Overview
overview
3Static
static
1Phonk_Bastards.eml
windows11-21h2-x64
3attachment-10
windows11-21h2-x64
1attachment-100
windows11-21h2-x64
1attachment-101
windows11-21h2-x64
1attachment-102
windows11-21h2-x64
1attachment-104
windows11-21h2-x64
1attachment-105
windows11-21h2-x64
1attachment-106
windows11-21h2-x64
1attachment-107.gif
windows11-21h2-x64
1attachment-108.gif
windows11-21h2-x64
1attachment-109.gif
windows11-21h2-x64
1attachment-11
windows11-21h2-x64
1attachment-110.gif
windows11-21h2-x64
1attachment-12
windows11-21h2-x64
1attachment-13
windows11-21h2-x64
1attachment-14
windows11-21h2-x64
1attachment-15
windows11-21h2-x64
1attachment-16
windows11-21h2-x64
attachment-17
windows11-21h2-x64
1attachment-18
windows11-21h2-x64
1attachment-19
windows11-21h2-x64
1attachment-2
windows11-21h2-x64
1attachment-20.xml
windows11-21h2-x64
1attachment-21.xml
windows11-21h2-x64
1attachment-22.xml
windows11-21h2-x64
1attachment-23.xml
windows11-21h2-x64
1attachment-24
windows11-21h2-x64
1attachment-25.xml
windows11-21h2-x64
1attachment-26
windows11-21h2-x64
1attachment-27.xml
windows11-21h2-x64
1attachment-3
windows11-21h2-x64
1attachment-30.xml
windows11-21h2-x64
1Analysis
-
max time kernel
144s -
max time network
164s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-03-2024 17:34
Static task
static1
Behavioral task
behavioral1
Sample
Phonk_Bastards.eml
Resource
win11-20240221-en
Behavioral task
behavioral2
Sample
attachment-10
Resource
win11-20240221-en
Behavioral task
behavioral3
Sample
attachment-100
Resource
win11-20240221-en
Behavioral task
behavioral4
Sample
attachment-101
Resource
win11-20240221-en
Behavioral task
behavioral5
Sample
attachment-102
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
attachment-104
Resource
win11-20240221-en
Behavioral task
behavioral7
Sample
attachment-105
Resource
win11-20240221-en
Behavioral task
behavioral8
Sample
attachment-106
Resource
win11-20240221-en
Behavioral task
behavioral9
Sample
attachment-107.gif
Resource
win11-20240214-en
Behavioral task
behavioral10
Sample
attachment-108.gif
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
attachment-109.gif
Resource
win11-20240221-en
Behavioral task
behavioral12
Sample
attachment-11
Resource
win11-20240221-en
Behavioral task
behavioral13
Sample
attachment-110.gif
Resource
win11-20240214-en
Behavioral task
behavioral14
Sample
attachment-12
Resource
win11-20240221-en
Behavioral task
behavioral15
Sample
attachment-13
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
attachment-14
Resource
win11-20240221-en
Behavioral task
behavioral17
Sample
attachment-15
Resource
win11-20240221-en
Behavioral task
behavioral18
Sample
attachment-16
Resource
win11-20240221-en
Behavioral task
behavioral19
Sample
attachment-17
Resource
win11-20240221-en
Behavioral task
behavioral20
Sample
attachment-18
Resource
win11-20240221-en
Behavioral task
behavioral21
Sample
attachment-19
Resource
win11-20240221-en
Behavioral task
behavioral22
Sample
attachment-2
Resource
win11-20240221-en
Behavioral task
behavioral23
Sample
attachment-20.xml
Resource
win11-20240221-en
Behavioral task
behavioral24
Sample
attachment-21.xml
Resource
win11-20240221-en
Behavioral task
behavioral25
Sample
attachment-22.xml
Resource
win11-20240221-en
Behavioral task
behavioral26
Sample
attachment-23.xml
Resource
win11-20240221-en
Behavioral task
behavioral27
Sample
attachment-24
Resource
win11-20240221-en
Behavioral task
behavioral28
Sample
attachment-25.xml
Resource
win11-20240214-en
Behavioral task
behavioral29
Sample
attachment-26
Resource
win11-20240221-en
Behavioral task
behavioral30
Sample
attachment-27.xml
Resource
win11-20240221-en
Behavioral task
behavioral31
Sample
attachment-3
Resource
win11-20240221-en
Behavioral task
behavioral32
Sample
attachment-30.xml
Resource
win11-20240221-en
General
-
Target
attachment-30.xml
-
Size
1KB
-
MD5
b06a292d1e58ed865f2fe9abc44ebd9c
-
SHA1
51b04d4c4b9dd8387ff8c672b17d2847fb6767d1
-
SHA256
5dc92d542fe7f367ee81a9a3d7a434d8d234955dd0615059a2d7c1ce752134f7
-
SHA512
129242eb61fb1cc9d140e5ab0ef49779353b4e7b68752d0bbb0f5c2be89fec4036e7f88a503719430a5d400377fb318a1a39b4bf049ba7d4c378483f9d89c7b7
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31094972" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1438413579" iexplore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
MSOXMLED.EXEdescription pid process target process PID 3340 wrote to memory of 3608 3340 MSOXMLED.EXE iexplore.exe PID 3340 wrote to memory of 3608 3340 MSOXMLED.EXE iexplore.exe
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\attachment-30.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\attachment-30.xml2⤵
- Modifies Internet Explorer settings
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3340-0-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-1-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-2-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-3-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-5-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-4-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-6-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-7-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-8-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-9-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-10-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-11-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-12-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-13-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-14-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-15-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-16-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-18-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-17-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-19-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-21-0x00007FFC63B00000-0x00007FFC63BBD000-memory.dmpFilesize
756KB
-
memory/3340-22-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-20-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-24-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-26-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-27-0x00007FFC63B00000-0x00007FFC63BBD000-memory.dmpFilesize
756KB
-
memory/3340-28-0x00007FFC643A0000-0x00007FFC645A9000-memory.dmpFilesize
2.0MB
-
memory/3340-25-0x00007FFC24430000-0x00007FFC24440000-memory.dmpFilesize
64KB
-
memory/3340-23-0x00007FFC63B00000-0x00007FFC63BBD000-memory.dmpFilesize
756KB