Overview
overview
7Static
static
7download/Pardakht.apk
android-9-x86
download/Pardakht.apk
android-10-x64
download/Pardakht.apk
android-11-x64
download/f...m.html
windows7-x64
1download/f...m.html
windows10-2004-x64
1download/f...m.html
windows7-x64
1download/f...m.html
windows10-2004-x64
1download/f...m.html
windows7-x64
1download/f...m.html
windows10-2004-x64
1download/f...m.html
windows7-x64
1download/f...m.html
windows10-2004-x64
1download/i...n.html
windows7-x64
1download/i...n.html
windows10-2004-x64
1download/j...n.html
windows7-x64
1download/j...n.html
windows10-2004-x64
1download/j...n.html
windows7-x64
1download/j...n.html
windows10-2004-x64
1download/j...n.html
windows7-x64
1download/j...n.html
windows10-2004-x64
1download/j...t.html
windows7-x64
1download/j...t.html
windows10-2004-x64
1download/w...0.html
windows7-x64
1download/w...0.html
windows10-2004-x64
1download/w...d.html
windows7-x64
1download/w...d.html
windows10-2004-x64
1download/w...1.html
windows7-x64
1download/w...1.html
windows10-2004-x64
1download/w...2.html
windows7-x64
1download/w...2.html
windows10-2004-x64
1download/w...3.html
windows7-x64
1download/w...3.html
windows10-2004-x64
1download/w...0.html
windows7-x64
1Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
04-07-2023 04:16
Static task
static1
Behavioral task
behavioral1
Sample
download/Pardakht.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
download/Pardakht.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
download/Pardakht.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
download/fonts/eot/IRANSansWeb(FaNum.html
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
download/fonts/eot/IRANSansWeb(FaNum.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
download/fonts/ttf/IRANSansWeb(FaNum.html
Resource
win7-20230703-en
Behavioral task
behavioral7
Sample
download/fonts/ttf/IRANSansWeb(FaNum.html
Resource
win10v2004-20230621-en
Behavioral task
behavioral8
Sample
download/fonts/woff/IRANSansWeb(FaNum.html
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
download/fonts/woff/IRANSansWeb(FaNum.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
download/fonts/woff2/IRANSansWeb(FaNum.html
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
download/fonts/woff2/IRANSansWeb(FaNum.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
download/img/favicon.html
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
download/img/favicon.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
download/js/bootstrap.min.html
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
download/js/bootstrap.min.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
download/js/jquery.min.html
Resource
win7-20230703-en
Behavioral task
behavioral17
Sample
download/js/jquery.min.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
download/js/parallax.min.html
Resource
win7-20230703-en
Behavioral task
behavioral19
Sample
download/js/parallax.min.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
download/js/script.html
Resource
win7-20230703-en
Behavioral task
behavioral21
Sample
download/js/script.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
download/webfonts/fa-brands-400.html
Resource
win7-20230703-en
Behavioral task
behavioral23
Sample
download/webfonts/fa-brands-400.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
download/webfonts/fa-brands-400d41d.html
Resource
win7-20230703-en
Behavioral task
behavioral25
Sample
download/webfonts/fa-brands-400d41d.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
download/webfonts/fa-brands-401.html
Resource
win7-20230703-en
Behavioral task
behavioral27
Sample
download/webfonts/fa-brands-401.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
download/webfonts/fa-brands-402.html
Resource
win7-20230703-en
Behavioral task
behavioral29
Sample
download/webfonts/fa-brands-402.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
download/webfonts/fa-brands-403.html
Resource
win7-20230703-en
Behavioral task
behavioral31
Sample
download/webfonts/fa-brands-403.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
download/webfonts/fa-regular-400.html
Resource
win7-20230703-en
General
-
Target
download/webfonts/fa-brands-401.html
-
Size
104KB
-
MD5
f4bdd85a576812f553ec3cfea8b1a2b5
-
SHA1
380bea4e9eb484d835d89cc608f2af7c3179e8a4
-
SHA256
3fe890d088ecf0cc9bc1b9069201e52972dbad6237865524090e15982d0de718
-
SHA512
bee31cd02a25885c9bb0e8eab268a836aa80efbfd82f724652dae32a68c56078e5d069b7fb447e30432fee5f94564f6e07685b568496ffcadb07ed0c51f305ce
-
SSDEEP
3072:Q5M7ZAZsXQhcMCxRuc+6q/SNY4GvEjLs8:GM7+ZGQhrCm/6qKHjLd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20b076602eaed901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395209160" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c50000000000200000000001066000000010000200000009285f4f0d1b579e8d146ca1d9fe8960208249bae4b127850b987c4025c7e3be9000000000e8000000002000020000000427206a3b1d699ca84f2e32588ce69800b27186de970db7c68ea8704adec78419000000094232e3fce49be9292dbcf4bff1a1f3fb8cb1e69f80fc91dddcb1fb9bbbd851127c4151d580631fcf7a4a9a69031a841ddd50cdff24ee60d08ac6d4a1e8740216c1b42106f2e4fd1b552ea88d2bf8c8fb4d072a07ba44d30f4e565fd31909f8f69c057d7fb70c04360c58d5f38110b2bf0a0ce483694f928ca06b4b3335d8e83edea893d8c31d60953d5e7b83f4da87a40000000f77fcb0b452323fca98ddeead5d33ee8616e97e3d76c7734668a5f8ae78a583909be8fa9b8f3c13e3fdc9b7c21b5a5bf519f54aa363f3934ead267f72041cfac iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ab35dbc53fd45498f88cda789e11c5000000000020000000000106600000001000020000000eb51734cbc7b2f259453585fc7951049d89e3c1a6f5d765128487e295c899a5a000000000e8000000002000020000000d8c39ff266c79e32cdfd2ba7e910262429075d1c5c205fd36c037c6a94453bdd200000008d7c8e81a6df86ec14d6caeddc76fa2c83e95eb705b8fa3b8dbe53e8b690de6f400000006307c9054bc16378d6b0d7b3380e35b7c2b5f6b48e11195c9c91eff781039a85dc0d2d1a5cd312bed3e70a2f444e026172fc4e7c39d6d6db73968b94b9c18025 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8ACA9801-1A21-11EE-8C76-725E84185631} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 296 iexplore.exe 296 iexplore.exe 736 IEXPLORE.EXE 736 IEXPLORE.EXE 736 IEXPLORE.EXE 736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 296 wrote to memory of 736 296 iexplore.exe 28 PID 296 wrote to memory of 736 296 iexplore.exe 28 PID 296 wrote to memory of 736 296 iexplore.exe 28 PID 296 wrote to memory of 736 296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download\webfonts\fa-brands-401.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:736
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51359639167aeef9df6590ac181e2df32
SHA144836484da0f14663bd36ffeed8f28d87bf0f56a
SHA25613767b44d881e0152b94f9bb276cd45bc05f25ea27f19e12ccd2165b5540a7fc
SHA512128312a028fba901c7b0ffa82328a207e4af6ef8eefedb7bae97a401668488d2962ca8b759c573942a4b4c6e74e508cf54f4cbcbf264ad006edabf4573bd877f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cef16e8b0ed60985ff5aef4574b9030
SHA1c71d6e1486c3869130854212cc5a82f1d7eebb26
SHA256622c21b3b49692c817d856efea625c201896c265b560c7caf567fc8d4ef1bb9c
SHA51262c0e76836c16f978e1e953bcdfde607b6093f24a751e15434a63c8cca161381a8b2b5018656a84e18a50456c067febd8b0b8b60c11fd023c47ef5fb7430dea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510fa5e5ff3a197b8ee1b48514b2eed8b
SHA1137087d48f6b537a4904470cb1d5c800b4d4d860
SHA256b7c8d51cda5cb47ca49b633d08d59eea78589ec69ab5ef323c7d7d15eca5dbef
SHA512cdae8d8ec143cab96b580d627f56a3d634b4e9066eb304a83202eb8fea312e5c2cd123ab7c5a0423b60cd1c4f23b26706d4d16a78bb0736f3ca74403fc56482b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5292807b75c6085a7bb4ece1bfcab3dfe
SHA176f70e0f3d997458fe6365b9ce727eb8568c1c56
SHA256a35cb5997ce7ebda5cbd28728596c5a325a04c93b40ee6fdb4a7d12c114192cb
SHA5129dc23f3f11d45f428d9867aac59701b9719165abf95bcd4fd590fa98faa251358c24a821576a583fca28a8b09ecd2cc2990a18e875abf749edbc9249f7a9aae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19ca363dcfa839137b8453cc9c9e91c
SHA186d0dcf03a1872cfcf20c8817eaf245ed1b386fc
SHA25630fc2f3020f00861f7fc4b668f9f6bf28996e92347a330f50b83dcbf936ca1e9
SHA51290af6f8d8eee97bf9b3a64e9920046ceef169e9e677e1080056b0c76f7d7b99c8857b7f3b8217053f091d433fbfa1d82c4664109e797fe2e7c30db60f7533ebe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d1b534b95df2af866b419e24836d15a
SHA1d963a39b0b4ac282029b9643c65700b914a062c6
SHA25685ad85b74358c0d878dcabab5516d4192afb723ee618914f5c985e4691405b30
SHA512573c2983273a1f812b091f7467bc74168bd31dbe49b164918b2000670079686e716ed2f70721b958ed2f0980394f005d2d369c531fc862c023fb7a437786175b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c911276afd7f9bdeab94651a1671051
SHA1bc95977d1732e3f8c1c2377b21b7aea11145da8a
SHA2562b50ae1656d0bf40b8cf82d5a28e6b5e46ba6d51fd254ff385d530b80c5b2cc0
SHA512c9b203f383928190043db6c518456e17e95ee6cb440d61462156f6ab9c9d60a48499fb420c54971e4c446d8f770a1ce0f85992cf5fe00bde32591f5d8c9c3802
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
601B
MD5697c366988de9e7c0b62927f56595ac6
SHA18eb7509e37babc1e1cee8bb654dc2ea8f819b6d8
SHA2563f7fa60ed0052f50b372608439e5a5f9bebb374e3319d23ee884c7ccf6f832cf
SHA51205fe8981a50cb298dd602c42e20934fcb4585b4741700aa5f102dbfccbbf4355d450f5ae384bb105137fbc567105d1bcd1c26bcba336c8f2fb08dbca804c89ee