Overview
overview
7Static
static
3OfflineExp...ow.url
windows7-x64
1OfflineExp...ow.url
windows10-2004-x64
1OfflineExp...OE.exe
windows7-x64
7OfflineExp...OE.exe
windows10-2004-x64
7OfflineExp...rt.url
windows7-x64
1OfflineExp...rt.url
windows10-2004-x64
1OfflineExp...in.vbs
windows7-x64
1OfflineExp...in.vbs
windows10-2004-x64
1OfflineExp...le.exe
windows7-x64
1OfflineExp...le.exe
windows10-2004-x64
1OfflineExp...te.url
windows7-x64
1OfflineExp...te.url
windows10-2004-x64
1OfflineExp...pl.exe
windows7-x64
1OfflineExp...pl.exe
windows10-2004-x64
1OfflineExp...us.dll
windows7-x64
3OfflineExp...us.dll
windows10-2004-x64
3OfflineExp...eN.exe
windows7-x64
1OfflineExp...eN.exe
windows10-2004-x64
1OfflineExp...ne.dll
windows7-x64
1OfflineExp...ne.dll
windows10-2004-x64
3OfflineExp...le.dll
windows7-x64
1OfflineExp...le.dll
windows10-2004-x64
3content/mp...lay.js
windows7-x64
3content/mp...lay.js
windows10-2004-x64
3content/mp...ons.js
windows7-x64
3content/mp...ons.js
windows10-2004-x64
3content/mp...lay.js
windows7-x64
3content/mp...lay.js
windows10-2004-x64
3content/mp...mon.js
windows7-x64
3content/mp...mon.js
windows10-2004-x64
3components/mpint.dll
windows7-x64
1components/mpint.dll
windows10-2004-x64
1Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/BuyNow.url
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/BuyNow.url
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/OE.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/OE.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/Support.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/Support.url
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/VBSample/frmMain.vbs
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/VBSample/frmMain.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/VBSample/oee_sammple.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/VBSample/oee_sammple.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/WebSite.url
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/WebSite.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/ftpupl.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/ftpupl.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/gdiplus.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/gdiplus.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/keYgeN.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/keYgeN.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/lucene.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/lucene.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/mfile.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
OfflineExplorerEnterprise/Offline Explorer Enterprise/mfile.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
content/mpint/mpintDOverlay.js
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
content/mpint/mpintDOverlay.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
content/mpint/mpintOptions.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
content/mpint/mpintOptions.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
content/mpint/mpintOverlay.js
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
content/mpint/mpintOverlay.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
content/mpint/mpintcommon.js
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
content/mpint/mpintcommon.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
components/mpint.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
components/mpint.dll
Resource
win10v2004-20240508-en
General
-
Target
OfflineExplorerEnterprise/Offline Explorer Enterprise/OE.exe
-
Size
2.8MB
-
MD5
5b03cf6713ab28d368a88d0c158f900e
-
SHA1
2f7bad10c29a171e4e18ff36ec72e977ad0047fe
-
SHA256
725f51fdf6139c5f49010475f049054953cfce930d665b861a806b752e114d6d
-
SHA512
f58bfd1144b56422e148fde38daebdd20a2e9e1a8070e40ac8c9b6f42b2c7d625fbe1f93c92ed6592410d585c2742e166cc2b6fc881749d78dd399996b21b499
-
SSDEEP
49152:crYeBJcn18Jq5kgRrY0Cbdr9jJe5bqRqnLRwUqfxVL6ARKaIoJkmnEliD7tcwro:oYcq80lRbURdehq66ZVWR3ovXxFr
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
OE.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
OE.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt OE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link\ = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\OfflineExplorerEnterprise\\Offline Explorer Enterprise\\Add_UrlO.htm" OE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page\ = "file://C:\\Users\\Admin\\AppData\\Local\\Temp\\OfflineExplorerEnterprise\\Offline Explorer Enterprise\\Add_AllO.htm" OE.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main OE.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch OE.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link OE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline &Explorer: Download the link\contexts = "34" OE.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page OE.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\+ Offline E&xplorer: Download the current page\contexts = "243" OE.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OE.exe -
Modifies registry class 64 IoCs
Processes:
OE.exedescription ioc process Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Queue file OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8D08ACE-78DC-11D4-84BA-008048B33DEA}\ProxyStubClsid32 OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{363569E1-0A87-4617-A7DC-210049609433}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OFFLIN~1\\OFFLIN~1\\OE.exe" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271F3C28-5446-11D5-8C6F-00C0DF030E23}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\ProxyStubClsid32 OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23}\TypeLib OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEConnection\ = "OEConnection Object" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271F3C28-5446-11D5-8C6F-00C0DF030E23}\ProgID\ = "OE.OEConnection" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B8D08AC1-78DC-11D4-84BA-008048B33DEA}\1.0\0\win32 OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8D08ACE-78DC-11D4-84BA-008048B33DEA} OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\TypeLib OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32 OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{363569E1-0A87-4617-A7DC-210049609433}\LocalServer32 OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.boe OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\DefaultIcon OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\shell OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\TypeLib\ = "{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{271F3C24-5446-11D5-8C6F-00C0DF030E23}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23}\ = "IOEProject" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23} OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\ = "IOESequencerEvents" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\ = "IMainOE" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\ = "IMainOE" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{271F3C26-5446-11D5-8C6F-00C0DF030E23}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\TypeLib\Version = "1.0" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OESequencer\Clsid OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{772627C4-544A-11D5-8C6F-00C0DF030E23}\Version\ = "1.0" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23}\ProgID OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B8D08AC1-78DC-11D4-84BA-008048B33DEA}\1.0\FLAGS OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB7B9780-51DF-11D5-8C6F-00C0DF030E23}\1.0\0 OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OfflineExplorerEnterprise\\Offline Explorer Enterprise\\OE.exe,0" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Template file OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Template file\DefaultIcon OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B8D08ACE-78DC-11D4-84BA-008048B33DEA}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23}\TypeLib\Version = "1.0" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EB7B9785-51DF-11D5-8C6F-00C0DF030E23}\ProgID\ = "OE.MainOE" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OEFolder\ = "OEFolder Object" OE.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Queue file\DefaultIcon OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Sequencer file OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23}\ = "IOEFolderEvents" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23} OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\TypeLib\Version = "1.0" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35DBDEE2-59CC-11D5-8C6F-00C0DF030E23} OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C2-544A-11D5-8C6F-00C0DF030E23} OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23}\ProxyStubClsid32 OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\TypeLib\Version = "1.0" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\OE.OESequencer OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D08ACF-78DC-11D4-84BA-008048B33DEA}\ProgID OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Backup file\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OfflineExplorerEnterprise\\Offline Explorer Enterprise\\OE.exe %1" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{271F3C26-5446-11D5-8C6F-00C0DF030E23} OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{772627C0-544A-11D5-8C6F-00C0DF030E23} OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35DBDEE0-59CC-11D5-8C6F-00C0DF030E23}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BCF698C-278D-4281-83F5-A9B6318FD4F2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{772627C4-544A-11D5-8C6F-00C0DF030E23}\ProgID\ = "OE.OEFolder" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Queue file\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OfflineExplorerEnterprise\\Offline Explorer Enterprise\\OE.exe,0" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB7B9781-51DF-11D5-8C6F-00C0DF030E23}\TypeLib\Version = "1.0" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FEB83DA8-ADDA-48D8-A460-9E399ACD99C9}\ = "IOESequencer" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8D08ACE-78DC-11D4-84BA-008048B33DEA}\TypeLib OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{271F3C24-5446-11D5-8C6F-00C0DF030E23}\ = "IOEConnection" OE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8D08ACF-78DC-11D4-84BA-008048B33DEA}\ProgID\ = "Oe.OfflineExplorerAddUrl.1" OE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Offline Explorer Sequencer file\shell\open\command OE.exe Key created \REGISTRY\MACHINE\Software\CLASSES\Offline Explorer Sequencer file\DefaultIcon OE.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OE.exepid process 2180 OE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
OE.exedescription pid process Token: 33 2180 OE.exe Token: SeIncBasePriorityPrivilege 2180 OE.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
OE.exepid process 2180 OE.exe 2180 OE.exe 2180 OE.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
OE.exepid process 2180 OE.exe 2180 OE.exe 2180 OE.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
OE.exepid process 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe 2180 OE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\OE.exe"C:\Users\Admin\AppData\Local\Temp\OfflineExplorerEnterprise\Offline Explorer Enterprise\OE.exe"1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx