Overview
overview
4Static
static
3046d-uipak...1).exe
windows7-x64
4046d-uipak...1).exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3html/download.html
windows7-x64
1html/download.html
windows10-2004-x64
1html/finish.html
windows7-x64
1html/finish.html
windows10-2004-x64
1html/welcome.html
windows7-x64
1html/welcome.html
windows10-2004-x64
1js/IE9.js
windows7-x64
1js/IE9.js
windows10-2004-x64
1js/jquery-...min.js
windows7-x64
1js/jquery-...min.js
windows10-2004-x64
1js/jquery....min.js
windows7-x64
1js/jquery....min.js
windows10-2004-x64
1js/logi_helper.js
windows7-x64
1js/logi_helper.js
windows10-2004-x64
1js/logi_helper.vbs
windows7-x64
1js/logi_helper.vbs
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 05:47
Static task
static1
Behavioral task
behavioral1
Sample
046d-uipak_x32 (1).exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
046d-uipak_x32 (1).exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
html/download.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
html/download.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
html/finish.html
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
html/finish.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
html/welcome.html
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
html/welcome.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
js/IE9.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
js/IE9.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
js/jquery-1.3.2.min.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
js/jquery-1.3.2.min.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
js/jquery.quickflip.min.js
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
js/jquery.quickflip.min.js
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
js/logi_helper.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
js/logi_helper.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
js/logi_helper.vbs
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
js/logi_helper.vbs
Resource
win10v2004-20240412-en
General
-
Target
html/welcome.html
-
Size
2KB
-
MD5
cfcb0e546d9a5b527fcbd970d5285bc7
-
SHA1
d1e7c0e6d01f283d8c6f34b67b5ed004f2a6d1e4
-
SHA256
2065bcfa62b410ffa2b79afc102b78a5071301cf16f94d2d42c12be8365ab253
-
SHA512
c9d87c083bca3d1fe33e79431a2cd2178b468d94289415a4bad2141588178824b1984da5c0e58ae084111b5e7b35fd08abe0ecfd3b2045a918eedb86ec721d9d
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000090a79b12b9b273a29d37397a1e6fd738d1d95a1888b6c009136cf3611f8337d7000000000e8000000002000020000000a69fcd7c5c1886b6c8090ae3705a6630f3d8d9530148ce56e83fe0a822e45fbe2000000028cd33bc47200b3115a8c57d3edda7e7e8ca3bc8519d1d102ffc412671ffef2f40000000b17609c4a46b2ca13afecc694423aae876f834f64981a4a9eac11fb053d8408a69a8d3823ec57d4f782251af2bb85bf5b742205efb20e23f02cd96a495495708 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000027a572f92cbecc6c9b60dd81132d0e9d1ef05825a001d6b456fd00eaf923fd7a000000000e800000000200002000000025542a687907516ef7f4a2dbee7f26e97099413b272c049b2fc5df16a0eef3d89000000070681f7be16df93fce83ccf9956af071fbdc47b1702d11679ca7fcd5c6899f13ba0589d78e7d395174a7c1a40c68cb140eb8a635ce6480c750e5eaae88b88b48c47cbbe42524bf6b48014b02b6e49354831eee0367d0ebf737ebd2ae429fc62a52e797286832465957673fb7ebc4f17ae569618611ff5071c8ef10f81038de54ac8a523ea99472569107ec676297a18c40000000e5e4eb575a8cef93c5bdac5ee5b304890c85721a44fea1b5c5af199dcde43210d7372b4494b7ce4fbee6eb1dc2407af2a92bdad01a26caecc6fe977cb1f1c693 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD813351-FFA2-11EE-AB14-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f11a92af93da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419840361" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2204 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2204 iexplore.exe 2204 iexplore.exe 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE 1184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2204 wrote to memory of 1184 2204 iexplore.exe IEXPLORE.EXE PID 2204 wrote to memory of 1184 2204 iexplore.exe IEXPLORE.EXE PID 2204 wrote to memory of 1184 2204 iexplore.exe IEXPLORE.EXE PID 2204 wrote to memory of 1184 2204 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\html\welcome.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2204 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed32e14b1daff69926453d9f286da147
SHA12b290aa2abc5d9dc7c71a891420cb32133d0cd45
SHA2567b674c9a51f6e7ce298e055dc1313fbe8e8e567fc40167ed23c4061c50ea34c4
SHA512a6ff56b4a78ae836559e9b3718bfd6ee0342acc41fb43b628d6cfc855d5eb57f71efbad2a60433dc4c462eed2583e5308c8a0597fe04e6a6e3862d76e660a4e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c108aa0a4305f4e70a13e8445e35b162
SHA1549d7af650c76a6b2c3fdf0d27d3746af78fed45
SHA256299f848a6cbf0baa6a05598be56b1de7cda21246c46c1465ea4f0fd39335e66c
SHA51277d98fa2051e7a30e6ccb6dae785dda8ebbecd4d40ec67d2d0df103af1c7b318826019fdaf4718c8f538308721017e7c99c225d182a9538d9a799d76aec1a947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56477f9360b0a9af6fffabc158c7d0dfe
SHA161efe7bac223aaf14660bb5f4a53bb6278e84faf
SHA25676f854a75b3d05e8da8f14285d2a8d4a69d00b339469f79c08a406ee907aff72
SHA512cd0573e3f1c461b43f1286ce110fb766d2ed774aeb4650ffe195262cc3e152f930d07d0137e33a22bcf2fa6de8cdccdba96749931961942f80796db455781b01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575fcf2ea60be32245590f58496423536
SHA1b316669d2c227e6af26786e1749b98054e6bd4ec
SHA2564bf952bb0e88358ba3cb811e6861df360512afb93f96bd761ed10c4bb4c08bc2
SHA512d4a40c9c0deaacdbbe08f2fd5ee025dba2348adbed71a21d2fadbf8009f1912e804fdec4cde7cc45f3ee4bf2552bfa5c870dfbcd3f45e79fe9109532664f0436
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e251e1c88f391bc6fff23beb264eb9
SHA183651d207251c781d531ffc6df23364cbac32c8f
SHA256c29641f38121019514d8468b7a332cd488e595bb4736f26b9715eaeb85404bd4
SHA512f31aa639171064b68f2f24cede54e0c7bd6035419418105c7a41a67c5749c919eb25b000ad63f2303fce8a67137ddd34a09c0fcbec810ef824530abf37438d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579983c5afad8e799f4b44e25f423b958
SHA12cfbaf57b2c57eb08e9334f726b5a4d41fd325ec
SHA256550dade5c92a91af6546a8cd1d847a42455592bd791e726cf87f10ac47169173
SHA512e5dafeafd3c518b6a6ac246df85bbefb82e08ca781a9f7ccaff018ae208a70c94e6bc15abddd30f400dc4753981e305f98c45647c42d6b3c56075f4447251bf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59385ae9b0b36b3956bb6ee070cb42e66
SHA1e563ac8a72c4b5d3fb4d07a0dea96dc1a839abc4
SHA256767c59f0b6e5a1c0d01a81fe264f55959051fd15287de893975c06ac8158cfd9
SHA5122fd95887bdfe74b483e2044ce1bf48d00f3ee520e3ed7edf5b578f5c4c67bcd1485cc55418e07843f088b520c7cdba8e8758f47a90e2031744cf6b88bb29bd16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571f51cbe774a831ebac7d95f3891733b
SHA1ce20a9b1db19f57bbeb45d7c0417c6703403c365
SHA256934d24f8c297db9f3302a76bf2681de247db94aa68bb86a645afef5e941990de
SHA5125d360da75bfd720bc2a6f4c15be1002ab73c537c112346e51d9f3aabb21987d78c78e3dd668674481da5f2cad9c502be018cf090e69418cc11f8436da352c81b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce7871a98c8e3664dab8e91aad1d7896
SHA19314cb91ffbabe53c4a074d4db94d31bf05a0d73
SHA25688ad31daefe3b150e48bbf3c72d4dc9dc8c9cc80040563e7f3618f84cc843930
SHA512af81517be01381aef37c9618795fa7cf6d74218930ff9106b3f7dcc24c59701a4c81fbba518fb6a18abcce6122cc8a936412371f3db3b7ec0f1432fe67dea391
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c8aa06171ac4704047f6248e6f1c0ea
SHA15c1b32f32d7c725c1c6dee7170d09e6b75849a67
SHA256166ec8568ce5529d80fe20d6777d22781a5a7bd227612e2f7bd733afebcac608
SHA5126ad347e4b1d19a539643aa1a10258299326c78c50a3d9a458b1c3b590bab36ba53525ee8fb9432d77d80bb44346038955b2e6d88a4113eb78096eb665172ee42
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a