Overview
overview
3Static
static
17ccc89d824...a4.apk
android-9-x86
17ccc89d824...a4.apk
android-10-x64
17ccc89d824...a4.apk
android-11-x64
1main.js
windows7-x64
1main.js
windows10-2004-x64
1cnb.js
windows7-x64
1cnb.js
windows10-2004-x64
1ms_com.sankuai.png
windows7-x64
3ms_com.sankuai.png
windows10-2004-x64
3mscwxjs.js
windows7-x64
1mscwxjs.js
windows10-2004-x64
1native-bundle-main.js
windows7-x64
1native-bundle-main.js
windows10-2004-x64
1picasso-co...dle.js
windows7-x64
1picasso-co...dle.js
windows10-2004-x64
1web-holder.html
windows7-x64
1web-holder.html
windows10-2004-x64
1wxjs.js
windows7-x64
1wxjs.js
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
7ccc89d8248cf5a36ca14d3682a42b17826dccd40e57d46ebe903158f11380a4.apk
Resource
android-x86-arm-20230824-en
Behavioral task
behavioral2
Sample
7ccc89d8248cf5a36ca14d3682a42b17826dccd40e57d46ebe903158f11380a4.apk
Resource
android-x64-20230824-en
Behavioral task
behavioral3
Sample
7ccc89d8248cf5a36ca14d3682a42b17826dccd40e57d46ebe903158f11380a4.apk
Resource
android-x64-arm64-20230824-en
Behavioral task
behavioral4
Sample
main.js
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
main.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
cnb.js
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
cnb.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
ms_com.sankuai.png
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
ms_com.sankuai.png
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
mscwxjs.js
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
mscwxjs.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
native-bundle-main.js
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
native-bundle-main.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
picasso-controller-bundle.js
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
picasso-controller-bundle.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
web-holder.html
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
web-holder.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
wxjs.js
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
wxjs.js
Resource
win10v2004-20230824-en
General
-
Target
web-holder.html
-
Size
987B
-
MD5
e2651ac08bf8304bcbcae8d542352f29
-
SHA1
8f4d51cce8318d70b5dd6314a9bcb330e2c92b83
-
SHA256
f8b90ce2cd1442702ec972bed4ed4a853b7ac3df3884b39612676e2510b51a0b
-
SHA512
fa969934d8145c440a38e66bb8bc9efab061dc5853d05e2dc22fd60bae43ed5329e4c9849f8cf0dfcc00f493c41a80c0d10baa0241cc3aa047a1a07fb3fb0114
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1114871325" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054532" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90a30d44c4dad901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400111388" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1127216561" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e70746b52f6804aba4142285479e7a800000000020000000000106600000001000020000000d82d65af2e42d36acba85d56efa32c2ea37da8f5fe221b75a78b6b2d5e5b770f000000000e8000000002000020000000dbab5404db83f72bdaa12a07017f47447701ea5170279dd0ff7f0838849b4ecd200000001c432986136c5602bcf5b1236fbbd74e76197d7bfd4e2cd635eb1b7e87620266400000004f8e9feaf59b71ee48deb37726aaabad16c26ac92aa123a67c8b92ec6a6b7ec9f609e9ad781bcd2c28a9828d48eaeb49b2367b817edcaebda80f0283b6882703 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31054532" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6DC01B98-46B7-11EE-B699-72A452026D15} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054532" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e70746b52f6804aba4142285479e7a800000000020000000000106600000001000020000000686bd78a2d2b679eb5186b8bd718569455e70f8abc0792bb79ae9e0c5b09e721000000000e80000000020000200000005e502c1439b6a85a1b81acd9482513e1d1919f9945641f8a6f7795b8222a08952000000015d8b785e34bd6998c42379227fd2f26f1a17488ae0052019f1b126a181128a34000000055c94d05e38d821fe4dd4f48cd53f2f08a9748abd40d6c556443c9f1e2f71f0b407acbe17b088069c620a86f86adf14f38089c2f226c517cff5d4662aef0ffdd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1114871325" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60451e44c4dad901 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1376 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1376 iexplore.exe 1376 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 1376 wrote to memory of 2900 1376 iexplore.exe IEXPLORE.EXE PID 1376 wrote to memory of 2900 1376 iexplore.exe IEXPLORE.EXE PID 1376 wrote to memory of 2900 1376 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\web-holder.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1376 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD54f13bc92872c28cd9af3da8be58b9832
SHA1254033a5138e6103c30220cf296b4997e273b104
SHA2569d34e64ebac6002c473b499156bea9f6bdac4131ba5288fe791aea71ace9f008
SHA512458e33366c78f8c7bd26611bb3253bc2feeac7aa1bb3c5cc657507bff2ef688b940fe2be18daab79ae5f8cd51073bc7bbf225d3af679336c86ef8faf29e9fe82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD505a45595e449d0cdffd181f2ed0d51a3
SHA1deaff703640085864f6f0efb205a36c54e2909d0
SHA25633dd41488a47d359225a144f8826028574ed67214ccca01e6e11e145039b273c
SHA512446de30455e61fb2628256c1adba277de76a8fea33915eef3069482858be58636cabfc886ccd6c27ca3dcc262bf1105988bd55b0668cb7d8db2cd4ff9ce0f963
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C7IPBQYV\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee