Overview
overview
10Static
static
7baef3c30e6...ed.apk
android-9-x86
10baef3c30e6...ed.apk
android-10-x64
10baef3c30e6...ed.apk
android-11-x64
10AboutCompat.js
windows7-x64
1AboutCompat.js
windows10-2004-x64
1PinDialog.html
windows7-x64
1PinDialog.html
windows10-2004-x64
1StatusInfo.html
windows7-x64
1StatusInfo.html
windows10-2004-x64
1WebviewSocket.html
windows7-x64
1WebviewSocket.html
windows10-2004-x64
1aboutCompat.html
windows7-x64
1aboutCompat.html
windows10-2004-x64
1aboutCompat.js
windows7-x64
1aboutCompat.js
windows10-2004-x64
1aboutPage.js
windows7-x64
1aboutPage.js
windows10-2004-x64
1aboutPageP...ipt.js
windows7-x64
1aboutPageP...ipt.js
windows10-2004-x64
1about_comp...ker.js
windows7-x64
1about_comp...ker.js
windows10-2004-x64
1ads.js
windows7-x64
1ads.js
windows10-2004-x64
1adsafeprot...ima.js
windows7-x64
1adsafeprot...ima.js
windows10-2004-x64
1background.js
windows7-x64
1background.js
windows10-2004-x64
1bmauth.js
windows7-x64
1bmauth.js
windows10-2004-x64
1bootstrap.js
windows7-x64
1bootstrap.js
windows10-2004-x64
1codemirror...min.js
windows7-x64
1Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2023 20:39
Static task
static1
Behavioral task
behavioral1
Sample
baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
baef3c30e6790572cd2b8f85325279d28aa9c5547ae62ed2d14215fa985a8ded.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
AboutCompat.js
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
AboutCompat.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral6
Sample
PinDialog.html
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
PinDialog.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral8
Sample
StatusInfo.html
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
StatusInfo.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral10
Sample
WebviewSocket.html
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
WebviewSocket.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral12
Sample
aboutCompat.html
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
aboutCompat.html
Resource
win10v2004-20230831-en
Behavioral task
behavioral14
Sample
aboutCompat.js
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
aboutCompat.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral16
Sample
aboutPage.js
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
aboutPage.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral18
Sample
aboutPageProcessScript.js
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
aboutPageProcessScript.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral20
Sample
about_compat_broker.js
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
about_compat_broker.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral22
Sample
ads.js
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
ads.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral24
Sample
adsafeprotected-ima.js
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
adsafeprotected-ima.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral26
Sample
background.js
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
background.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral28
Sample
bmauth.js
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
bmauth.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral30
Sample
bootstrap.js
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
bootstrap.js
Resource
win10v2004-20230831-en
Behavioral task
behavioral32
Sample
codemirror-5.31.0.xml.min.js
Resource
win7-20230831-en
General
-
Target
PinDialog.html
-
Size
23KB
-
MD5
45937ac174e568f5c3eb424f70be1137
-
SHA1
13293d7a58049b53b66ffba2ec6d7dfcb80d4924
-
SHA256
59c9720b29b2ad9982e5efe6f3897888f74aed7f4fe750ddb28920919cf60516
-
SHA512
30268d3bb5df8374509d0858c613161dcf245bf702e0d3344049e91a91c41d38a1fc763f1cf6e534c0fe1cc7b20248ee72f0d6d6d5b98f3fe40f6966c69c157a
-
SSDEEP
384:7xwlSA1lBaD+GD0C/DimrBVUg6eojeSKwtw6n1vdGnC561kt0AlTC1z:lwlDza+S0Uimr7Ug6eo8fqs
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc Process Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08ee882cbe1d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2179878211" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000776f9e01abbbd44483f1dd33e709243e000000000200000000001066000000010000200000000ed7caa868e80ad3a29f86498c31f7ee166afdd3fc1617556490f96a67bc9569000000000e80000000020000200000000c647efd5c3132c4a98a892f28a91b41895a9629308f975d2f0b6b3b4315b05d200000001594f9e3796d5d89a6f4b3085ee2773b1f6389757801d0bddf106c8ad9edc00e40000000795f0c25af55c868354a0d9412d50b1741b9661ae5324cbb57bb4021857047e3513e885b78899fc5abb12266b61c48d901ed1902ee8d782ae8b9e58a4a41b697 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000776f9e01abbbd44483f1dd33e709243e00000000020000000000106600000001000020000000b588daea7fd6ce778b6704e5b876a9d1a79891321f0abcc66bc5be2c557d8efa000000000e8000000002000020000000ef2d7ae3b697d345dd177f51e1f7206cf194206b4e19fc29c44bab5b8217afa0200000007dd1006eff9233edb0a55127c4249eddea3c6b60891472d5a9dcd95bb6b7bafb40000000e78c6c7ee81fc388445a977de481c0bdb18936e9cc3ea7dbbff046e2b851ae0eefcac17894a2bc5d0b0aa3ab292325738b878d5d27fca902aec156ca60bf7351 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31056331" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31056331" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{ACABCAFE-4DBE-11EE-A3D1-4E8EE27A950C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2166753053" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400884158" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2166753053" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31056331" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a8dc82cbe1d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid Process 3440 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid Process 3440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid Process 3440 iexplore.exe 3440 iexplore.exe 4832 IEXPLORE.EXE 4832 IEXPLORE.EXE 4832 IEXPLORE.EXE 4832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid Process procid_target PID 3440 wrote to memory of 4832 3440 iexplore.exe 85 PID 3440 wrote to memory of 4832 3440 iexplore.exe 85 PID 3440 wrote to memory of 4832 3440 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\PinDialog.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3440 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee