Overview
overview
7Static
static
7Sonic.EXE ...d .apk
android-9-x86
410 de 10.html
windows7-x64
110 de 10.html
windows10-2004-x64
1BfFuckingDies.html
windows7-x64
1BfFuckingDies.html
windows10-2004-x64
1Keel.html
windows7-x64
1Keel.html
windows10-2004-x64
1Milky.html
windows7-x64
1Milky.html
windows10-2004-x64
1a treta.html
windows7-x64
1a treta.html
windows10-2004-x64
1bothCredit...o.html
windows7-x64
1bothCredit...o.html
windows10-2004-x64
1can-can.html
windows7-x64
1can-can.html
windows10-2004-x64
1du ai luke...a.html
windows7-x64
1du ai luke...a.html
windows10-2004-x64
1f de fudeu.html
windows7-x64
1f de fudeu.html
windows10-2004-x64
1festinha.html
windows7-x64
1festinha.html
windows10-2004-x64
1soundtestcodes.html
windows7-x64
1soundtestcodes.html
windows10-2004-x64
1superidold...u.html
windows7-x64
1superidold...u.html
windows10-2004-x64
1tooslowcutscene1.html
windows7-x64
1tooslowcutscene1.html
windows10-2004-x64
1tooslowcutscene2.html
windows7-x64
1tooslowcutscene2.html
windows10-2004-x64
1truegameplay.html
windows7-x64
1truegameplay.html
windows10-2004-x64
1video.min.js
windows7-x64
1Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
Sonic.EXE 2.0 Optimized .apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
10 de 10.html
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
10 de 10.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral4
Sample
BfFuckingDies.html
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
BfFuckingDies.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral6
Sample
Keel.html
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
Keel.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
Milky.html
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
Milky.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
a treta.html
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
a treta.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
bothCreditsAndIntro.html
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
bothCreditsAndIntro.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
can-can.html
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
can-can.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
du ai luke laike ai nidi yo poweee bruda.html
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
du ai luke laike ai nidi yo poweee bruda.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
f de fudeu.html
Resource
win7-20230831-en
Behavioral task
behavioral19
Sample
f de fudeu.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral20
Sample
festinha.html
Resource
win7-20230831-en
Behavioral task
behavioral21
Sample
festinha.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral22
Sample
soundtestcodes.html
Resource
win7-20230831-en
Behavioral task
behavioral23
Sample
soundtestcodes.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral24
Sample
superidoldexoneyobinikekienda mas miku.html
Resource
win7-20230831-en
Behavioral task
behavioral25
Sample
superidoldexoneyobinikekienda mas miku.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral26
Sample
tooslowcutscene1.html
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
tooslowcutscene1.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
tooslowcutscene2.html
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
tooslowcutscene2.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
truegameplay.html
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
truegameplay.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
video.min.js
Resource
win7-20230831-en
General
-
Target
tooslowcutscene1.html
-
Size
62KB
-
MD5
3cc473b2376b95be62bba049963a7ec5
-
SHA1
1dcddf3e99ae9e72bce00879ea85f2e0d1c9ae13
-
SHA256
88128c5a887ec29da44506a6960164d7d4cdf9bdbde8af0ac19995e0456eb08a
-
SHA512
e5b9feb979ac4d14156a923b714daca8dd920377fc2b735da1223d976593f78ff733406930494c5e95ab79a2527cd07fe3438af690a45d597e060b3fc6d8f96e
-
SSDEEP
1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++2:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QI
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000008789e075a34ac1ade2c714463485bd946a0ea7fdecc8878af6902e4c20c8eb17000000000e80000000020000200000009e5b4580d606705629b8eb64a6d8bf712e816c74b722cd1e4f9e8aee3cee291420000000ea6492b8486c6ad1349c8632bdacc7d7320a095b09fb039a209b5952906838c940000000e0e157383434d7fa0dd14884ee4665c04f084c40a531b0084dee4eadc31c70f14ded6cd6ba09b744876dc74a194841bf3f2994d4d6dc8c062e65e04dda268bec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402e0b60b8fbd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000b2292c2ce7e7092f4a5d9324083d0ec774e9388aac4f6a53dca4ee18947f8ba2000000000e80000000020000200000009edcfb27b24e6e9f656f6a7bd194704d5db153d2d80b1f7b3f729c01a71e58a19000000015a195394bf974207b91b21f226019797a54e382372aae3ee8eb42d364ae6e1617702a422ba7091c883cd1334c9474132495f18be8841e2099a1fadba570669002b611d9b8def245a4d311d4d87981f37b9a9dffd449e78e3bba407808c687ba101f93776f348954c29d7c21385523cbc0ecee6ce6f2a4c27eebbff263577aa17ca2c496105bd8992679715c9dfb3a53400000007dbb5f5d025e0555f495b5a84b5cacbd2021ba2b0f9f34df78054bae13ea961583d05dcf7fe83f82bea23f43a565b87e90a97c7de90454f21088eaaf9b50091f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403131565" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A9DBD31-67AB-11EE-8796-56C242017446} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2132 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2132 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2132 iexplore.exe 2132 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2092 2132 iexplore.exe 28 PID 2132 wrote to memory of 2092 2132 iexplore.exe 28 PID 2132 wrote to memory of 2092 2132 iexplore.exe 28 PID 2132 wrote to memory of 2092 2132 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tooslowcutscene1.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559a66400873526b448163c72f0ad4e71
SHA1ff35e3a57c20260af94ae888f22e89385f57871e
SHA2563c36bc6fd88b46178bf3830e38ab6a88ddcbffe008cb105fb1da67edec576696
SHA512b34be21b3c064ce0175d007e163ebbee5e27e6c226e5ae06299335c54fc0c165e08cdcb351e9dcb86915c9c25cc89f876f2b97739cdf809eae351e8fc4858576
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bd3cfcca9f885004d39bbf5569b1a67
SHA1409142ac4434bc399e2c7a1bcd08f7b7356bbf58
SHA2568d283d04230f84387b27c7729a595d6c76b80930c4720f40a9bd4b6978544197
SHA512e8c35b3d92af9dd763e955a876c1e14f96d0bf77b6b55ce7d49156b31f519d13a04cac01fe11b60582864ac2b80008e505c05629b14ac1c9318a1c28e751c39f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd7c37372fe29e6b9c1094131c861e3
SHA18c49e5571ad6fbeb7c7a02c04e4f769455ef9102
SHA256a50d3f056f56f0de92e4751a0e695f250fb5fb1bee3bcf3a40cce18d2b2769d7
SHA51213da5edf3b952b0938acb321b63e426b893df8b0c25371e93abba42ae4631b999b28950d56d3ae36d99af0c6ea4e13cfd2a6a3302dc5cee57814d04a35dcf33a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5360a0faf74b1d19271286a70703529ad
SHA10e837e6abddc5d158ac8e53f558ce5031edff25a
SHA25670d0182e98cfb1e20e00c075964b570ff2fdc546684cc3f8b8d8afbf84ce3d0f
SHA512d9e5fd8a1d8a75ec120b44b51cee46fbe2d94ac2dd73e0c64df95af9742fc2530f2185d1a7475d7715a4f3930a604b06eeb28619f12e693f03ca3005d01a513e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54477e09fc8b7b6f8cb8ee1d28b3229a2
SHA1dcb4fa05405747d39c35f7d78f309bc6f0da1604
SHA256b50b692ec05105d1f1db061d28f2f17715cfdc0b65ea4dc72f7c1764b079cd49
SHA5121043ab75c04fabbfa97aa7d1f654c65d71fa67e2e990ec9c8d0caa8523330876795be81f46014b7bd37d2fb297dd0e2d43d58d1d284431d1621c56a809e53ef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bda4edd73ec0eb7f64e89519946f0a19
SHA15a9f0e7d315d662ae038878c62843e468d5305d9
SHA256f554f059ce6fd40809603fb1c623515ea57c7e7f15d0c3a2545413ad216150cb
SHA51256d784a82638007c20642a1627856e8d9bf07f25416aa3f7d51585543aa99c5e393a18dcce0b7d0aae4354325be116fd3d0c783ba782d3f141cb79d24888b98a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e68b7c63b00e2843feb2c6c91df2424
SHA1a17de2a3b90ac348ecc75e06eb4eb4052a2bffab
SHA2568823ec026284568bb8c6fe9610ad04d2ac59c7bb47ea1a2de8afc0feecb063fb
SHA512613c20cbee274424a15994d3b357bea4f9f306d5b53f03988a32003e8cca838427d64129d8750437b269645ff1104e0754facc1e333ed15f120fb4242752c6a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2e206d0847c53ef91eb8a9403f16054
SHA1960317bb355e35da2b2e6c9187febf9ebf8ab68f
SHA256d3a178e2e06aafa1c70d19cb9bedceb2cd1755b0536ee33a3ed68f7816deb88b
SHA5123acd4f8471794486bd9365f5064071d6f64987ff67a4ad4fb87612a2cb5bedf9e07228fb3548311c31c00d106e860c6fae7e484faa1df53883297652ef14c16d
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf