Overview
overview
10Static
static
73f39c2fc43...5b.apk
android-9-x86
103f39c2fc43...5b.apk
android-10-x64
103f39c2fc43...5b.apk
android-11-x64
10about1d.html
windows7-x64
1about1d.html
windows10-2004-x64
1about2d.html
windows7-x64
1about2d.html
windows10-2004-x64
1index.html
windows7-x64
1index.html
windows10-2004-x64
1scanning.html
windows7-x64
1scanning.html
windows10-2004-x64
1sharing.html
windows7-x64
1sharing.html
windows10-2004-x64
1Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
19-11-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
3f39c2fc43173b203a6a0b0331adb6ad265f0ee09fbab56ff25f18dec4fb805b.apk
Resource
android-x86-arm-20231023-en
Behavioral task
behavioral2
Sample
3f39c2fc43173b203a6a0b0331adb6ad265f0ee09fbab56ff25f18dec4fb805b.apk
Resource
android-x64-20231023.1-en
Behavioral task
behavioral3
Sample
3f39c2fc43173b203a6a0b0331adb6ad265f0ee09fbab56ff25f18dec4fb805b.apk
Resource
android-x64-arm64-20231023-en
Behavioral task
behavioral4
Sample
about1d.html
Resource
win7-20231025-en
Behavioral task
behavioral5
Sample
about1d.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
about2d.html
Resource
win7-20231023-en
Behavioral task
behavioral7
Sample
about2d.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
index.html
Resource
win7-20231023-en
Behavioral task
behavioral9
Sample
index.html
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
scanning.html
Resource
win7-20231023-en
Behavioral task
behavioral11
Sample
scanning.html
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
sharing.html
Resource
win7-20231020-en
Behavioral task
behavioral13
Sample
sharing.html
Resource
win10v2004-20231023-en
General
-
Target
index.html
-
Size
18B
-
MD5
c50002b30f2db7e33045a6ef53f94b46
-
SHA1
84346b72d78331cf3909638329cf227f912d5822
-
SHA256
04c6d962335c2da8d837eb14f48f77019f3d71c1d09bc2db067751137f9c8746
-
SHA512
d8635d4fd501efcba4dde964bfc1f38d022616b11a94f3f88e31be270e5712268772d8c9573571b16a1bb7c26e0b60516b241bf8e843f123e80050306a5b11a3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e9000000000200000000001066000000010000200000000e825ddb08402c6636e625713d4dff620851f959fc641c48006dfe90596d113e000000000e8000000002000020000000e027c0537935fbe23d680988fb44beff98734cc896fccb79d2add0a2ad15793d90000000bea357a4b6c90b9d3eb747bef37661cbd173186bd89ebe1972aec927c4355cd3c3bff794e6a08de3e6d8f1cdce372b69863117d725f8735b1271d625c3e99a9d23dead348996addf6444164c360cbab51f71d980a3a1dadf7600058572f66d418d880dff05e42806edb23865c0b57364f97a140944fe47ae108ec25a6c56a00f5f10aacb844c3ea6d34cec434a59009940000000becaee87e2adca4d2db3b005c6896073a3efa64be567bf76fee5ad194e0fff1f52f743f139fd1822b8d1edbba72c19403f23444ced0955c341f42bac4c70dbeb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79072038c960342ab421b8facb933e900000000020000000000106600000001000020000000ebab805e71bb797c651374d65e15a61bb5e5f1994ce92b17a4e6b02709eb10af000000000e8000000002000020000000fc76532c01b311a5ad78eba03075fe6a99e7deb79fa2fb1d1e08c410b12089b120000000936fddfe797852ba1fbc01bc1a789eb89545e02d46f2d1c98ef6f3f9bcb2563340000000e2586a21575e33e694b4a07cee3ab5b5f9ca640e26cd285e2861068fd3242c4145d202d99106bc3e023e1a048f5563fe6aed2a85b2c4fe3f06b5e4987a052f3b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "406593119" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D4BECD1-8727-11EE-A268-46832863ABDE} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0a7aee2331bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1140 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1140 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1140 iexplore.exe 1140 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1140 wrote to memory of 3036 1140 iexplore.exe 28 PID 1140 wrote to memory of 3036 1140 iexplore.exe 28 PID 1140 wrote to memory of 3036 1140 iexplore.exe 28 PID 1140 wrote to memory of 3036 1140 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\index.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc0e0b2c6469ebfe3cb979f000da47e1
SHA19a5389dcb0bd8827e0f5d26b69ca2a8d605efb9b
SHA256af72e66296b66131a819a743b74c0dfb1895e5fcb5d760b37fb4e9c1343b140b
SHA5127afd1d51ed01aab7494182c5966a260c242f24f0b8426778959568cd46fa449f3b594dc994808d454685cddf726a65f6c8de307a3e29e44ee11fa5cb6aa626ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c8a94e2667c07cf6bd4d14948762a9
SHA1f068092a29a10eb0b8ffe20dd6a4c2d83e1e6011
SHA256e7cfd6063c9eb08174383e22f31970b3843a8e4d47315b6378b9a6eee2f4b9a8
SHA512f962ebf3289274f58674bf5058adc5e047550d981b62b1a7a1f700e5131d16b0caf6918b4126240cccb55742fdf0a2b17e9bce017a0ed9a46380e657ebe12592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5525b1cea91cf8c5f57a9d0d5a8a71fc6
SHA165d2e895efcd21b6d137e74b8e33dedd6240b5ed
SHA256697311f44f4f2d51e9da67bffae1647b63f581ef4066c4a31977d5988e0bee0c
SHA512f3663249d3f7cee528cafe8e9d5b92189b4a3762c04236bfba1482c3e51034f72dfda57dcd09c58fb475982cca71a612879eea6dae3def3711e7dedcb8a1f4bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526db05a7791d4d93252afdd080375036
SHA15d01dc4c3d8e16d07d16730c15704dbae745489f
SHA25630f60e65968db2427b77798da031b0ebf93a08930fd05a401dc0c6c5d844f6ba
SHA51284270aa9c2777ca22193727e66c1932fe61714676ea95bfaa7b5000aa3338f7b5b5c35e5e11409a07c03b6511b3997b6286600200b8d3c2f737a2375c73f3025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b489b8f282859efc022be8ed795c676a
SHA1a2756aef39bf6512338a51b3b683447e0256d42f
SHA2564f1e9a04072e5a6dbe9ef93f1f879b14dcbbf594e631fab35a6be4b8e18edaaf
SHA512db35d9177b86486f4427c090f197985fb0073d8dedd7a046b386e02d4298297cae5da312a07fbdd292368961aa60f2cb7a630ea5b032a89eb26eaae75e5a58c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4416eb3d9bcdc8485d41682d2cd8882
SHA11ab206da55ea5a34e3ee6d243ef0bc71c18692a1
SHA256fac32b78643d5512189567820392e3decaabbcfdf70b82fe6ef25b0483875ddc
SHA512127603a2f9c3ce0e3921214b45f8a026d7b8d212a52927796978cfcb47c79275712a45f3861ef4ffbab69ae5e837e07c2eb6f2ad557a60091249c5d88b0eeb7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f959ac4651a89e4028a8fee3cad8ee2e
SHA1b718538eb718b4405c5d84e5ad6c66a991d6eebd
SHA25670b74cf094c0fd2d36568f0285b0a1eec4c9270c5f00e11751678ff4ba8fae34
SHA5126ee9616d2e70910b783098c9bf7c0c8a1dd0c01582de5a42b306d768523f9e12f78a5ca1568bef8ba7d13b508830ae5a3129b06d1845469583b8e18cc443ebde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550ba4e0898da0eeb649dd96e23d11251
SHA1f0bc81f132b3042f7abee78f3c9f605667027d3e
SHA2568079e6be73cc30e848e0afad360d279324071055600d9b86e120fd22b3106152
SHA512e9b2fbd8438725db919718a2c8c28df3cda3c27aa45c2fae0e448ab7870e94d1da74496263e8da7430814bbc06bdb98e6a2f5b13e9c8a41d0dc0eed13aee03fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0c883e7f5ee98b6a1f93d5a3010f144
SHA153374505ec9ffa8c2f573153948258eb0ad33fc5
SHA25673bfc54cc12b1c349b7a134c8feba0367db3f276ab5b76338a2d5c7b15675e4d
SHA5127c8ec5f929e0e3ffa7c9a378cb85509628d46af1699094c88db73c8413d5e0f0797e0e19716dc11fd5cba54f841ab18e8082c91aa502e057efd2499cbee9146b
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf