Overview
overview
7Static
static
3662ce2779a...5c.exe
windows7-x64
7662ce2779a...5c.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3ANRITSU CO...NT.rtf
windows7-x64
4ANRITSU CO...NT.rtf
windows10-2004-x64
1BackendModels.dll
windows7-x64
1BackendModels.dll
windows10-2004-x64
1FreeImageNET.dll
windows7-x64
1FreeImageNET.dll
windows10-2004-x64
1MapStore.dll
windows7-x64
1MapStore.dll
windows10-2004-x64
1MapStoreViewer.exe
windows7-x64
3MapStoreViewer.exe
windows10-2004-x64
3Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Resources/...mon.js
windows7-x64
3Resources/...mon.js
windows10-2004-x64
3Resources/...age.js
windows7-x64
3Resources/...age.js
windows10-2004-x64
3Resources/...eak.js
windows7-x64
3Resources/...eak.js
windows10-2004-x64
3Resources/...ata.js
windows7-x64
3Resources/...ata.js
windows10-2004-x64
3Resources/...h.html
windows7-x64
1Resources/...h.html
windows10-2004-x64
1Resources/...h.html
windows7-x64
1Resources/...h.html
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
662ce2779aeca5637684558f792f43c114ff5d6dd2568c351f7cccd0dfab935c.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
662ce2779aeca5637684558f792f43c114ff5d6dd2568c351f7cccd0dfab935c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ANRITSU COMPANY FREE SOFTWARE LICENSE AGREEMENT.rtf
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
ANRITSU COMPANY FREE SOFTWARE LICENSE AGREEMENT.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
BackendModels.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
BackendModels.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
FreeImageNET.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
FreeImageNET.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
MapStore.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
MapStore.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
MapStoreViewer.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MapStoreViewer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Newtonsoft.Json.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Resources/connect/scripts/common.js
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Resources/connect/scripts/common.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Resources/connect/scripts/page.js
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
Resources/connect/scripts/page.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Resources/connect/scripts/unibreak.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Resources/connect/scripts/unibreak.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Resources/connect/scripts/unidata.js
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Resources/connect/scripts/unidata.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Resources/connect/search.html
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Resources/connect/search.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
Resources/connect/splash.html
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
Resources/connect/splash.html
Resource
win10v2004-20240426-en
General
-
Target
MapStoreViewer.exe
-
Size
46KB
-
MD5
52da62ef71d9a5b3b89c7e28cac8e07e
-
SHA1
6c36d10a724496a43629dc0da3395ee6e8b6ae82
-
SHA256
0db5c0acbb5f324e27dd1181dd0b16f7ed1a33e981f04a57c06ba40eec0564c1
-
SHA512
91f5959cda1c233ec867edf78ad1e9b6430bdca090dec896c1cbbea9d03e83be682838d1e0e862b1ef744e7036596529362dd8ea23702d50c938f7f1fa40f5d5
-
SSDEEP
768:CdtRAzdYahkL81oVjQxxxh+hT7M7DJUOhtzerRsop7+sTnzEhMPqaJzYcHeIm:WRAz7kL81Rh+hTo3JCFJp73Tn2iYI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 20 IoCs
Processes:
MapStoreViewer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg MapStoreViewer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" MapStoreViewer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff MapStoreViewer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 MapStoreViewer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings MapStoreViewer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 MapStoreViewer.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 MapStoreViewer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MapStoreViewer.exepid process 1176 MapStoreViewer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MapStoreViewer.exepid process 1176 MapStoreViewer.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-0-0x0000000074091000-0x0000000074092000-memory.dmpFilesize
4KB
-
memory/1176-1-0x0000000074090000-0x000000007463B000-memory.dmpFilesize
5.7MB
-
memory/1176-2-0x0000000074090000-0x000000007463B000-memory.dmpFilesize
5.7MB
-
memory/1176-3-0x0000000074090000-0x000000007463B000-memory.dmpFilesize
5.7MB
-
memory/1176-4-0x0000000074090000-0x000000007463B000-memory.dmpFilesize
5.7MB
-
memory/1176-5-0x0000000008820000-0x0000000008822000-memory.dmpFilesize
8KB
-
memory/1176-6-0x0000000074090000-0x000000007463B000-memory.dmpFilesize
5.7MB