Overview
overview
10Static
static
7636f6e438f...53.apk
android-9-x86
10636f6e438f...53.apk
android-10-x64
10636f6e438f...53.apk
android-11-x64
101bf84a89-2...c0e.js
windows7-x64
11bf84a89-2...c0e.js
windows10-2004-x64
1ad.html
windows7-x64
1ad.html
windows10-2004-x64
1aps-mraid.js
windows7-x64
1aps-mraid.js
windows10-2004-x64
1assign_lab...l.html
windows7-x64
1assign_lab...l.html
windows10-2004-x64
1blood_gluc...l.html
windows7-x64
1blood_gluc...l.html
windows10-2004-x64
1blood_gluc...l.html
windows7-x64
1blood_gluc...l.html
windows10-2004-x64
1blood_pres...l.html
windows7-x64
1blood_pres...l.html
windows10-2004-x64
1consentform.html
windows7-x64
1consentform.html
windows10-2004-x64
1diabetes_r...l.html
windows7-x64
1diabetes_r...l.html
windows10-2004-x64
1dpr_report.html
windows7-x64
1dpr_report.html
windows10-2004-x64
1dtb-m.js
windows7-x64
1dtb-m.js
windows10-2004-x64
1edit_insul...l.html
windows7-x64
1edit_insul...l.html
windows10-2004-x64
1edit_label...l.html
windows7-x64
1edit_label...l.html
windows10-2004-x64
1edit_medic...l.html
windows7-x64
1edit_medic...l.html
windows10-2004-x64
1edit_track...l.html
windows7-x64
1Analysis
-
max time kernel
123s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-10-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
636f6e438f0747a117995a9c6bf15c95fd2f4ba367f5cf5430c6524e615eed53.apk
Resource
android-x64-arm64-20230831-en
Behavioral task
behavioral4
Sample
1bf84a89-28f7574e191c74305c0e.js
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
1bf84a89-28f7574e191c74305c0e.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
ad.html
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
ad.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
aps-mraid.js
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
aps-mraid.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
assign_labels_local.html
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
assign_labels_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
blood_glucose_entry_local.html
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
blood_glucose_entry_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
blood_glucose_local.html
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
blood_glucose_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
blood_pressure_entry_local.html
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
blood_pressure_entry_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
consentform.html
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
consentform.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
diabetes_reports_local.html
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
diabetes_reports_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
dpr_report.html
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
dpr_report.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
dtb-m.js
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
dtb-m.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
edit_insulin_local.html
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
edit_insulin_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
edit_labels_local.html
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
edit_labels_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
edit_medication_local.html
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
edit_medication_local.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
edit_tracker_local.html
Resource
win7-20230831-en
General
-
Target
blood_pressure_entry_local.html
-
Size
2KB
-
MD5
1cdeabe6877fd1045588c42a174a7e01
-
SHA1
376b5eec8b187c05c562e65dea56622501840f77
-
SHA256
2f1b3beb96e982fc3a873335c5117682f212f870d5fc4ee6e0e9c2f9e861f2db
-
SHA512
b3ff351f1ab2a406f8f1b01d6f8ce58052f5edc5307d84c331febe2c972fa3354ecaae2da9f97e278666692ff56a80d020d49c587b184307557b8adfcff234be
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403050726" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53D46F41-66EF-11EE-BA84-F2498EDA0870} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000846f70ae5a5163f60c922717b065d3732218b9ef238dd2cb1552ecf53adaf1f4000000000e80000000020000200000008363d586e61034ed8b2c6dfdcb6c1ad73c63a99ec64303131c063482c51ae2ce90000000879be6163842b14cb62a0b0defc1f0f3d2aae1a4b7db1f2c6b896e7d39a2cd84e643e34faa9a6e6632fe5299fa34bc3cf0db8805c60c2448fa456029b4e8509cde94c1712b7201e805409e51a354515a1a75edfeb35b1c2d5401c7d2032195086e7d26cea0d2478df682bc1b8a343a96906e84ddf0681cb1bff2cb06a91646276268a6ec5356ce32c07407f634895da940000000cfba2c0458e049f224301dc49bede3170c080f75fdee8d0dcbc0efc8bf9b5f0d766ba93f91cbd21f26c888a1e7f1fbb9b5c4ad392e49d8ed0e0acccc0202ff17 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009c112afcfad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000dce4c3835a6b1f5e8d607705787ca99d0d956586bd5f8ae6db1e8456650956c7000000000e800000000200002000000060604b336a2f28b4de7520b95efc7b59cf5314d78def240bf81f74ca17136c0820000000e1e52dfac060157174f271a5f4c0087852c23ea15faafd06b14acb5f8c3f5069400000009428f1bd7ed4cdf16c1389497ce77da0b20efa23c781282aad72af40746c47f0be62808c95fcd3c76b334f1fd9413a008de717cfbdeee30a0c5b123cefe0ad70 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2072 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2072 iexplore.exe 2072 iexplore.exe 576 IEXPLORE.EXE 576 IEXPLORE.EXE 576 IEXPLORE.EXE 576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2072 wrote to memory of 576 2072 iexplore.exe 28 PID 2072 wrote to memory of 576 2072 iexplore.exe 28 PID 2072 wrote to memory of 576 2072 iexplore.exe 28 PID 2072 wrote to memory of 576 2072 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\blood_pressure_entry_local.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570df132cf3e140ce791a094ef486bb81
SHA1d50fccaca339ab4d405cf8e90f4934d25bc63453
SHA2560cd12b28d42e8a54c90fbc840d434cfff3fcd6499e2da29b4d4dc2009063ea7d
SHA5126747fd8b2bf392ea6c24374ab75bf8fa9823cc96008792256939203af7acf1d7c46e4c2b3cfc0802ab4ab71cc414862ad627b161a691db40e91ba8a04642a31e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef98b1c3fa4ac013b07e1f9e6c290a6b
SHA147b3d79a55d8c0cfe964000cc2df4ae7851a04bd
SHA256b087db3361571011ac4d63610babd86be2ad89fe7eb34786d1368d45dae17570
SHA512d6db0dff90e5fa8b8477f3fae5dc95510f29504e939170d8af9189a44a20925c5a20c131e6227df6ce37f2cd7794fb7ff787a94e75502b42439a2f7f447b2902
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ad1ac71fafc2e5b49a2b240dae9e753
SHA19a92f0b093f0633b18d89c399f142a12c9891a91
SHA256c79cf20a4f1da62214b3535807a128bf492918235ddbeb7b8a71794129ee08cc
SHA512523e42bf97dd0a01f319ec168770be22dbc7b13f3cdf0d33c702c6e75453eec8d6c74dd1bafa3d05cf5ae67edce68b0fff8b0953aeab25ae658c875f2a41a26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af47602ae8a817cb22a792be8a484518
SHA1b5e4680f1a7fc41535b95a364e2fad32f0543c56
SHA2560cde9d72f9981a9c311a97b17fcac03a4961866b2f2986258f5453f17b39c389
SHA5122e067de36a05d042764b794d0ce503978d0e6ec90f3163e3a07f2e029b3634c5f32d790feae3cd00182cbe136564150a2f6395730f82fab8a9373191d7c35487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a9b99f947db5f8ec75f2518e775bf92
SHA1337ca490f7361b3761071eab937663f0f4bc2b75
SHA256ae6b64a0e5dfa9a02bd1b476941a63c2c6c1a418bbf176a12d8623a86f5785e1
SHA5128d00cceafa134ea16c53764dfae4387d81396d7dd69c87b58e66a4bc46570f1492fbbf436bf08f428e14b68ca05836052ee5a2a8e22d7df672c8d5ef4a8138db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558703ee2e8f83563efab60c70d78eddb
SHA19be0374d36136283162e169595702315ad38858c
SHA2566b287c586cfdd977ae5ad6aac89b622d7cbe01c2e7e5e880be9f0699e5cab3fb
SHA5122e083891caf7acc05321f814aea7e1faacdb7fee2978cd7798c9936f227842be00f71d4ce78b7343fc9b0c8ff6391103fb058050be7f77c635d35227e86e0682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5910d599d4f176f41a9a25cbb9b97f57d
SHA1d359635c02788a1babac9963b7b38f569f7ebd16
SHA25618ac242e4b315f730a8bacd72533ae2fa83a989522aa29fa248d09ea28a21051
SHA5122faab77c3f2a72b54dcd6797ed7c066dc3ff8da8e84f5c957bf6138cb2156958038954c05fe261b71b0a286180170712492a7a0136a6d564a5b0ef95c98f9310
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b16dfe65c88c6135e8738611bcff3b26
SHA12f6f9d7ac41ca12775b7e582c9b92cc617a0ba7c
SHA256d21be952872f64f0d37c6f0198f268e8e97b57927e41a334456464fbb5d2d6be
SHA512195dedd6230a5976d480f3cb58d93a9c74d8add59d2ec4c295d0ebbdf3879ff5127194c4962c99177b5413109eb8abc7516be88f4901c9280b84ca9aa453f402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5373ea7950638ccbfd249cf114392784f
SHA180b363a61840a767a638f473c4e64994daa2417d
SHA25684f95074cac2b0a7055775652e0664026121dae74b9f899e1f5dd461e1789a41
SHA5121e2cd82a070bcdd130084d90e8de1a552a68a9782e5ea0e40046ff355008285b022309d31612d17ce9a9955dd7f63dc0978a9c681424ee2ce0576ac9475b5cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e57c3144f6b2433fdc30f89f265ddb7
SHA105132a3a0c664b18ca2d2a453398caae1fb1e07b
SHA256b58668070fb5c1cc79c6df38439d81219e23cab04f85efc684baa202f8576677
SHA512487f9722abef3741b6724d38f315073f25a704481661cafb269f235d244684ce41525e32a699d0d26487ecedf771ef6ad1e914868ce1a138e13671f6dbf05ed7
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf