Overview
overview
10Static
static
7Checker.exe
windows7-x64
10Checker.exe
windows10-2004-x64
10LiveCharts.xml
windows7-x64
1LiveCharts.xml
windows10-2004-x64
1LiveCharts...es.dll
windows7-x64
3LiveCharts...es.dll
windows10-2004-x64
3LiveChartsRegion.dll
windows7-x64
3LiveChartsRegion.dll
windows10-2004-x64
3MetroSet UI.dll
windows7-x64
1MetroSet UI.dll
windows10-2004-x64
5NAudio.dll
windows7-x64
1NAudio.dll
windows10-2004-x64
1System.IO....le.dll
windows7-x64
1System.IO....le.dll
windows10-2004-x64
1System.IO....on.dll
windows7-x64
1System.IO....on.dll
windows10-2004-x64
1Vip.Notification.dll
windows7-x64
1Vip.Notification.dll
windows10-2004-x64
1WinMM.Net.dll
windows7-x64
1WinMM.Net.dll
windows10-2004-x64
1World.xml
windows7-x64
1World.xml
windows10-2004-x64
1postproc-54.dll
windows7-x64
1postproc-54.dll
windows10-2004-x64
1swresample-2.dll
windows7-x64
1swresample-2.dll
windows10-2004-x64
1swscale-4.dll
windows7-x64
1swscale-4.dll
windows10-2004-x64
1Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
06/07/2023, 10:44
Behavioral task
behavioral1
Sample
Checker.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
Checker.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
LiveCharts.xml
Resource
win7-20230703-en
Behavioral task
behavioral4
Sample
LiveCharts.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
LiveChartsCountries.dll
Resource
win7-20230703-en
Behavioral task
behavioral6
Sample
LiveChartsCountries.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
LiveChartsRegion.dll
Resource
win7-20230705-en
Behavioral task
behavioral8
Sample
LiveChartsRegion.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
MetroSet UI.dll
Resource
win7-20230703-en
Behavioral task
behavioral10
Sample
MetroSet UI.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
NAudio.dll
Resource
win7-20230703-en
Behavioral task
behavioral12
Sample
NAudio.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
System.IO.Compression.ZipFile.dll
Resource
win7-20230703-en
Behavioral task
behavioral14
Sample
System.IO.Compression.ZipFile.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
System.IO.Compression.dll
Resource
win7-20230703-en
Behavioral task
behavioral16
Sample
System.IO.Compression.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Vip.Notification.dll
Resource
win7-20230703-en
Behavioral task
behavioral18
Sample
Vip.Notification.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
WinMM.Net.dll
Resource
win7-20230703-en
Behavioral task
behavioral20
Sample
WinMM.Net.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
World.xml
Resource
win7-20230703-en
Behavioral task
behavioral22
Sample
World.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
postproc-54.dll
Resource
win7-20230703-en
Behavioral task
behavioral24
Sample
postproc-54.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
swresample-2.dll
Resource
win7-20230703-en
Behavioral task
behavioral26
Sample
swresample-2.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
swscale-4.dll
Resource
win7-20230703-en
Behavioral task
behavioral28
Sample
swscale-4.dll
Resource
win10v2004-20230703-en
General
-
Target
LiveCharts.xml
-
Size
215KB
-
MD5
5be563dcd4b0f60d71384cb31d44aae7
-
SHA1
df3c88103204b8ab85aca2dc7b99f602aee25e02
-
SHA256
ce3283e4afd74377d313f9c1d247afe8164e626c95f710f928734da6cfab9311
-
SHA512
af651258acfb4ae3be78b19c54a39d2c84dfb682b9f897c19cf912eaa35602abe6cbee228cb6d9492052fe71b04d53d3dc34988ff7b55277f4e97b8ece785e3e
-
SSDEEP
1536:mcbn1+gpUi4nQ/iXT/rinSDhnUJ0JUPrejY++Di5wqAzJMO:mcbn1dUi4nQ/iXTDqSDhtY++Di5Q
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73E5B821-1BEA-11EE-8B7F-62AE83E716DD} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e00000000020000000000106600000001000020000000ab8b392a7c3253d1bf1392050eb039e92cb78a5609d7f371b76acb7f66a05c57000000000e8000000002000020000000fe4912a0207d6c20f36eb74fa103b432560f9227e476a5315617c9800857f86b20000000f4ce4f71c78678cc221c1e10bb834d4c3a9a1d5e47fb76cb9cee49ad903387da4000000048c84dc12bb9750583da4f701a8774056bef5b579340f06ad17b7624181c64ae558b1a3dc08fdc86964db6fef7a5768db5663c1a4533d96722e97d24b6cea8d6 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e00000000020000000000106600000001000020000000d40732eabb526a79e486891e2d5d16042c65974504c0e21630e760552ccf22b4000000000e80000000020000200000007015630f35b175f74d28de3c4b7801c2aa654ff10f3a5aedc4f30af4832c804f90000000504cefbdd641502cc6648faca0957865cd5538b728e78bc29b8dc2d1c18f9b3f5ab56e02be4e02c4a877f6071f5a4005ba37705716052688f025083a1f67946a1d2d477fbb118abf731f7a072204f3553244b7f8aac395a44e01eb2a6f6398b6704a7d89934d6d94ab50046aa1352dd8f112e46ecc04bcce63ea270ca00d732d36b9c45262ec5268f5ff604670ea57cb40000000fb5ce2bcf909914c90de8b89dae65e462065aa3a6d8086330bc870351279416d5072dbfa4512fac1d8c2b8c1c606aecf8afd673dd9cb43edb713011fd5b623bd IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395405403" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005e074af7afd901 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2396 2204 MSOXMLED.EXE 28 PID 2204 wrote to memory of 2396 2204 MSOXMLED.EXE 28 PID 2204 wrote to memory of 2396 2204 MSOXMLED.EXE 28 PID 2204 wrote to memory of 2396 2204 MSOXMLED.EXE 28 PID 2396 wrote to memory of 1912 2396 iexplore.exe 29 PID 2396 wrote to memory of 1912 2396 iexplore.exe 29 PID 2396 wrote to memory of 1912 2396 iexplore.exe 29 PID 2396 wrote to memory of 1912 2396 iexplore.exe 29 PID 1912 wrote to memory of 2920 1912 IEXPLORE.EXE 30 PID 1912 wrote to memory of 2920 1912 IEXPLORE.EXE 30 PID 1912 wrote to memory of 2920 1912 IEXPLORE.EXE 30 PID 1912 wrote to memory of 2920 1912 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\LiveCharts.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c50ac6326e74f033089791da853b0539
SHA16923c4d18f91afa88de4237c9047879f2030736a
SHA2563a3c0be89d745be20bbea3bb5ee01021836f1a1d0b60e46f9a8bd5546f4128ed
SHA512071795b87acfd91ad9803b72aba5d77dd34e6bf84422bf16121890ce5268fdaa5ebfc11fc29d7bfd49b5f5822e42451a326d48b7084066f45723599a3b29ddcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595b466667415c00dd82d86090b373a29
SHA1afae7bd96569bce16f3f3fa2fb986b1abbeafd38
SHA256a8112a68768b57ad59fb9aae5d22f4ca8f9df7776d26478993f3ef5ba4c1c16d
SHA51272eea9e8a5f0d8ebb5c4addf792de4b904e2ab7ebb7b988ef97c96d2f877fcaac2aab46d8136270cc17489be27507e16d2506d489c0f833eb49402b0ff7147c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da1f6ae0b0629cfc21ce0dc00fef53f6
SHA1548efb6d1b76c3f22731f8c959662a28a2f80ce2
SHA25625e4a81829fe775107d4225ce7070de97cb4f1e6d2b5a95c65b3e8632887da3b
SHA512554f4b9557b562e8f9a9cc7e1c6243242344f506f04f05da513af8eb3ad4636357ad2c67f22ef32aed07d43fe2a8ab869bc96a74db8dc4ca256dedba7fef1d1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd09809083de6d39265e0d52d90025f5
SHA1dca301129d50fba8f203189a8a92adba8c74b7d9
SHA2566fcd5cab783ec66102f58ef84eee20ba87be8bca831fe35d775c5a58cf5862b8
SHA512834db9342922560f1ca58f1a11e84bb95cff5eaa633151359a1c5a94a4c171d470bcd28273e04d4111aab267fd9ff7b29794704b3332c193cfed802726211502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bfa927f3efc2ec6622371733b8381e1
SHA1e5c07d68a685f833b07910d4d186b1064651a310
SHA256c4d881a695e35fb186c7a09b677d1ee3551e3c177da4c9bc79ad948e0ac1250a
SHA512d2331543f053243101b443da03e94ca859c38ba654a67920e6d0c9512932984c3beb179ee3094add329c151d667f0a4bdc564bc397cf3c74f92b538459c1146e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a2ee03a60ead9bf23dead4484d399d7
SHA15190263e1b444f11bdf4ae5b033f9bce7c5917d0
SHA256ba8094e30a1058e820048d261d78b5970e009b3cd2c165872c1cd1d57c62e381
SHA5128afd51c19124661ed9fb4e1854affe2fab2380dc4fa99154b401707b90ee210b2dc63dab07eba3d3dc94d04daa301c867663e87bfc2f6e82e870d6f4a8eaa67a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2025E2R\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
606B
MD513dacfcb8e9cd8fbea7a902b504f9153
SHA18fee4d91002893eda83f55dc139d3ceed3ec0826
SHA25626cea27c7eefd885bcf397a5c4f6ff062db30f61f0b17f545ede048d3cb5d137
SHA5124617b415d861c042655c15e107b202d43397c4fa2e77964407a214f2cd255b0c2ac630ad74bc026456140fc4db38396b49dfe61228c37e3615a5240bf5331373