exe 83 PID 4260 wrote to memory of 3588 4260 iexplore.exe 83 PID 4260 wrote to memory of 3588 4260 iexplore.exe 83
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\changelog.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4260 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3588
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5856c42fcc41e6055fec4c82eb761c89f
SHA1a13ad86fd12b9f11cca79f825b0be57f44c8fc22
SHA256cb07236840471054f94b674a01baeb951ee2c6f3d41fc8ece6ff095cc7f4a4e8
SHA512f0b518d3722d59cac9f8bcd2b4a06834debbba94a42145177aa50f4bb8579b3e730155f27fcb58636a7f8d4e74cdebf9a47f8c8cfcf167acafeb1ed976ddb1d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5928c9993d046c678d51961be23f47bf6
SHA16d7a645ba1a6f1619a49890c9a1f5434a7512bb3
SHA2564d1e163d8133f64d0376f0ad6873a9f540e803d3056e8a0cb6ea41e76e033110
SHA512dcdf9c3c88c3e97fe8a2cf177f967f89b5717c634cf15d53fe02b4f6348d125fa35f5bad9b04b3418be28f05eb39d464b39ff969116355879503bb9a0ffb32f1
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee