758da04589faf3a8aedeae4f9e26c90c4a7530f5e8368a368efe8ef792f167d9

Analysis

max time kernel
132s
max time network
260s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-07-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BoratRat_Cracked.exe.xml
Size

5KB
MD5

3e645ccca1c44a00210924a3b0780955
SHA1

5d8e8115489ac505c1d10fdd64e494e512dba793
SHA256

f29e697efd7c5ecb928c0310ea832325bf6518786c8e1585e1b85cdc8701602f
SHA512

ea7e3a6e476345870f05124a56dde266e1ad04b557b2dde83c5674cfdf3be00f26d3db6a14a8d88ecf75e2c9e3a12e6955f6c85654ba967c17664e9acc3d4f1f
SSDEEP

96:Xr7T7Kc7KnreNRrqAbGxRN3ZV/Kw4YpyMasJ8J4YqJyM/:Xr7T7D7or8E3ZV/Kw/pvasJ8J/qJv/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80fc7be0fcd4da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "427640088"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B34D321-40F0-11EF-92F7-EAEDABA7A252} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3758416768"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118588"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c123f9c4dbdd474f92360c4fbc91fafc00000000020000000000106600000001000020000000d19409176c74324f403ab42101d904a8d894930592e38d8664aeae0d64afc30c000000000e80000000020000200000003b45c40a2e2e8ebdf0aff018013b3fa180613bca9366da21bcbe47cdbbc8b4f0200000008d59f179d037fc71575be857d80142c97f860278296468aa7a2f2409f22e01fa400000003fb32201a7bf6c03b9a85300f8893d73b856143e8714772f2aaae6ac4ec65b50c93982eaa86ba6b2610c93a5f8176d181fa26777364a6b356258cbb135240e51	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d074e0fcd4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31118588"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3758260484"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3758416768"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118588"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427623494"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3758260484"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31118588"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c123f9c4dbdd474f92360c4fbc91fafc000000000200000000001066000000010000200000000ddb480c75ed7401991c612bda8ad703acaa5ab63534af9fcddb3a99c9335cea000000000e8000000002000020000000532d0aefaca3cc24451bb96288d48c510c77c2f22a1ae371e0d6a3383fd8d3ed20000000c0f8c37c157da4b67893b1d9d8e16fc803b5e2fe546f8a82017a889f5826af5740000000baebc7d78d1a4c5fd3d7240e8fc7fa996f6c5b06b3db6516f286fd069cd3f70e88331e65a2b66699ebb3beacd488c88b6d89172c337d2e02485e041ba52ddf1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "427672080"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE
3872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 2340	4056	MSOXMLED.EXE	75
PID 4056 wrote to memory of 2340	4056	MSOXMLED.EXE	75
PID 2340 wrote to memory of 3872	2340	iexplore.exe	77
PID 2340 wrote to memory of 3872	2340	iexplore.exe	77
PID 2340 wrote to memory of 3872	2340	iexplore.exe	77

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:82945 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
2f1af77de3b23e57f86e2ed3f8605803

SHA1
72cbfe907207b956a0ddadcf238699594973eed9

SHA256
afc3534afaa0326fd475bd776d45a624f3522f84c51afdd52e7e2ae19f954cf1

SHA512
a0f98c95293c9cac09bbb257445cea11ab707568191011660b89a1a11c587abe2c7ed945762b99847a0cf33648bb6c4e70d424f4fb977306da98d64172fa82db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
02bf741b351cbb17dab70a27ea87768a

SHA1
4eb4595064e444840ca36b06d8114e4fa667f185

SHA256
956ee0b5c0a43776426cea194b5c3a1f6557be25dabfecf7949d72bd67711ed5

SHA512
ea67357cb9f3aa89ccdde22c2eedebd5d608fd8b33f4b7025c3172eefcc9c8c417d9f4135d413535fae8b0120afabd7aa4b7bfbfdfe7fbc16d8b5c3f18ed106b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
49c10a718b150260f4f411b04dcd2194

SHA1
4e874cb4ac43458fbd57652acd32eed787625186

SHA256
2de08e5605bfbadb42e21a0f2c25a8eb0ac076b8e57d33359b26776e58eb92f7

SHA512
f693191ed3861dffe58f38d7eee219c219908b4d5da81ffb496ff948b651f5416ea58e9ea62a436b315cc789d1e65e83d3ae61b16040b9db764b4e09e4cc9177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verFCCF.tmp

Filesize
15KB

MD5
1a545d0052b581fbb2ab4c52133846bc

SHA1
62f3266a9b9925cd6d98658b92adec673cbe3dd3

SHA256
557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

SHA512
bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T28YHK6H\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\90GOV1WX.cookie

Filesize
545B

MD5
f9defe9cfc084f83e55092f4c8ed0455

SHA1
f6bfeb315666b36f8a6e59a6d0c22d063ca5799a

SHA256
c42317f155f5907303113f303de13f55ed4577ab1124ce48a24dc5202c04b13b

SHA512
b6553167cfc24629b67918c905174e9652e20c7e7e3bb774c38bb0f8d5f3726863b23da0caf8590298533cd0cadba2154628b48ee71fc6474a38a2c1b962cf5f

Download Submit
memory/4056-8-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-20-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-10-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-12-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-14-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-13-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-11-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-0-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-15-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-16-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-21-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-9-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-19-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-18-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-17-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-7-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-6-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-5-0x00007FFE4A840000-0x00007FFE4AA1B000-memory.dmp

Filesize
1.9MB

Download
memory/4056-3-0x00007FFE4A8E5000-0x00007FFE4A8E6000-memory.dmp

Filesize
4KB

Download
memory/4056-4-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-2-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download
memory/4056-1-0x00007FFE0A8D0000-0x00007FFE0A8E0000-memory.dmp

Filesize
64KB

Download