Overview
overview
7Static
static
7Roborock_4...re.apk
android-9-x86
6captcha_day.html
windows7-x64
1captcha_day.html
windows10-2004-x64
1captcha_night.html
windows7-x64
1captcha_night.html
windows10-2004-x64
1darkmode.js
windows7-x64
1darkmode.js
windows10-2004-x64
1detect.vbs
windows7-x64
1detect.vbs
windows10-2004-x64
1sr.vbs
windows7-x64
1sr.vbs
windows10-2004-x64
1Analysis
-
max time kernel
127s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2023 13:36
Static task
static1
Behavioral task
behavioral1
Sample
Roborock_4.0.99_Apkpure.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
captcha_day.html
Resource
win7-20230712-en
Behavioral task
behavioral3
Sample
captcha_day.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
captcha_night.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
captcha_night.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
darkmode.js
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
darkmode.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
detect.vbs
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
detect.vbs
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
sr.vbs
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
sr.vbs
Resource
win10v2004-20230703-en
General
-
Target
captcha_day.html
-
Size
9KB
-
MD5
6aa4fedbb4d043003ab584c23d80e3ce
-
SHA1
3a8ee32c33d6652264f43c5af598134bf6d0d284
-
SHA256
12724a0c15e7efcd1f26f2f97ad6da5de24bb84fb6a181d366101b1ec2df51b5
-
SHA512
a2fe6a6f97767dcb10d09c1d77e4b9134cca1862c3ee4ec06eb3c97088a8bc2587205184c361974c7b989e9dcc8200d6ab88b4b2b8ecf5c4d2947043021557cd
-
SSDEEP
192:hT26Fa/4AfeEicxTSTiwRSLRob5WlUfWMjRdWVbqxx9eMJJkb2kDXjdL2h3zrRrT:FOqleMJznqw
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31051846" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c0bcd746d0d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398958008" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee5868703000000000020000000000106600000001000020000000a11c67eee7953fdd287f053f47b0fc25497283a8bbbc98b494cede355767fa35000000000e8000000002000020000000c5c05f974b724fa18baabdb8d333afaa4a790d116ae476ccf51f1da3ed5948c32000000088c22788e818865a03e279cff7f50e2c316a61f2d50d116eba3163febf1e7ae740000000efce63cecc1c2b7faa797decf4616f8bf16bd88a94d2f76794bc9bcb843798373174bb075efcf909d7462c55b985ac8a9975ac403cac81b807a6361f76ffdb6a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31051846" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3607292883" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b4885326af1dd94bb4dd17ee586870300000000002000000000010660000000100002000000041f2a691765240dcc4d6507467d59647b884292bf3983592e1e6525d9c7a35c4000000000e80000000020000200000009b847d4645481205f1b59f5122af67ef6c3a1e796af5f9d5a1e14b16da7ed94b20000000456a50f70cf6213c76aa7736cae1e02def9030d8713741ae734992ca44aa88d0400000007779ad11396712abe4c80cb900bf1c220e1e900e6ad832487c994e619ee4eba402f9d77f199f6e2b16dc20e26f7e5d890c473fc27b42ec851b564dffff3d66d5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dab0d746d0d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3579324163" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3579324163" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31051846" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{00B1AE8E-3C3A-11EE-84C0-E2F5CE34D8FF} = "0" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4408 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4408 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4408 iexplore.exe 4408 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4408 wrote to memory of 2548 4408 iexplore.exe 80 PID 4408 wrote to memory of 2548 4408 iexplore.exe 80 PID 4408 wrote to memory of 2548 4408 iexplore.exe 80
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\captcha_day.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4408 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5e2b36434d392eb5e6625407eba6114da
SHA1f6fa993d4253689dc3829b6992c137dcf5ad6c46
SHA256f53cfd169854a1104c9035f88f158e6f9ead0ae0ed573ca84a05cbb8881d0fc6
SHA512d81c0699ac168e3f6d510a473615f73552ba2d83c82aefa25b162c0018701ab8baa3b1a5389774d8309aaa04f9d74518af98f8265f699f647c08bcfe1c5381cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5261083f634f2fb05fd3734052758a351
SHA1d9562d2b11ab81f51588a2e2b982ba99f8da2928
SHA256d855a530261a4f8a13b5d91d1a4207b206ca46d03f085c9ad18d30714b6ef8fe
SHA512421284450b3657e42cb43d80a64ef26153b262dc50db0071b092b6e2a86735d4fcf772dc92c9810afd1cca69bff3109e60c78cd77453bd3793c03ae6f04c237f
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee