Overview
overview
8Static
static
3privacy.se...10.exe
windows10-1703-x64
8$PLUGINSDI...er.dll
windows10-1703-x64
1$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3LICENSES.c...m.html
windows10-1703-x64
1d3dcompiler_47.dll
windows10-1703-x64
1ffmpeg.dll
windows10-1703-x64
1libEGL.dll
windows10-1703-x64
1libGLESv2.dll
windows10-1703-x64
1privacy.sexy.exe
windows10-1703-x64
7resources/elevate.exe
windows10-1703-x64
1vk_swiftshader.dll
windows10-1703-x64
1vulkan-1.dll
windows10-1703-x64
1$PLUGINSDI...ec.dll
windows10-1703-x64
3$PLUGINSDI...7z.dll
windows10-1703-x64
3$R0/Uninst...xy.exe
windows10-1703-x64
7$PLUGINSDI...ls.dll
windows10-1703-x64
3$PLUGINSDI...em.dll
windows10-1703-x64
3$PLUGINSDI...ll.dll
windows10-1703-x64
3$PLUGINSDI...ec.dll
windows10-1703-x64
3Analysis
- max time kernel
94s - max time network
155s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system - submitted
07/02/2024, 01:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
privacy.sexy-Setup-0.12.10.exe
Resource
win10-20231215-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10-20231220-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10-20231220-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
LICENSES.chromium.html
Resource
win10-20231215-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
d3dcompiler_47.dll
Resource
win10-20231220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ffmpeg.dll
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
libEGL.dll
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
libGLESv2.dll
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
privacy.sexy.exe
Resource
win10-20231215-en
windows10-1703-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
resources/elevate.exe
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
vk_swiftshader.dll
Resource
win10-20231220-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
vulkan-1.dll
Resource
win10-20231215-en
windows10-1703-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
$R0/Uninstall privacy.sexy.exe
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10-20231220-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win10-20231220-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10-20231215-en
windows10-1703-x64
2 signatures
150 seconds
General
- Target LICENSES.chromium.html
- Size 8.8MB
- Sample240207-bsv55sdbgm
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- MD5 2675b30d524b6c79b6cee41af86fc619
- SHA1 407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA512 3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP 24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000089891e0716f62f439c10c1e3593a975800000000020000000000106600000001000020000000f313de428e549eb084f6b2844b76be038342ed76ed652df578fda694368d6897000000000e8000000002000020000000bd958adcfea51cdd7b642e0b9128ce0b7daf1d0e3196cf99ef1e899f11434f602000000079c3ed1584ec99db7931f91a45b9945702b4a5810b5a8903230a618c513945f7400000004ffa10f57962f46dd49ff5fa148f05abe3d1125673a364757afea45f1ae44d13a33cb247f65ea3dbe8c76cbcb2525ab401d89e12326b04bf175562480f485e01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000089891e0716f62f439c10c1e3593a975800000000020000000000106600000001000020000000c8eba8fe1874b62f4d28df2a86d3f4d9296fb2897c07e53b06fd304b9dcd1e68000000000e80000000020000200000007dd3c35f59be4a1c7c485629c703d59a4309b51799eb3931b5b6a2cb664049ab20000000795c41f7181c7d47a2724da980f6d85e084d8dd067ae62dd411ab7a8e083979440000000c2a777dad4fdcd03d19042cc36d9fac6e65724ae6e1ac42b54b62fe884e88d6e4391cb90aadfcf99fcc7861394b3a4e6f09839684589fe5ad9a869de3d484c91 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414036151" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1612175276" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086953" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "414052745" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1610612492" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086953" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1612175276" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1027eb616959da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1610612492" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086953" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086953" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e057f9616959da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "414084736" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B88D75A-C55C-11EE-9D1D-727C50576831} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4692 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4692 iexplore.exe 4692 iexplore.exe 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE 5096 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4692 wrote to memory of 5096 4692 iexplore.exe 72 PID 4692 wrote to memory of 5096 4692 iexplore.exe 72 PID 4692 wrote to memory of 5096 4692 iexplore.exe 72
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4692 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5096
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 bc90385d981e255e5265ac72964e7f6a5123f89e14cdcadbb79dd4dbab480bd7
- MD5 85863b6ab550a4c9927463bf343c0161
- SHA1 cbdc7d7ba5c33eefe58a66b84f927d0c164d1cbd
- SHA512 555a828b8e65c44b893c3ed1942e7372077875ff993af17a660da3508f0fe1b5ffbf4ccf9a6b956ec710ad0e581f79291c04d5e2fa56a84fbd061c6e1b66e9d3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 9fe6d989634b4b2ac195633ca300e8cf14dccd57be96373027b45badd166bc19
- MD5 787f70e7be6a75bbf9747fcbd0627cdc
- SHA1 15060d8fbf37ee141c8ddc3fb2153f4c2d87e0b9
- SHA512 5a913bcb3ebb055ba59121a9245f5d3187dd239d5c4eec0129f5c680f1868248129e8585fe0529c70670c9f4309a2c69f88286353be0c3eaf3350d60050f7fc6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver4EC7.tmp
- Size 15KB
- SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
- MD5 1a545d0052b581fbb2ab4c52133846bc
- SHA1 62f3266a9b9925cd6d98658b92adec673cbe3dd3
- SHA512 bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
- SSDEEP 384:79Jv9DF9/C9qc9/J9V791T9TK9Xf9Nm9xQ95a9BR9fV:79Jv9DF9/C9qc9/J9V791T9TK9Xf9NmT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1WNDVRQC\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\KNJHQJZB.cookie
- Size 541B
- SHA256 8ad86e7b9c43fcc599fd25523f99a786860e766a913fa3e043480cb694b042c4
- MD5 6322591634fbb35550849584e13fbd7f
- SHA1 55544e1af58c06e33968fcfa7b5edccb712da1bd
- SHA512 b3cb640dd9d9051f1f7b0eea647c54a96547e19608cbf247c10a2e5ce27a4b755e3cac59a53f874eb66fdffc3d0c3ab307b2e1510e95691d56692f4b95c319b8
- MD5 SHA1 SHA512