Overview
overview
10Static
static
709c28d864e...ad.apk
android-9-x86
1009c28d864e...ad.apk
android-10-x64
1009c28d864e...ad.apk
android-11-x64
10about1d.html
windows7-x64
1about1d.html
windows10-2004-x64
1about2d.html
windows7-x64
1about2d.html
windows10-2004-x64
1app.2d89045a.js
windows7-x64
1app.2d89045a.js
windows10-2004-x64
1app.html
windows7-x64
1app.html
windows10-2004-x64
1app_get_version.html
windows7-x64
1app_get_version.html
windows10-2004-x64
1aps-mraid.js
windows7-x64
1aps-mraid.js
windows10-2004-x64
1bakchat_privacy.htm
windows7-x64
1bakchat_privacy.htm
windows10-2004-x64
1base.js
windows7-x64
1base.js
windows10-2004-x64
1error.js
windows7-x64
1error.js
windows10-2004-x64
1home.html
windows7-x64
1home.html
windows10-2004-x64
1index.html
windows7-x64
1index.html
windows10-2004-x64
1jquery-history.js
windows7-x64
1jquery-history.js
windows10-2004-x64
1jquery-res...min.js
windows7-x64
1jquery-res...min.js
windows10-2004-x64
1jsbridge.js
windows7-x64
1jsbridge.js
windows10-2004-x64
1libwbsafeedit_64
ubuntu-18.04-amd64
Analysis
-
max time kernel
134s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
13-11-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
09c28d864e89a2686f821d6ec76897620f25113dd954d061eaba74580d7aaaad.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
09c28d864e89a2686f821d6ec76897620f25113dd954d061eaba74580d7aaaad.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
09c28d864e89a2686f821d6ec76897620f25113dd954d061eaba74580d7aaaad.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
about1d.html
Resource
win7-20231023-en
Behavioral task
behavioral5
Sample
about1d.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
about2d.html
Resource
win7-20231020-en
Behavioral task
behavioral7
Sample
about2d.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
app.2d89045a.js
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
app.2d89045a.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
app.html
Resource
win7-20231025-en
Behavioral task
behavioral11
Sample
app.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
app_get_version.html
Resource
win7-20231023-en
Behavioral task
behavioral13
Sample
app_get_version.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
aps-mraid.js
Resource
win7-20231023-en
Behavioral task
behavioral15
Sample
aps-mraid.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral16
Sample
bakchat_privacy.htm
Resource
win7-20231020-en
Behavioral task
behavioral17
Sample
bakchat_privacy.htm
Resource
win10v2004-20231020-en
Behavioral task
behavioral18
Sample
base.js
Resource
win7-20231023-en
Behavioral task
behavioral19
Sample
base.js
Resource
win10v2004-20231023-en
Behavioral task
behavioral20
Sample
error.js
Resource
win7-20231023-en
Behavioral task
behavioral21
Sample
error.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral22
Sample
home.html
Resource
win7-20231020-en
Behavioral task
behavioral23
Sample
home.html
Resource
win10v2004-20231025-en
Behavioral task
behavioral24
Sample
index.html
Resource
win7-20231020-en
Behavioral task
behavioral25
Sample
index.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral26
Sample
jquery-history.js
Resource
win7-20231023-en
Behavioral task
behavioral27
Sample
jquery-history.js
Resource
win10v2004-20231025-en
Behavioral task
behavioral28
Sample
jquery-resizable.min.js
Resource
win7-20231023-en
Behavioral task
behavioral29
Sample
jquery-resizable.min.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral30
Sample
jsbridge.js
Resource
win7-20231020-en
Behavioral task
behavioral31
Sample
jsbridge.js
Resource
win10v2004-20231020-en
Behavioral task
behavioral32
Sample
libwbsafeedit_64
Resource
ubuntu1804-amd64-20231026-en
General
-
Target
app_get_version.html
-
Size
617B
-
MD5
9d84ff259a41328bb856984da9def25a
-
SHA1
25e16b76351ae5a5aa772541a9ced9f9d8b6e115
-
SHA256
c0b35e30d789b77cf0adac51dffe155b5d5c2541bacf6fd50a4ab8cf169d76d6
-
SHA512
41d746f102913a2663f344c2127df5010b42611d8ec853261aeded28d98c9b08a133bbfa7e5289e028c670b7964d0227840731ee3b623788dcda2d245227c8a3
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd669200000000020000000000106600000001000020000000bc524bad629b484628af107f15f71de67e111c4dc51998b423164e24edcf0169000000000e80000000020000200000002127225573d9825a75f4bb4f4d0dc21093fae071acbae04c738600cdd497fa0290000000716302657c489635071236e992988c97ed8d35288bf64d809ed7d3a236b18486ba57653f0165f1fba4ab28f9819b7305d28f3a063135ec0d5befc9657d90316eb22110519e0d16a2681ea6c70bd7878e5a9fa8c46979aebf80f1443896c97138d8cb3b078fe1abac04773de35f926145a17be7fab013aa348f4c6362ac78c304b635bb34c3206c6d56a76c4fa6245bd240000000e8f1975bfc75e2d4659c41bd6fda041c4eb137f0c2d7c0c0934a40fc5d74db9e7d1b9ca940300ad033fe6fd267f354a007bd95fc09dfc0bfa938163dcb7c1d1f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406074686" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70470fde7c16da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008d5ea254cbc3cc499365b391a5fd66920000000002000000000010660000000100002000000075faffe849f4a4ef274fb0e6c4ece9c000fb142a22c8f4e5b13f6667e786c320000000000e80000000020000200000006614802c322c92fb87069b7bca3b9196267da7d296b176e82852c39381ba842b200000006d64afdc914dcf78405e9ce3d3e6406e307bd4cb06540c2e64e86559407b7dd64000000043fdd4ef5c99d9b93e38da0bda9045a68fee292bb698de398076c3534df40e1ad8d0e7b5fc0c5f8af2e9d74cb6a8996b9ebd0eb0f1d5caa02d5dc226b4288c63 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08731D71-8270-11EE-A512-C6A71AF0F40E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2760 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2760 iexplore.exe 2760 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2760 wrote to memory of 2624 2760 iexplore.exe IEXPLORE.EXE PID 2760 wrote to memory of 2624 2760 iexplore.exe IEXPLORE.EXE PID 2760 wrote to memory of 2624 2760 iexplore.exe IEXPLORE.EXE PID 2760 wrote to memory of 2624 2760 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\app_get_version.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aa92fec2ffbfaa04e18b55c4cdc8b8c
SHA13f4b3c4f46f7a208d6c003a6697674b8568d43d6
SHA256426f916f523ec4e9602f80f4faaec4ce4dc33b51a7646dc7a90f06e6a6320a3f
SHA512c7411e13108618402a1497404d7014c6bc0830c7f5040ba4cf0182fedc3fb41be182046c995609e1f8e51d62144c74afdda4e32f6fa9517929aedc6014265375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fba03350bdb07f1e6f0c913c3e393fbf
SHA1252c2dac22fd35c432412aa645e2cb3a59f0f713
SHA25653311c8b526cb50e0ecc20b2d65b92a427d49d2b696b0b196c587623f084deba
SHA512a43c69636139ae7bc480c71fdf227a8e38b23c1a2d5cfe4724b4786190e760bb264044dd5dc4d777ca249a33f3954b78994bfd74ab5f83ee2ce1a34b5d11a90e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a1a523b58066dd52712428776f14029
SHA1bf00a1ce1cb5cbaf203ae8aedf373aeda9467562
SHA25619241c9c3e6ab238becc8c2c00f16a25277284c620f342bfcdea0c36ee76dc62
SHA5129cae4ea40921d48162febd7b73a0378b253c9db50fd84b0a110a5e47358ec3de5fb0dc741d8a69bfc23b076fe7e296759e9122237a9a183b293e257b0e497a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc11d640696805ff7f6fd448ae5d55af
SHA1cbce3d6431b3873c1ffd66bf315a2afe3ec77b25
SHA25679c492eb66fef4fde23001c2e41cecb577b57a17db073a7ab5c0305abf3c52e6
SHA512ede868ef2285b71fec89e891e4cd9b28ed62ed407df91696895d49a16eff738e277e606d94f463f816aeea1c571862f32a92dde7d7f15bd682237d08364535d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5202d35e3960daaa21813888004654d9a
SHA12c0a3a866cf6c322b081a83079a98220feef851f
SHA256e475cc6b48f5ae593fb0e69530168db5fdd11184e29eebabcbeab8f69f0b85d6
SHA512db1b28eec063a12f620efc3f73b0d2eb9d47b20c8bb94b8260f6d77caa9401783578c82b12d96c725d04cb2c8a9484b5bbc08626524ec0d98ba2e9bf54fc59a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5058e6e827eb12bce1d2059f1e67150c4
SHA14706348b1b81465b6f43a649ae784c2459007124
SHA25677abb9ea4e4cee2b4dcc06ca9f9d3857fdb1b34e8e298df29d26662ce7a68803
SHA5121e41a36716c41d6c2f7b50de6dd1e3323dc1f4fd327ef66f218df40e44c49c7e805e77952307c3e07742d18f8a017b1976af0f423d7d5450a2ee7156a1806d1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57675906d10fcc83aebf3c6387af32a89
SHA1fb17a633b78367066da2ac1ee726b587c9f11a2b
SHA2566923965e2ff3c88235bdb98fec22688d97a2940888d3319ba22928a08b1c1132
SHA512e484f9d8e30bf66f1aa6c9c5651dedefa92fb5e71efd2f9ef8551da5a6331cabc741ef33cf112013be31c264bf8fd1d1e5f3e1538ba942406b15f6463dbb60e2
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf