Overview
overview
7Static
static
717e7c53050...0b.apk
android-9-x86
117e7c53050...0b.apk
android-10-x64
117e7c53050...0b.apk
android-11-x64
1.html
windows7-x64
11.html
windows10-2004-x64
110.1.html
windows7-x64
110.1.html
windows10-2004-x64
110.2.html
windows7-x64
110.2.html
windows10-2004-x64
110.3.html
windows7-x64
110.3.html
windows10-2004-x64
110.4.html
windows7-x64
110.4.html
windows10-2004-x64
110.5.html
windows7-x64
110.5.html
windows10-2004-x64
110.6.html
windows7-x64
110.6.html
windows10-2004-x64
110.7.html
windows7-x64
110.7.html
windows10-2004-x64
110.8.html
windows7-x64
110.8.html
windows10-2004-x64
110.9.html
windows7-x64
110.9.html
windows10-2004-x64
110.html
windows7-x64
110.html
windows10-2004-x64
1100.html
windows7-x64
1100.html
windows10-2004-x64
1101.html
windows7-x64
1101.html
windows10-2004-x64
1102.html
windows7-x64
1102.html
windows10-2004-x64
1103.html
windows7-x64
1Analysis
-
max time kernel
126s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
17e7c53050f7ea111b2f4d71b553625679eb185e574c3ef92b690927e5258e0b.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
1.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
1.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
10.1.html
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
10.1.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
10.2.html
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
10.2.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral10
Sample
10.3.html
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
10.3.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
10.4.html
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
10.4.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
10.5.html
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
10.5.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
10.6.html
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
10.6.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
10.7.html
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
10.7.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
10.8.html
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
10.8.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral22
Sample
10.9.html
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
10.9.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
10.html
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
10.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
100.html
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
100.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
101.html
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
101.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
102.html
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
102.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral32
Sample
103.html
Resource
win7-20230712-en
General
-
Target
1.html
-
Size
888B
-
MD5
25d0b183d4c751a6d4b4783908b4e8f4
-
SHA1
d2c00767a055fc915791c3d86d70b744a3ee125b
-
SHA256
0fd6e698ab8355a470e91f02ec9183592b5ddf953c9a2bdfb525887881ff782a
-
SHA512
7743f4ce7ce2df7675af96ab33b5de44c41d43583f450e7d62f1524fa3fc4f177438773aaee0c2c7a1bcb5be57212efbe77af928fb7a65b7c5e97a8a84656c3f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054934" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2897263215" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2897263215" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e083acae56dcd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2921169856" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{D825C897-4849-11EE-A3FC-46EA114D2111} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007ce7b7852422c48865386072e9a0d0f000000000200000000001066000000010000200000008d560dc596edf47c891e2dca5954357ad9a21d43a9fbdf23a3f0c2708955b16e000000000e8000000002000020000000f87a64377a80f69805c6480d3fb4043aad1b3c6ac7dbf1a448b355fd15540c972000000066a1863c416f41258a14e49f07445d4a1d2fdb37087ee0058ba17a8be0cf22a240000000544a4847d8f8e018af2cc56f83a78a824d490076f4bd916628edc5e0ed450c9113003c09d1be703140b81e140fca42d131d21c0f6f19ccc8dd076a1bbed08d46 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b096bfae56dcd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31054934" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000007ce7b7852422c48865386072e9a0d0f000000000200000000001066000000010000200000000b0b8c239e30f7c3fe60b303509bb84b0cf05562979791a291b525efc9e00272000000000e8000000002000020000000e89d0e4b87a0054a8350607d7ad408f2df46cb966e3f09c6ca74959c180ff9b620000000a628abb894c15e449f537b91a4a7e0b449c78eede686abbe53d91e5314ec42d54000000088c6ab5d2bf5c51b69e2f017cd31fbc74e2becfc9000f301ccb5b6425ed63f53b82d05890e7fda56d3436d3dbb77a87a185b2d0fca41f318cb8e7c94bd97e2a1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400284225" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31054934" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 3844 IEXPLORE.EXE 3844 IEXPLORE.EXE 3844 IEXPLORE.EXE 3844 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3844 2056 iexplore.exe 82 PID 2056 wrote to memory of 3844 2056 iexplore.exe 82 PID 2056 wrote to memory of 3844 2056 iexplore.exe 82
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3844
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5c890b903fcec9cf731ff05696767d3b4
SHA102173ab9596c44d68deb2376ebdd18681fd35088
SHA2567af23c976085389fd7e24692412ae2f38b6ce66b5494baf6c05465ac336f0811
SHA512cb509b719fad2cbe879a19cfc606cef0a6fb5f61c6bd9baf230c8e124fa755225c50ef7d58eb0889a083fc859015f469a92f09c0bd9eaa5ceab3e8fca85bf01a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52f174ca57abda014d26526bb7bcacf1a
SHA1105f9073e749b6eb5259b6a211b1776ff9e7fb27
SHA256a3ad063d4e3d895f7c6dedeeeeda39f378c134b7632d0d10006a2815215832b6
SHA5121c782c4b04f2691259ebbfc7444fbe3da4dc8270e3839abf93852f18b0f4c7347bdb0cd7e001226972c448390c1dd2ab6451d9d02b954f7c24749065a9ca5104
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee