Overview
overview
7Static
static
3f1b8c15947...18.exe
windows7-x64
3f1b8c15947...18.exe
windows10-2004-x64
3$SYSDIR/Ak...er.scr
windows7-x64
1$SYSDIR/Ak...er.scr
windows10-2004-x64
1$TEMP/dospop.exe
windows7-x64
7$TEMP/dospop.exe
windows10-2004-x64
7tbu03852/dospop.dll
windows7-x64
6tbu03852/dospop.dll
windows10-2004-x64
6tbu03852/options.html
windows7-x64
1tbu03852/options.html
windows10-2004-x64
1tbu03852/s...g.html
windows7-x64
1tbu03852/s...g.html
windows10-2004-x64
1tbu03852/s...b.html
windows7-x64
1tbu03852/s...b.html
windows10-2004-x64
1tbu03852/tbhelper.dll
windows7-x64
1tbu03852/tbhelper.dll
windows10-2004-x64
1tbu03852/t...091.js
windows7-x64
1tbu03852/t...091.js
windows10-2004-x64
1tbu03852/u...ll.exe
windows7-x64
1tbu03852/u...ll.exe
windows10-2004-x64
1tbu03852/update.exe
windows7-x64
1tbu03852/update.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 19:13
Static task
static1
Behavioral task
behavioral1
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1b8c159476cef41d3e6b5e536a66a8f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$SYSDIR/Akon_Screensaver.scr
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$TEMP/dospop.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$TEMP/dospop.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
tbu03852/dospop.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tbu03852/dospop.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
tbu03852/options.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
tbu03852/options.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
tbu03852/static_img.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
tbu03852/static_img.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
tbu03852/static_pub.html
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
tbu03852/static_pub.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
tbu03852/tbhelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
tbu03852/tbhelper.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
tbu03852/tbs_include_script_008091.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
tbu03852/tbs_include_script_008091.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
tbu03852/uninstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
tbu03852/uninstall.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
tbu03852/update.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
tbu03852/update.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Uninstall.exe
Resource
win10v2004-20240412-en
General
-
Target
tbu03852/static_pub.html
-
Size
599B
-
MD5
0bf3de7de6f6a9ece7674fb245c7e428
-
SHA1
a71d601820676d5741734e825c7347d59570bc98
-
SHA256
29101ddb9fc880b921c78a8aa0952310ccf0fe4eb03479425500fc2e779d4b2b
-
SHA512
30dc0cf67d772a79dec244882f24c4a6ad71a3139b1b92d6e059f1e677ef138596e71c7bf12c2283b591ad64744b9abd15895fa29c4a600f64c784423bc270b2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000198ca50ff14b520f73245c810f71d75c1b80f0f4443a677fdf69481f550880ce000000000e80000000020000200000008ee519b6fc3876ff450d7c1013dccb566f807b1a6647d882edf2e9866caad9d6900000000177202dc4005ee13d25b47d96a9595553c5f5c5bbebd204c22d2da880b237c60deb401ffa43c2c0a37ea39f94ff046b189805fae13e85879b971b587052f15cf2893c5a3a059234f19c4a7e510d121bde1c3cbc3402d0be34599376dbb66e8df3429e2522e0b8f3e4abebf3c2ca497a76701028848345dbdf9bc13111df50248d7323d32dbae34e56d887bd8e578a64400000007dc3cc884c350555ec66580e4c99ba9b228cdb648e57b1719ed06e64ed47a26b537a88fdadc67d273407fb0a8370300d4b75bf1864578e77f7ff921b15f849ef iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419370253" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204d1305698fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3080ABB1-FB5C-11EE-AF55-CE46FB5C4681} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000042a554729371466fbd756099151d55842a04f5db4bd9dc7d4fe1dc4e88ee1333000000000e800000000200002000000080fd2932d08735e86bc49c1e70721f115929ecaac09848839d5779b2080b65c220000000dc13a6f40a4ca00b5a4f503b6082e863cc1847d8d46d8d4fa4d92229f192dbb4400000002a00adf1fe2110fd77cbbeeaad28214fc888231dfae7e409bc7d1b59cee0710e0c6058b5dc8a4788dea3949d241fa800bdfeea6ec5c182c8ce95432255c57b44 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE 2648 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 2648 2308 iexplore.exe 28 PID 2308 wrote to memory of 2648 2308 iexplore.exe 28 PID 2308 wrote to memory of 2648 2308 iexplore.exe 28 PID 2308 wrote to memory of 2648 2308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tbu03852\static_pub.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2648
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2d4a6b00495638289d4296405ac37ad
SHA16c933f79acaefb855de8653a7f51a5213f658283
SHA25641037af907a45fb1fb2f93844fdf91da61bcaa7453c028139bdf5417470da36d
SHA512236f524c00b0f7fc45db34f70271b66b3c6cfd0f493005ff974c8f3d4d0371b764fe09ab6cf02be482813ea95921157e88965fb73b00a9cb45737d206cd5dfaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58da34e02f6df99a8529319d99abd9ef9
SHA18ec2c82ee775075b906a49f8a3b70a4154b038dc
SHA256a3be2f4099f15b798995f63a84a789311292e2418214ff69829efd5636a0c18c
SHA512db011a88880bc00783f5f7ee5b9f3e697c7eb3db1fe2ee6a49264e48aec5937f3daf9713fb12f39d7bbf2264fe327a027f5b99ba42a33c0a206951ed47d2928f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb38069ae3fa32abf13b4fa2ccbca3c7
SHA114c3f34369518bac3de8c6cb2b7de2f247f76955
SHA2566a9c09f8cdd899c113d6db187412ff5df2f973bf38c4c8366f7f0bb375a07a9f
SHA5129f97bbbca4757f7561ce105bcb4aac670db77ffa0aca3ddecb2cee1311f2814942ee2b7b98d4dc7e9904ce6470f904eca2e5cfbdfc11af7a0f96b159df58a8a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a6600961d07f66325d22a2341c7d138
SHA1ad86a65a2ba1f9fc5d918b1fd815f258d8e62005
SHA256a6c1e30399fd77905e9ae32d5d04be693707610b55210bcb4eaa70a695e30564
SHA512570765ebf48f5d0fbb749f855a737c733b755efe458c3990d28d8c0e822d4fc9be6296ea3fe60ae94ed4199105455f19926bf9ac4620297e62a34ff3733cd0d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d14ac790cb305e444776bc817533e95
SHA12c2da1af1a15d78a435a0b35936536a4a32515cb
SHA256d959d8615c0bd648b6f067b40c09ee33ea0de8b2e95ca04cbc14a4e14fda51d6
SHA51263126dfb43199bc06d0532fff6ada43deccb9d773b8120a838a724387fbccf3f2369a9755d555f6e800fa77cc3b5449708cf7b2cd6659956de27aca2b9368ff5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5592777f44d6f8fcbbd6bbb04ec155590
SHA14bd87b37be1073ea8da727e8616b77526b215b74
SHA256970340a1d1aa5f09afbb605bc9b30f73b6231d8daa9b2dfbc1e7ad1fb740f8c5
SHA512149ea37b22775e5c362541e1816f2dedcc79078ec6687ed61921bfb63c33f15565e7eed17052d6339542214f3cd57f6b8aad7e4e563506214c2282656dc0b3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d194cfd9464c6c882c5c6e9c65e61d8
SHA11b7a99340460970c5a45838d6ab9c0297bfd6895
SHA2561a6225033e2ed23312faf083b7e70018c0adeb4dc4e6579f1f7197d237ca777c
SHA5124546cd8556aa73660ca4eeca22d03115dac85f367057bec500eb38773c495030d21e0ad2d1af824edd1a8627f9c15efc165b0c8636f7471215814f7d7a087935
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d752f481cda8a8436d3f51cd21bdc6c5
SHA1b92f6f16ad4d5e0902de2c43edde4687edcdcdac
SHA256e8e74326be4e70268d999ab746dc6d89ab75001cd456ca0da9a6cc01bd722ece
SHA512052a405c8df5f3b106e5097df4cd90bd7759101dc7992d570746c099cfb06aa9b2a388bae6b99836ee7ec3b1e54e86fdd5bc6cf1a1df4cf73a711c726386de37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff347a323a99a142ba186627405b1747
SHA1ccbc016575fb08528667e611ffaa999cec84adcc
SHA256d0788935acfc0e82879986ecb25227790f8aba37ee9110010113c4f7d0035787
SHA512c40efde0a4b677a38bb302606234ee219ce6037972029c0fafe33c00949360acc486fa1f493945bed55291f28d206d7d8efacbd80fb66d3ee1246738433580dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5967f8b41be17a612592f0d9bfd9e5c87
SHA187c84e3341444ebcbb76ff86929110852662491f
SHA2560f52f2a36a37382109e5695f9f9936c9b891470ca68febdeb661f953757c952e
SHA512acfce52c1c554827498fe5635623c0753b886b166c691825fffe4a057c63e0adf57e02309c766df3e1c7f90577ba622b49d9eddf35f90dfcb98cebccb54829ce
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a