Analysis

  • max time kernel
    135s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2024 01:51

General

  • Target

    apk/cyberRat/Port 7262 sample build/index.html

  • Size

    331B

  • MD5

    a1b267742dd8aa08e549c632bd4f26fd

  • SHA1

    4d3b8c2b16554bb002dd825cf40d24429e82c08b

  • SHA256

    76ddc2872947ba922fb13e95c4122710431c0476f09479a282ca6a3a0e60bf4e

  • SHA512

    df1af12e0511edb7b9567fb0230fe5fd19acb3c0571e153285f340c5a3b897d9c981c2fc2460422c55e5a430177a6deb8f54db115258f2f2c2a19076bf7efa3d

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\apk\cyberRat\Port 7262 sample build\index.html"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2588

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41011676ee9ad584e5ad4c30a4d22c61

    SHA1

    3ed055b3e0fd5d2fdb0933068a209682c345ed6b

    SHA256

    7748e75a70d12f93fe05205e068c2e5afc553e6a143c3b8cd4b7fa0b2d51b987

    SHA512

    c7cc885eae97686f65caf1eaa0557e52963b9b5a9b03ded8c4f783523b7ef900efe3bfbd7f6c0688ef11d8d1dc9e1e025f297f6200e0dfa1f6b5e39a582f8d45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a52f1d277b16642ad9f6643deed24ab0

    SHA1

    635c19414ccde959995a215594d03dfed2e2084e

    SHA256

    b181df4ea24ee3560b0ac53ee967a1d3568cd4fdc83bab617dd268d6654d0b75

    SHA512

    79ea64dadf1c775f8ba0a925f6a66598bed110fd4cb957ff913793d3e3a0d721be063055a2796996537be1f82dc22085e13c7db6cba5bbe83089175536da2060

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e1004cb1cd735516aa82a090d712e3d

    SHA1

    1c47de671e629cc72d215cba28cf3995bff59d56

    SHA256

    10a83b4774012a80b777608ab438349159b5c918bf64e13b8102189fd6cf9e80

    SHA512

    13229bc98b35d3b195086d138c5a09fc15fbe640b7ac3ff13d42967895ac6576dec3b5d7673a82abf471385e2f4603e13987e0eb025ee20d54dfc40532f82e9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c51c3f95507001f077e5f590219c937

    SHA1

    ef572601dee486303d45f2648b8caba3e0ec3430

    SHA256

    0acb6f19ed151b2d90e1073bc0a72d99b1c8f21cdcd47311ae28f0ca4398435d

    SHA512

    585719f8af609b954716ce9cd832b92658eb0c9365715f8cb60e8c9a881f7594ce61098d8538a3de5414c498bdc6a0a2efe64be47e67f0b3a8f089df880f6877

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68c2d7a65ead843ad0f9de1418377e61

    SHA1

    27aa13c39054318e0d4f36bbc8b9b246a884609c

    SHA256

    da49c9294c3c2f14a8034e1fe1636a0e2c34f050f74578cdf41356249aa217de

    SHA512

    b04691c09c0638247e0740dd9f816207a97dc2e6781d8e8f9f36a7870fd0907e71ebd9d326cfad7ae398236c2c7ef70d95efc37d181d095b34cc14f26d3c06be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8b0b6caab9b7db3ca1b35d941328fcc1

    SHA1

    2bd431686d31ee7c86cae3fe74ea28b0b6c61652

    SHA256

    538bf4a734db441e42a8c046bdf5350572ce06a06c9eb9b230cccaf4002a84da

    SHA512

    945d8ef6a57063d5aab4bb052d7126e432ed47dde54ed7c5244803e7b5a3f05a488952099b782ac0adb207bfa8ab6113ab8dbc4d93ce86c9825a6c8737cf6e4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80f1f21542a3c245220f5bde4c950332

    SHA1

    b74bc46511e9996d44efa9ebaa7d3cf687a20b75

    SHA256

    8eb8649ed732a03ad1b9ed14bab12485571e7ee3f2484e9590372c927398f23c

    SHA512

    4309e34a83b96f97ffd8b08a3345ef975e25d6cd038ff0d23fddc93275ba26794dc74824286caebba2d2e696823c9989e9908482ac06f8d6bca73d928e70b17b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8bd42a043e29fd446afc5a53be521ebf

    SHA1

    73816c06a78fd79f47fde62a96bcf419df2805ba

    SHA256

    efcc74b423b90d8b91424657bcb7f359a0da76aa90b2a5bf4407d6eaa6f2683e

    SHA512

    4f056d3875568494f8619c166e3592e67cd9ec10cf599cff862bead353f5d86a608342ad23ffa705893dd1575caf3bc00b5ca55cf6fd4a24c1144ac00c64e34d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e1afe8fe5d2192ca064fad5daa5b0cc

    SHA1

    d0a00bdc4ce18a35609e9ed649a4c9b1cfc12693

    SHA256

    7df700449cd3e36df53a52f2422f9117dd3b16bff8ebeb79e9b12c288dccf427

    SHA512

    18db99ee21273f21781a246c687c06b2102abcf077e71653ec80f909eead645dad9d89d3174f4dd1fe8da31460e3b13ce5828020f3ed47951812960e7d1bef48

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    362a5805b81b6812ddc8e2a1f1c8d4d4

    SHA1

    e1e96c7c7079d66d8015218c5161444981e0de55

    SHA256

    3e9154cef2e1e75cb7ee1fd241bab043fb6fbac2bf7191a8f04435b7ace4c166

    SHA512

    1050cc0fa9f55dd2d0d78d617fa80ddcf56b58d9ab4128b4f05ad9da342d96e0ac0701fa9d7ab0aadec402704eca71a88e52294f52e586ac37a9f89711586cca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aa0827345cadfc5a3238a89ca23a1e8e

    SHA1

    cd63db2beb304b3682d9f6668e16d7a2560c713d

    SHA256

    1e272e6b28f8bd3034e73de780c5298da486df4b768ceffea6b7f31b4c4f46dc

    SHA512

    15de9b4f26f916a6752cf4f3f491a97893cbb9e72da6bff0cdb7c61272d179484d9f9635c6b113504eff4e4ed7815ba10f54df9ed4ec381ce65da26948ae10f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c7a8735cb09c2d9af3094a22759c080e

    SHA1

    02f208bc62414168074682a2e637c9561e5b2f32

    SHA256

    37a3db9c0a05784704e549f6bd75eb098953fe73b2dabc38db366b7cae20c13f

    SHA512

    34eeca42f93bece3e1cba307134a5840556f5b5a970da799f61a9277b63fd7019aa7b11ac9e17cc8bece26d94018cf525f05ea70a0115d0fb7794bcec1ebe79d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbb7b2cc46b376779cbe594e3c1838f7

    SHA1

    d34db996da278ae33cb6777b21ed23816ccdc98f

    SHA256

    a4eaf401164366d242352a6e0ed46247a16a5cea85542b01f2a8fe75eaf007d9

    SHA512

    17cb60c275b0f29c9fcb0c8fa5affac6482e360b32faae6d6d4024e7c6f12dd16c738de29ae470360696ad52d6162c71d167e62c3f1309355d2f26207ad2b75c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee5f66de9b344bc13e8aafec64140de9

    SHA1

    647e4f220050cf66793ea2daba8e794ae443b199

    SHA256

    e54e2464a2d70a44ab11e074e2b12a96d5cfb0851e0b8c894fb3f48c8a7d9f14

    SHA512

    dcabb3e89acd2437bc64d81209a1512228842f3335d9721ad17f6b924f2c1c59187e3f8d5313fe4f599b5122924b783de852724a028488fc926f1631edd984ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    61dc296640fb02a6502ab0820310092c

    SHA1

    7fda988d503ddf5c4c38697886b12cbe612f022e

    SHA256

    93d160caed434fa8a363aa67486466bafeb91440bfbe4e74f8e9ef2f313d7b0e

    SHA512

    0289793303662926410f0b4ff066844fe089b57bdba5a69d1b4608de7509fa7e1b5c5a971b3527b7c2cda5fac1cc5f3844b045635814e80a569a5cec8f1863a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2fa9d9f9b8e0348e0aaf8045d9d9deb1

    SHA1

    a5f42f60b8586d9bc5cf909b773717cdc4d2453b

    SHA256

    4b90892e928000a45bb40e5d8b4fbcad27d6ea050b7d5f5203e0e9cd87c826f4

    SHA512

    55fc0877fcaea1ff54a990f17dd6bd8957ff709095d0fd6144ad9c9d673ac6ddbed0dca881cc1f6e6c85652896cc065757e8bc20c919469ccf46d5f93fb49268

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa9727666d9b1f57c3985ce54950f6c3

    SHA1

    039d95c1e14c95a11a05199e5b3ded50650949c1

    SHA256

    c6afbbd0efb5139d1976c2300397a0b4cbb72d907a70c7b46b97038d44bbbed7

    SHA512

    7e04a43188064931f9f1fb9c86ad7221b370e16512ce5549c6291da0f2a1d079bb171de615acdddf7aee0eeb8463fc0a4bcb352161f0348b9815f450ea81a913

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    399682333df6e96a97367753067bda32

    SHA1

    14582319577b50144b7d3f47a417c1517c4b1aae

    SHA256

    7708c0955d99b39391f10d7ea38d15a4445807127742bbb27a567969ccdc99fc

    SHA512

    fd65367cbe9fcbd6f8a9402e4b6a44b14976884c2bcdbe0bcfc48b88c35a4dd4b29dd8ca37393e0e68f73f054d327d4e9fbe89db9694d3d452e02137b339ce7a

  • C:\Users\Admin\AppData\Local\Temp\Cab3FD1.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar40ED.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b