Overview
overview
6Static
static
1Safe_Exam_Browser.zip
windows11-21h2-x64
1Safe_Exam_...dme.md
windows11-21h2-x64
3Safe_Exam_...AC.dmg
windows11-21h2-x64
3SafeExamBr...fo.xml
windows11-21h2-x64
1SafeExamBr...kgInfo
windows11-21h2-x64
1SafeExamBr...B.tiff
windows11-21h2-x64
1SafeExamBr...n.icns
windows11-21h2-x64
3SafeExamBr...e.icns
windows11-21h2-x64
3SafeExamBr...n.tiff
windows11-21h2-x64
1SafeExamBr...nu.nib
windows11-21h2-x64
3SafeExamBr...ce.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...er.nib
windows11-21h2-x64
3SafeExamBr...le.nib
windows11-21h2-x64
3SafeExamBr...ds.nib
windows11-21h2-x64
3SafeExamBr...am.nib
windows11-21h2-x64
3SafeExamBr...al.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...ty.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...00.nib
windows11-21h2-x64
3SafeExamBr...ow.nib
windows11-21h2-x64
3SafeExamBr...er.nib
windows11-21h2-x64
3SafeExamBr...n.tiff
windows11-21h2-x64
1SafeExamBr...ges.js
windows11-21h2-x64
3Safe_Exam_...11.exe
windows11-21h2-x64
4Safe_Exam_...up.msi
windows11-21h2-x64
6Safe_Exam_...er.txt
windows11-21h2-x64
3Analysis
-
max time kernel
89s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-05-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
Safe_Exam_Browser.zip
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
Safe_Exam_Browser/Readme.md
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
Safe_Exam_Browser/Safe Exam Browser for Mac user/SEB-Browser3.3.2.macOS.for.new.MAC.dmg
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Info.xml
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/PkgInfo
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/AboutSEB.tiff
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/AppIcon.icns
Resource
win11-20240508-en
Behavioral task
behavioral8
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Appearance.icns
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/ApplicationsIcon.tiff
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/MainMenu.nib
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesAppearance.nib
Resource
win11-20240426-en
Behavioral task
behavioral12
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesApplications.nib/keyedobjects-101300.nib
Resource
win11-20240419-en
Behavioral task
behavioral13
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesApplications.nib/keyedobjects-110000.nib
Resource
win11-20240426-en
Behavioral task
behavioral14
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesBrowser.nib
Resource
win11-20240508-en
Behavioral task
behavioral15
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesConfigFile.nib
Resource
win11-20240426-en
Behavioral task
behavioral16
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesDownUploads.nib
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesExam.nib
Resource
win11-20240426-en
Behavioral task
behavioral18
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesGeneral.nib
Resource
win11-20240508-en
Behavioral task
behavioral19
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesNetwork.nib/keyedobjects-101300.nib
Resource
win11-20240508-en
Behavioral task
behavioral20
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesNetwork.nib/keyedobjects-110000.nib
Resource
win11-20240426-en
Behavioral task
behavioral21
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesResources.nib/keyedobjects-101300.nib
Resource
win11-20240426-en
Behavioral task
behavioral22
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesResources.nib/keyedobjects-110000.nib
Resource
win11-20240508-en
Behavioral task
behavioral23
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/PreferencesSecurity.nib
Resource
win11-20240426-en
Behavioral task
behavioral24
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/ProcessListView.nib/keyedobjects-101300.nib
Resource
win11-20240419-en
Behavioral task
behavioral25
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/ProcessListView.nib/keyedobjects-110000.nib
Resource
win11-20240426-en
Behavioral task
behavioral26
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/SEBBrowserWindow.nib
Resource
win11-20240426-en
Behavioral task
behavioral27
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/Base.lproj/SEBServerOSXViewController.nib
Resource
win11-20240426-en
Behavioral task
behavioral28
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/BrowserIcon.tiff
Resource
win11-20240419-en
Behavioral task
behavioral29
Sample
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Resources/ModifyPages.js
Resource
win11-20240426-en
Behavioral task
behavioral30
Sample
Safe_Exam_Browser/Safe Exam Browser for Windows user/SEB-Browser3.6.0 WIN10+WIN11.exe
Resource
win11-20240508-en
Behavioral task
behavioral31
Sample
Safe_Exam_Browser/Safe Exam Browser for Windows user/SEB_3.6.0.633_x64_Setup.msi
Resource
win11-20240508-en
Behavioral task
behavioral32
Sample
Safe_Exam_Browser/Version Information SEB Browser.txt
Resource
win11-20240426-en
General
-
Target
SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Info.xml
-
Size
4KB
-
MD5
450b225b3bf44ad35a449702c68476a1
-
SHA1
841d4377310bfc4e5309cba9784eb4197d151f34
-
SHA256
640fb495ba065bcd8f0d91de6b1cd285e761d242046b5b844d5dcf6fc00ed9eb
-
SHA512
e61947565c69a43d015c40ea22f5b2f6a8639f7fa77987642656665670f03356b7d7654efce57b54a42fe3059c12d048587128dd16122e3886be044db2e648c0
-
SSDEEP
96:CyKQxBYGAIDj27cH130gIdxi+WjkS1/O7STOApZTQpXSQfdtjX:XEGAyB8xi5CPX
Malware Config
Signatures
-
Processes:
iexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "20555013" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31108640" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
MSOXMLED.EXEdescription pid process target process PID 3096 wrote to memory of 404 3096 MSOXMLED.EXE iexplore.exe PID 3096 wrote to memory of 404 3096 MSOXMLED.EXE iexplore.exe
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SafeExamBrowser-3.3.2\Safe Exam Browser.app\Contents\Info.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SafeExamBrowser-3.3.2\Safe Exam Browser.app\Contents\Info.xml2⤵
- Modifies Internet Explorer settings
PID:404