Overview
overview
10Static
static
76245fa1646...6e.apk
android-9-x86
106245fa1646...6e.apk
android-10-x64
106245fa1646...6e.apk
android-11-x64
10actionsQueue.js
windows7-x64
1actionsQueue.js
windows10-2004-x64
1mraid.js
windows7-x64
1mraid.js
windows10-2004-x64
1omsdk-v1.js
windows7-x64
1omsdk-v1.js
windows10-2004-x64
1shape_01.xml
windows7-x64
1shape_01.xml
windows10-2004-x64
1shape_02.xml
windows7-x64
1shape_02.xml
windows10-2004-x64
1shape_03.xml
windows7-x64
1shape_03.xml
windows10-2004-x64
1shape_04.xml
windows7-x64
1shape_04.xml
windows10-2004-x64
1shape_05.xml
windows7-x64
1shape_05.xml
windows10-2004-x64
1shape_06.xml
windows7-x64
1shape_06.xml
windows10-2004-x64
1shape_07.xml
windows7-x64
1shape_07.xml
windows10-2004-x64
1shape_08.xml
windows7-x64
1shape_08.xml
windows10-2004-x64
1shape_09.xml
windows7-x64
1shape_09.xml
windows10-2004-x64
1shape_10.xml
windows7-x64
1shape_10.xml
windows10-2004-x64
1shape_11.xml
windows7-x64
1shape_11.xml
windows10-2004-x64
1shape_12.xml
windows7-x64
1Analysis
-
max time kernel
74s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2023 01:24
Static task
static1
Behavioral task
behavioral1
Sample
6245fa164605d119c883a056c185f3fd9c502eba4ef08290bdc053b0db68466e.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
6245fa164605d119c883a056c185f3fd9c502eba4ef08290bdc053b0db68466e.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
6245fa164605d119c883a056c185f3fd9c502eba4ef08290bdc053b0db68466e.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral4
Sample
actionsQueue.js
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
actionsQueue.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
mraid.js
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
mraid.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
omsdk-v1.js
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
omsdk-v1.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
shape_01.xml
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
shape_01.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
shape_02.xml
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
shape_02.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
shape_03.xml
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
shape_03.xml
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
shape_04.xml
Resource
win7-20230220-en
Behavioral task
behavioral17
Sample
shape_04.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
shape_05.xml
Resource
win7-20230220-en
Behavioral task
behavioral19
Sample
shape_05.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral20
Sample
shape_06.xml
Resource
win7-20230220-en
Behavioral task
behavioral21
Sample
shape_06.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
shape_07.xml
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
shape_07.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
shape_08.xml
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
shape_08.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
shape_09.xml
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
shape_09.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
shape_10.xml
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
shape_10.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
shape_11.xml
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
shape_11.xml
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
shape_12.xml
Resource
win7-20230220-en
General
-
Target
shape_05.xml
-
Size
471B
-
MD5
d088bfa4b1e206c8c5ed88405855f767
-
SHA1
1cc0925ff6a38384f466560cc86b1afcadbeb15c
-
SHA256
2f7924e1f2537622b8617a051765bd4fe57272e9f14a37f4bbe127269c522434
-
SHA512
d1ceda7c098a5934f1808d9b89bcb7fa8809a1f084e915ea0c12ee9070b854ae9d625eaccee3af3db5d50a07438eeb346b01ea73463fe5e34b988a7663321b79
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B75099D8-FAAB-11ED-B7D7-6A8031F758F8} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31035064" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000069cb57b62929e46aa26df38262c68b900000000020000000000106600000001000020000000953af8a81c2dd16edd07d24dedfe1cd7f3db51b633001e407931f9c9ac132ab0000000000e8000000002000020000000830b737881ac71a098881b06f301d9b2fccb14d1c91fae21a1c478a7c5507f7820000000f8b2cf9e1876a308f01f142bbb10ad2f7ff86a0df32176dab9cd58d767c3563040000000a89df42bf3d8c01136ee76c93116549539942ea49fc1851050872d25cc7c3cfb338ee3ee8741bba9f4d80755d9d8dd2edd19ce7fb0b9801c4ccf77af22e74c0c iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309ac68db88ed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2345013971" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035064" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ccae8db88ed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2345013971" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2360482946" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000069cb57b62929e46aa26df38262c68b900000000020000000000106600000001000020000000d6e4a16a7e8f76de8b0f324071e6fc0f85e0c0df0ca7f0a73e59050f692cb493000000000e8000000002000020000000940e589b523d5d804434cf89e0abe052f088ab743bf4a2723083171edba15fa02000000088d2f0fa715876a038f5c3d2712be44c9d419b5eef0bd2ce3815f7a21e1ca65b40000000d1f6dce5134e6b9d81e01d135b28d1de4f52580076616f0bfdb4c7204afae395cca50188994e88695e259080260110491a802a61e2af199f0774255f55480876 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31035064" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "391750069" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2648 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2648 iexplore.exe 2648 iexplore.exe 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE 4924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 536 wrote to memory of 2648 536 MSOXMLED.EXE 82 PID 536 wrote to memory of 2648 536 MSOXMLED.EXE 82 PID 2648 wrote to memory of 4924 2648 iexplore.exe 84 PID 2648 wrote to memory of 4924 2648 iexplore.exe 84 PID 2648 wrote to memory of 4924 2648 iexplore.exe 84
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_05.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\shape_05.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD53fbb8ee33354096d9f116c557a402d14
SHA1f75756c42d45d1047eb04fa54bd7702f5560df4b
SHA25613e2696561dd0955e1d61f7e18166c8bd7a02faf1dbfe04e738b5d68cc2ca57e
SHA512cc21e56f9278282b3c15964b5618d42bdfda83b245d7bf01d12550aabd69a9747d1deaa5a9a9830e6d6a47465f580e21e0a7621cf992b56244ad4bee8779c338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57425e07b117e8df0fb2097633f01cc7d
SHA11d0ecd4fba772dde868840ddaa86dce47ad80d35
SHA2567621dad46b84317c4aed7989b67e564ba3290f253a9ceec38fe97163ad5f6f8e
SHA512daeb235bd3637cf8e1dc66d0521da102d688e633e878d0a83c51f4274a185caf499646ff7cf3bb3d71a20bda2057c7a1222919ee088a531d3e4bf4724dd20117
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee