Overview
overview
10Static
static
7b6b59a54d6...0e.apk
android-9-x86
10b6b59a54d6...0e.apk
android-10-x64
10b6b59a54d6...0e.apk
android-11-x64
10callout_11_shadow.xml
windows7-x64
1callout_11_shadow.xml
windows10-2004-x64
3callout_7_overlay.xml
windows7-x64
1callout_7_overlay.xml
windows10-2004-x64
3callout_8_overlay.xml
windows7-x64
1callout_8_overlay.xml
windows10-2004-x64
1callout_cloud.xml
windows7-x64
1callout_cloud.xml
windows10-2004-x64
3callout_de...le.xml
windows7-x64
1callout_de...le.xml
windows10-2004-x64
3callout_shape_2.xml
windows7-x64
1callout_shape_2.xml
windows10-2004-x64
3callout_shape_4.xml
windows7-x64
1callout_shape_4.xml
windows10-2004-x64
3callout_shape_5.xml
windows7-x64
1callout_shape_5.xml
windows10-2004-x64
3callout_shape_6.xml
windows7-x64
1callout_shape_6.xml
windows10-2004-x64
3help.htm
windows7-x64
1help.htm
windows10-2004-x64
1help_cs.htm
windows7-x64
1help_cs.htm
windows10-2004-x64
1help_de.htm
windows7-x64
1help_de.htm
windows10-2004-x64
1help_es.htm
windows7-x64
1help_es.htm
windows10-2004-x64
1help_ru.htm
windows7-x64
1help_ru.htm
windows10-2004-x64
1help_uk.htm
windows7-x64
1Analysis
-
max time kernel
127s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07-08-2023 20:32
Static task
static1
Behavioral task
behavioral1
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
b6b59a54d67199717390a8f67751019b65be5aa791c2a605a564c897e21fe90e.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
callout_11_shadow.xml
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
callout_11_shadow.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
callout_7_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
callout_7_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
callout_8_overlay.xml
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
callout_8_overlay.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
callout_cloud.xml
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
callout_cloud.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
callout_dest_bubble.xml
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
callout_dest_bubble.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
callout_shape_2.xml
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
callout_shape_2.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
callout_shape_4.xml
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
callout_shape_4.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
callout_shape_5.xml
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
callout_shape_5.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
callout_shape_6.xml
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
callout_shape_6.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
help.htm
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
help.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
help_cs.htm
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
help_cs.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
help_de.htm
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
help_de.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
help_es.htm
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
help_es.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
help_ru.htm
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
help_ru.htm
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
help_uk.htm
Resource
win7-20230712-en
General
-
Target
callout_shape_2.xml
-
Size
4KB
-
MD5
6dc1e0aa43dd2a582b24b6487605fb76
-
SHA1
c403b4c464908b8d740d03775742fdc72a6e8327
-
SHA256
f6ec4c71c9e3ebfc1d23691364cc5736a12c3180ad35e55f4f9dc0fa3ce03669
-
SHA512
3cced4fb52552f26f35eac6eacf8fc408b6f5e251984f486e203777b0889261db83ea127a97b5e53c246456c819b23b6d6209fec1bb3a6df5f173e66de370ce2
-
SSDEEP
96:7OKfvMkrs4v9rTicBaUTnpI5kS0nvVfiYPl9Cb7dMM/SAWicJPjiBwlH:SoT44Vp3hrnvVqY99CR/SAWicgwN
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1532 3476 WerFault.exe 38
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_shape_2.xml"1⤵PID:3476
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3476 -s 4722⤵
- Program crash
PID:1532
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3476 -ip 34761⤵PID:1596