Overview
overview
7Static
static
7Sonic.EXE ...d .apk
android-9-x86
410 de 10.html
windows7-x64
110 de 10.html
windows10-2004-x64
1BfFuckingDies.html
windows7-x64
1BfFuckingDies.html
windows10-2004-x64
1Keel.html
windows7-x64
1Keel.html
windows10-2004-x64
1Milky.html
windows7-x64
1Milky.html
windows10-2004-x64
1a treta.html
windows7-x64
1a treta.html
windows10-2004-x64
1bothCredit...o.html
windows7-x64
1bothCredit...o.html
windows10-2004-x64
1can-can.html
windows7-x64
1can-can.html
windows10-2004-x64
1du ai luke...a.html
windows7-x64
1du ai luke...a.html
windows10-2004-x64
1f de fudeu.html
windows7-x64
1f de fudeu.html
windows10-2004-x64
1festinha.html
windows7-x64
1festinha.html
windows10-2004-x64
1soundtestcodes.html
windows7-x64
1soundtestcodes.html
windows10-2004-x64
1superidold...u.html
windows7-x64
1superidold...u.html
windows10-2004-x64
1tooslowcutscene1.html
windows7-x64
1tooslowcutscene1.html
windows10-2004-x64
1tooslowcutscene2.html
windows7-x64
1tooslowcutscene2.html
windows10-2004-x64
1truegameplay.html
windows7-x64
1truegameplay.html
windows10-2004-x64
1video.min.js
windows7-x64
1Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
Sonic.EXE 2.0 Optimized .apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
10 de 10.html
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
10 de 10.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
BfFuckingDies.html
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
BfFuckingDies.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
Keel.html
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
Keel.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
Milky.html
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
Milky.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
a treta.html
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
a treta.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
bothCreditsAndIntro.html
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
bothCreditsAndIntro.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
can-can.html
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
can-can.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
du ai luke laike ai nidi yo poweee bruda.html
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
du ai luke laike ai nidi yo poweee bruda.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
f de fudeu.html
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
f de fudeu.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
festinha.html
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
festinha.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
soundtestcodes.html
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
soundtestcodes.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
superidoldexoneyobinikekienda mas miku.html
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
superidoldexoneyobinikekienda mas miku.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
tooslowcutscene1.html
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
tooslowcutscene1.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
tooslowcutscene2.html
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
tooslowcutscene2.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
truegameplay.html
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
truegameplay.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
video.min.js
Resource
win7-20230831-en
General
-
Target
can-can.html
-
Size
62KB
-
MD5
bfcef5edc42aa6b1564f2d6ab1e0488e
-
SHA1
d1234272436fca051504cd1bc7cc19ed5b2eec4f
-
SHA256
b2b35721a6aa99dbf5afaa1948cc27170efd6c700f235d1c864f5ba421c900fb
-
SHA512
7c4b26dd388ad764661ecb1fd3df31a3a863dd9c09b97bb14bd75feae0b9da834881eeab9043ed73d05d417d1d1420d21ac39c0912e869115836a07bf1aaa2c7
-
SSDEEP
1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++1:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131549" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000000fc08b7338845c9a47cb674ed49aeaf70b346632cd388c3a0d7913d461bba21a000000000e800000000200002000000085d67fc351334fbb7fc211e71ea92ec75200a5547a36971779faf814ef93093620000000077683d6a806df40baef21f692095fba331a73b5466a25e1e23b01c9861ad75140000000f5a658be6c58853f2fdc504e844947d479f00b05517c0956b8fc2c9ca4c8054f338a7ce61c5189e25b69d5444e1d605970113b5358bedf7632b75c9a5c7f4fd9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{824829E1-67AB-11EE-964A-C6004B6B9118} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000003a1c02c31786a468be77f6a9b6c66bb66750a04e36d05b21bf56d00e1adadd7d000000000e80000000020000200000004f92b6e96470138a27dfc07981492c017d9cbcd1e92dd7ecab7e602789f001aa90000000e5499241fd6b2982a64fe6967fe8d9eeeac8801cb1e1058e220f35147ae3d7f9bf2eabbbe7df6e91fc988a94a4829f5f1dbdd2c25a75af3d97c524c3ca0267093cd63b9b82cd24ede2da25021e606d724b92ac9806663efa2034a9c422a7a19b95fac888594c8996cfd0f249562cacbbe0b2086047c533161daf1430282637403b55ce3c2d7d1dca24c7a4163075762e40000000029ef96a591a65fac3de901025796414c7a61cf6c76f429646c751f03dcebf3df82d428261eb41589e5535e9825ba3f5bcc0f4cf8e7bc31be3cf0769af63aebb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bd2559b8fbd901 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3060 iexplore.exe 3060 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2704 3060 iexplore.exe 28 PID 3060 wrote to memory of 2704 3060 iexplore.exe 28 PID 3060 wrote to memory of 2704 3060 iexplore.exe 28 PID 3060 wrote to memory of 2704 3060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\can-can.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a000b007099719011fa323fa13514c3f
SHA14ccdb4cc08f7c4c4b525cb66ba38e22a32ce31d3
SHA256eb94ec6eccd42d4562eb154776babdb7c38dfce16484c98d75394d381f50f389
SHA512b20f04adc5646d35ccb1b08dff8f4c6563b306cf642109e70f576b83a89f5678b43fa59a4905d5dcc1c631afe2c488f102a2d7676a96044c35267df34e1bba89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9638176cfe3e471e1cb60c97fb2b7be
SHA146c0af9b9d8b12b4ddc4364eac7059dc7f89b8df
SHA2560607f043c2a692135b2202e9e631c894cc3808065be7100c5bc8fb7ed3c1b036
SHA512d59e5e7105cfa2d414a89f16aa6dbb71493c456feb87d043c56041df61e815694d743f9c232d3bdcc86c2a5ab7608e32d7aea6a45111fe91079cff17f280baf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd951eeea66aee34486e81ca0422aaea
SHA1782569dab328574eccda457f2410c5962836769d
SHA256d3f06d7b14883e39ffbad9acf2123560f7fc02d72ac026028c90b9feefbe5bca
SHA5125ac6972e7f885cc62bf4c371c7e34e6bc95afc82fbb495a7a7838cf7a3424706627c39b3147c212d6bf30ca4fdce94bf7891389d5bed046cca6d87910bcd3478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d16eb465fe604c89fd27516477ee4ac7
SHA18c05e70ca2a79358c0b0e2cf3c1061720d827c70
SHA2562c04f27a97b2d08bb7f4be4669e1be6314ca8a615acf2ebb4197779ccf369ac1
SHA512c7505546e690632ca25dc6c26e67390e0ff560408db23dfad6f318d95be24c56a95d810325e27b6698449c3e9b951ff60212f46319f6ee2fd8b2efc21429959e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55098f9af2b56228776101d10af2e239d
SHA118dd9e41f44bcf71098915ed70559e1d0b651285
SHA25633cac8d439447de885155bd39e0cb1ff31b07a013e0557393e1cc68111337509
SHA5121753aadde37d76e3f7768a8747e591e0b41db416f63f3fa10a98cf9317da59a84f001b2c45c72cab2a0cce5453e62943523ac1616ff0a89f8b2e2a44153cadf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a768b01a1cb0ad3316c710be42db76b6
SHA157f9c73410a5d9a59cfd1f767b37cb8e0c683a3f
SHA2563d638026c36d0c97d688b31d1d46f21517e4b97e822b953be5fceb260726da8b
SHA5125d63332f1153db68143ba6e23e7baa4486de7544959a0ae1337ce990b2db84dcbcc332c375bd222efa2032f15643b9f837799894e82601c6f9b9dd37660e6d60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5840b5c797251484b7a5492a9b790586e
SHA15b141de00bf01c5d47c0c8b747aa499205ade100
SHA2569a713c8001af35f67f0bc49930f8398f553943f9b6a32f5627298ef44aa83b3f
SHA512bad72623cf8e35d0ed7794cdb1ef1da7bfbe5395e5d0769b72db71dff83ee37258903becf91cd5193c89fa1c565aab862939bd08c7e5e6642fe8225571ff4069
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8db71946a435047b32790b2010b8343
SHA1a52cf368881d2ae0ac4c18485096f2800645eea1
SHA2563e8d0b55c1c353de86eae6ef9adbcb7371d8579b9178bcc9c7098ca74dc0f821
SHA51272935388b74488df7366c09eb4fb0aeda2e71a9592f08add69a1eb9e2c036cf2abe1b40a9d559896aa3cb7a1fe4a01701a781b3b0dd833d2c19a6cbac5ae7f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5286b54258cbd8570921303dbbd9fd11f
SHA185cc0a4683a6d89ebacd88bc6ba66113b3918c5f
SHA256710e88f102b405a8e91fb88ea407a0278cb01b10d27f1120d461525a6a28cdd1
SHA512e7459f19ac881896eeec856a67c878fc4a00fd2969af9509b0f969592a99624f7961ca476f255903d499be4b11b330c50a44393ad94fe380d986591abd33a60f
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf