Overview
overview
10Static
static
76c90dfc63b...f5.apk
android-9-x86
106c90dfc63b...f5.apk
android-10-x64
106c90dfc63b...f5.apk
android-11-x64
10CheatSheet...s.html
windows7-x64
1CheatSheet...s.html
windows10-2004-x64
1CheatSheet...n.html
windows7-x64
1CheatSheet...n.html
windows10-2004-x64
1CheatSheet...s.html
windows7-x64
1CheatSheet...s.html
windows10-2004-x64
1chartjs-pl...min.js
windows7-x64
1chartjs-pl...min.js
windows10-2004-x64
1hammerjs.js
windows7-x64
1hammerjs.js
windows10-2004-x64
1jquery-3.4.1.min.js
windows7-x64
1jquery-3.4.1.min.js
windows10-2004-x64
1library.swf
windows7-x64
3library.swf
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3com/google....class
windows10-2004-x64
3com/google....class
windows7-x64
3Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2023 22:06
Static task
static1
Behavioral task
behavioral1
Sample
6c90dfc63bce24689c0c5922f8eac1779c01156dc54c3066bae8ca65198949f5.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
6c90dfc63bce24689c0c5922f8eac1779c01156dc54c3066bae8ca65198949f5.apk
Resource
android-x64-20230824-en
Behavioral task
behavioral3
Sample
6c90dfc63bce24689c0c5922f8eac1779c01156dc54c3066bae8ca65198949f5.apk
Resource
android-x64-arm64-20230824-en
Behavioral task
behavioral4
Sample
CheatSheet-Algebra_zs.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
CheatSheet-Algebra_zs.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
CheatSheet-Derivatives_en.html
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
CheatSheet-Derivatives_en.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
CheatSheet-Derivatives_zs.html
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
CheatSheet-Derivatives_zs.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
chartjs-plugin-zoom.min.js
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
chartjs-plugin-zoom.min.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
hammerjs.js
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
hammerjs.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
jquery-3.4.1.min.js
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
jquery-3.4.1.min.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
library.swf
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
library.swf
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
com/google/android/gms/dynamite/descriptors/com/google/android/gms/measurement/dynamite/ModuleDescriptor.class
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
com/google/android/gms/dynamite/descriptors/com/google/android/gms/measurement/dynamite/ModuleDescriptor.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService$zza.class
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService$zza.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService$zzb.class
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService$zzb.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService.class
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
com/google/android/gms/measurement/internal/AppMeasurementDynamiteService.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
com/google/android/gms/measurement/internal/zzh.class
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
com/google/android/gms/measurement/internal/zzh.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
com/google/android/gms/measurement/internal/zzi.class
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
com/google/android/gms/measurement/internal/zzi.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
com/google/android/gms/measurement/internal/zzj.class
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
com/google/android/gms/measurement/internal/zzj.class
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
com/google/android/gms/measurement/internal/zzk.class
Resource
win7-20230712-en
General
-
Target
CheatSheet-Derivatives_zs.html
-
Size
51KB
-
MD5
474fb21ed6466ad2aed3f7a5d3cc490d
-
SHA1
24cdbaec78c1c2a3b409af9253f0e896d28a9f71
-
SHA256
2c7af38860a1c0b8430499d5ebf66a2582e3b71c50687c304faf4f1f4b4463a6
-
SHA512
cfc6721a73e96059ae7f95e32635e03fb0ab64421a62c527ddeec153e283c03013f413a065b6bc32d9f716e75bb21deeb291a1b15697d996d9d059b354a20bff
-
SSDEEP
768:omnahvTUXSAYQ/zrwdR6Aml9LOOJFP+VH0G8SY0ANC:z27U8JuFP+VnlYTNC
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05111036ad8d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31053930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31053930" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cefb026ad8d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "399852722" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "5220199" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2BCD6826-445D-11EE-A61E-C615F1EABC99} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31053930" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "5220199" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "42096498" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a388214700000000020000000000106600000001000020000000f1f84464f99fcaaa1125de689bacabb92d462af2e71490ed5a167d5e7d4b1509000000000e8000000002000020000000c1962f9e9f2a352d52479a6cffafc8e65cc075bdbafa22343f00782cb58956ed20000000cbf159e84c4f54efa31f2d8e169069e230ac19b8fdbfa53f526895d5e5501a06400000004cfdcb3c8d302ffe69c8a3c16601405b9ef8127c06b0310ddd99387bba14e72b3f23869fed2179b06addd0e61c2e013dcffad341c22ba2320ef6cdfb9d7d9bb6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a388214700000000020000000000106600000001000020000000ba7039a95ce3755cb961662dc9f5ebcef32bd407c3b10d76c75a30ad4478d394000000000e80000000020000200000007041ac3142cda2df3f4776eaf9fe9abd83267f21f5efa8f2d328f2ad45cdbb35200000000bea11a3f84266cff8573c8d7ff869f262af2cb8ddcc796b883a8d68d0d5552940000000ecae34dafb8f3702398e831a85d3ae7faf40eebea5b28bc4d42f974b2f1da31d8b606fbf42448ca63c2c1dd4dc0870776d7af44e7a4d154e1355bbf99263cc1b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 532 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 532 iexplore.exe 532 iexplore.exe 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE 1472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 532 wrote to memory of 1472 532 iexplore.exe IEXPLORE.EXE PID 532 wrote to memory of 1472 532 iexplore.exe IEXPLORE.EXE PID 532 wrote to memory of 1472 532 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CheatSheet-Derivatives_zs.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:532 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5b76a23b37666a7437d014c8f45e0c843
SHA1fac0f80c6161321ab45222f5c7b74a9d14fe0aa7
SHA2561fa8f775e6d41cf817e2a89d7b35a469f8c511b5e6f2092afc58bad8e743075f
SHA512483c9f960400347614dce89560af6be1547627438af1a0464c9ccee9e8906df6957b68ae547dfce5adf384d5f4eccd2145e568c386c300a073d254bedf7bc24a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5ea1e7a7ffd0440412f351c343174951e
SHA1da7a13ffa852b505eb4445152275413e7919a042
SHA256fa8b45de9e62fdc808d038be7fcb930b8a16b7f3271937a23862691151db42ce
SHA5121507b5071715eea42af6e109a782720d0a78282ad1b04f1fe58490080a27c5a0ce4c2cd2cecfb24f396432290729270acf40e783001c9f903877db92eb4c8b0c
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee