Overview
overview
4Static
static
3vlc-3.0.20-win32.exe
windows7-x64
4vlc-3.0.20-win32.exe
windows10-2004-x64
4lua/http/custom.js
windows7-x64
1lua/http/custom.js
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...m.html
windows7-x64
1lua/http/d...m.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/d...w.html
windows7-x64
1lua/http/d...w.html
windows10-2004-x64
1lua/http/index.html
windows7-x64
1lua/http/index.html
windows10-2004-x64
1lua/http/js/common.js
windows7-x64
1lua/http/js/common.js
windows10-2004-x64
1lua/http/j...ers.js
windows7-x64
1lua/http/j...ers.js
windows10-2004-x64
1lua/http/j...ree.js
windows7-x64
1lua/http/j...ree.js
windows10-2004-x64
1lua/http/js/ui.js
windows7-x64
1lua/http/js/ui.js
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.20-win32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
vlc-3.0.20-win32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
lua/http/custom.js
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
lua/http/custom.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
lua/http/dialogs/batch_window.html
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
lua/http/dialogs/batch_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
lua/http/dialogs/browse_window.html
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
lua/http/dialogs/browse_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
lua/http/dialogs/create_stream.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
lua/http/dialogs/create_stream.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
lua/http/dialogs/equalizer_window.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
lua/http/dialogs/equalizer_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
lua/http/dialogs/error_window.html
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
lua/http/dialogs/error_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
lua/http/dialogs/mosaic_window.html
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
lua/http/dialogs/mosaic_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
lua/http/dialogs/offset_window.html
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
lua/http/dialogs/offset_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
lua/http/dialogs/stream_config_window.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
lua/http/dialogs/stream_config_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
lua/http/dialogs/stream_window.html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
lua/http/dialogs/stream_window.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
lua/http/index.html
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
lua/http/index.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
lua/http/js/common.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
lua/http/js/common.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
lua/http/js/controllers.js
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
lua/http/js/controllers.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
lua/http/js/jquery.jstree.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
lua/http/js/jquery.jstree.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
lua/http/js/ui.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
lua/http/js/ui.js
Resource
win10v2004-20240226-en
General
-
Target
lua/http/dialogs/error_window.html
-
Size
501B
-
MD5
ad9769b13838d62653857ff47718c6c0
-
SHA1
a4683573d5b43aca9e256d4a45dc5ac46db927ed
-
SHA256
75d1a1ab807cd97801bc37ed547b26c7b357497e82d01221ac064497c9480304
-
SHA512
58a7d9ce56936da79a8f46f0f5c1e465d63ee1b8f68701627ffa00e1c43267899a64a3dfe601bf660bfee66b5ea365a27ba8d68f7d598ab6e3a917b52d6e9fc0
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000e6dbf34de1cc5944dead05431cc19fc03e274ab206007826c27bd76d9b9f09dd000000000e8000000002000020000000dc9ad1c933b77db7c6b4e9a38bba586c345f7bc30e4b266b9db60ddf9c508c1d20000000defaaf4bb3d7ebe7637e7856a05fa2ba492809ec48216b89fdc1ebf448172816400000005bca73f63f90b1f8102f677017338b0814d4250f3cf5c607aaa5eb2d9f78b33bcc823558bc88e6e5fa254e83248c3745041e29bf872032d7b4c1797ce68af687 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d5d180bc74da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416437453" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000d758369ff432ed225f16f9a582339f1630dc75a2116e462fa6863d6a2ec589ec000000000e80000000020000200000009eecdec8d37e2d259cb33b76ff270cbe20a7c4a692f054d1288363f7c5da40ec90000000323f47327ba58fa5f304ed4676a160b4627a047f0c50015594f71ae4d6eafaa6e73689e8f12d8106bae2943dad4cd3a0ea298583d9b07381a8adac37676b7cc422f9f88c36467b080f13f1d86919db66d7c7bcc62868491d2fd709f59ea28ae70966b9c2c762fb2b2c2638494b49fe8dc9b04f60b8ef39749ff2f0c31927e7bacc662136e8d80035aaba2761f9d158cd4000000005081ded1aaec2ca4026ecbcad72eb4332cdb4cfaf691a497e3c3d7b4225f6db01667e3356485f9baf9011e520ca7cb9f490eb92adad84e86fa8dadc8b614593 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC25B8E1-E0AF-11EE-9969-66DD11CD6629} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2948 iexplore.exe 2948 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2612 2948 iexplore.exe 28 PID 2948 wrote to memory of 2612 2948 iexplore.exe 28 PID 2948 wrote to memory of 2612 2948 iexplore.exe 28 PID 2948 wrote to memory of 2612 2948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\error_window.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb1b89f7a55824f911c366cad4cb017c
SHA1eecfc3873be14b44048c5fd8f00bc8eed4dabbb9
SHA25693147df63c473911835b9a4f18617b31d8940be7ca3666b377b5f1767c4ed441
SHA512a416c1d52f9fa25820555a4380b4aed7a3c29957972a40f1d1a8553cb01891e3827ec2259db9563745ba7081f233548eb04136efac7ee4c3fb9f138fd881b782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d4ed86edbaee08715bd2f3ce055d6e5
SHA165fe0fa341a9ee756c3d7c12bc08ca1f278988fa
SHA256dd257ba4d1fd117e7e4938aa1f780981141f424ee02e91cda64600612ee7428a
SHA5126e4074bc857f6a8ffe0eaed239b52a7ece3079ad419d8c220d514615ac64a89e7f7dccfc67d7dcf3555f22d0e3c33db4331f8c0ee63a0f40dd7e26917117d43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7d1a38a0d7c64610f0dcc09a40f84c1
SHA1b4c299380adce5dd4344b968307fd7be5f8ff168
SHA2565add7d6198de5d30d5145d4692b3485fd658187c616dcb500d6b153e884a5e71
SHA512e84ef90dc42e670f50a587a10ada3d4e7e83e0313c2e982cca4dd886026c5c0894de10a50bf18792ac3ed7e8a83b06e11e84564c36d442e725c8363886b39931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b437cd50093ca3ec22270d162af27df9
SHA10c8296f2b50bd9c382a6438310d02cc1db0a7d3e
SHA256bfd5d346768053b934023f7c1dcf18a1217bd81133dedf49ef4a16c0c9a45661
SHA51261132dfe58ffcecb60cbe544d16bf68f35f35efc6cd67d4db09d5dd20631adfd35e12fb7f3220f774752438ab366ab7f9250e3b2ce4c324c347825b66ed2c678
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581fe33d0a95544d253d2f2506a67ac55
SHA1ff7220b5dd98a5c0fa668b91d4a08006f205625d
SHA256cde424fbacedd78d289870041b1c832bd594429cbb4363df0aee4dd9d4def279
SHA5128cf7490a0d994849ed178833cbc68a6eb32e42831184310b35c3519e0ae77072cb7de134b0d928b4cf6427fe2afa981f0eab1a9bc654d23c6e435be529d1f76f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1ddc11f4ba3632fb5cc3d998c5e72f7
SHA122e9742a4f9dc8885125bf5366b3c217b963e69e
SHA256d1b23d0f793146c86d686093c32994be73df9c6aa598c55aed5e9cb9a46cf1f9
SHA512729b00bdc69238a3ca07d40a10103ce951487dfcf2c08d6598fad9d7bb3e3136217beef5519f5f8176463ff04367d8802d3a8ced47fdc39c6eed2a14a73775c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5247d4bf44d73c812a5c00b0de09d973e
SHA1b0d3bf31e0010f172b77ae59fe726e11d88dddf2
SHA25611714f30629f585f10c715c5542cf52bc4147d3d74f08217cb41b95d57b1cabf
SHA5124bacfb21b13843496e6a87e25520e1fb153d3054efa513d35df9b968bb7ff635e1ad027c8887ca69ecf0f6386dc36fbfa262bb06c92b4bacdb90825224204bb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59db54d25d913b9c600e2a3153b6ed7ac
SHA1712787b68833e1fbf736252289ed514a7f88691e
SHA2568d03f34ef47084ffc05e56b3e8c9fe73e8056ed9c18519db673c5a7bca76830b
SHA5126ec3eb4e73bc4fc982cdae5a55397383f676da358b695011360b5787d3bf81f109363099a5f2d5b46fc3dbb252dd61f12f554cffa1ee7dc71abbeee2e5b214b3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63