Overview
overview
7Static
static
777169.org/...��.htm
windows7-x64
377169.org/...��.htm
windows10-2004-x64
377169.org/...er.exe
windows7-x64
377169.org/...er.exe
windows10-2004-x64
377169.org/...��.url
windows7-x64
177169.org/...��.url
windows10-2004-x64
177169.org/...PE.exe
windows7-x64
377169.org/...PE.exe
windows10-2004-x64
377169.org/...er.exe
windows7-x64
377169.org/...er.exe
windows10-2004-x64
377169.org/...ct.exe
windows7-x64
777169.org/...ct.exe
windows10-2004-x64
777169.org/...��.exe
windows7-x64
577169.org/...��.exe
windows10-2004-x64
577169.org/...��.exe
windows7-x64
777169.org/...��.exe
windows10-2004-x64
7Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 16:27
Behavioral task
behavioral1
Sample
77169.org/ɱ͡AVG-Spyware/77169.org˵.htm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
77169.org/ɱ͡AVG-Spyware/77169.org˵.htm
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
77169.org/ɱ͡AVG-Spyware/S-Player.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
77169.org/ɱ͡AVG-Spyware/S-Player.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
77169.org/ɱ͡AVG-Spyware/ĺڿͬ.url
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
77169.org/ɱ͡AVG-Spyware/ĺڿͬ.url
Resource
win10v2004-20240910-en
Behavioral task
behavioral7
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/MaskPE.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/MaskPE.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/hmimys-Packer.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/hmimys-Packer.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral11
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/vmprotect.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/vmprotect.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/4.1ƽ.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/4.1ƽ.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
77169.org/ɱ͡AVG-Spyware/̳̹/ڿԴ��.exe
Resource
win7-20240903-en
General
-
Target
77169.org/ɱ͡AVG-Spyware/77169.org˵.htm
-
Size
5KB
-
MD5
d122408c88ea147d35137fa775d78d32
-
SHA1
818dfc81160c9e783e195d914d4b2ad81417a2d2
-
SHA256
1a246e720e02d8b2f9c59eebb673e48885d6d7a8fb194b5f4f0de57df28c4812
-
SHA512
4c1963e822bd52ced208c5906de4901349717b5fed2367b028a4dc8923d8c04f0fa25b8b9c5cf32391acc750a594de4107af71118416cfbe04a53b326634b917
-
SSDEEP
96:m1OQF/fRA2RWhwM6w6mheySgh/SnqjQhhwQ0660X8bJhnYOPMj1zNMXlGvak:mXF/JA0VdIYehN2hwQpZ+JhnYOPMjxNJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433097927" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A9CE141-7836-11EF-B60D-EAF82BEC9AF0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000a19a8317f8546b5c6d5f4f6adef1d8732c273ba357fe49b5f68e3de3408f7a13000000000e800000000200002000000061e5962065bceb3859a60f408705977d9a3ebc5f7c82458dcc0b1a0004be594b20000000271fd504c4aacd1a103da97ab5ac024f8813fa970cea8dae20da33393309096d400000003889548cd17af9f35754b89f78befb7b7b64ad4c76ea6eb7b1e5230eef6f32c639523e4dfa36996d3fe01041f0da09ea15f47079afd3c2e515f6fe40cb026b43 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000d38bc030e9867e483d3e6af672510754f2968895bec87791fbed5977e939bd9c000000000e8000000002000020000000a65ca4ba80808fb4c08d090e9c4bec8642abc72b24a064c178a7214a7072543690000000619f430c44dd17466922c944e3d776f9c711592bcb27290feb07bd8bfd8c91bf66d3758a9896bb0e36cc9082cae78485025b8e9afc3f7a97ae0271f23e31c8af4f10e960092990f7ce41acd4c5c770bf515e87c3ff09293fc1ccb9ed31a4d832649ce4bfe7049f27208072b932ddda610584587dbac81ca2340b28f7cfcc82cb72c7070592765e2cc122e39c1b1e8142400000007ae5ac5337b29b17ec5358b66e934dca0698b761d6402966c229ecb8af977be6742db360b26bb2f3ad872aae5320aeb25c1633d12a0d5b4cd0c52e4896c6272f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1099113c430cdb01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1956 2332 iexplore.exe 30 PID 2332 wrote to memory of 1956 2332 iexplore.exe 30 PID 2332 wrote to memory of 1956 2332 iexplore.exe 30 PID 2332 wrote to memory of 1956 2332 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77169.org\ɱ͡AVG-Spyware\77169.org˵.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bf460c93bfc79f9298f5503a26ab8df
SHA1d3e390b4dc2d2951d0c1e23d437b8defe77e722e
SHA2567b0856fc25c0c9c9ac4089c7b4e799f4fe84ead8c747fefe83b3705dfd4049d1
SHA5127d9f24eb17ae9f1b3e17de64cb5ed2fa1296d777691248149c73a509dad14dff557dd5da8f69773f734040ccec28cd2a4f24df6a52a9b5bf907ef1d90af81bbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c8567ae0dc7f252f730d6131df7af740
SHA161ac76c5893ca9a9bf54c3a681c3ae5a39d31234
SHA2565288b9dc36e7b679f59deef776db0829022fdccf8dfa4a26773a310096ef3060
SHA5120f0a4bae1398ac7eff1d01ed88a302c806e13563d24e37365e44f630ac45a008987d07155f9534a3aadbda93ce34e72583ee630a7f7fc567570efb45a2d08d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD505f07a6401833843570d13202efe920e
SHA173657a19727fb4bca6980f4b7b5143398f584468
SHA25642821f313308871efd79e5b0486543bcbbe7838bdb41d6f4612a2c024af69203
SHA51291489ebcb3c71588cb7de9da4d0472a127979a9110481e897b36b63c5fa484b77f8ddc07f096cafd0bc89600b7b6c0481eac054ebfd79bdb2040f0c79d67dd97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD595138822e58f94a799c43cf180b9b29f
SHA1015549818841580a08600ba895e82027031d1e55
SHA2562bab8d4f69d56dcc70fe3e30df1912fc4f8ae5ee9e320f7b0c912266bd9dc663
SHA5121999cb971aa5da3b10f5b9d862b640cbe04c4d0c57c40c04177bc5bb3e63e7a7ecbe0f99f6f37e7ea62641a720ef040abd5802d57d4945da17e1e5319484a3d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5786788f6b3a4fdccc41c35a435f03fd9
SHA1926c5bfd38625eda44eb8ad2bb8268e0ebb37570
SHA2563c4855063e23e8395146accd18b5e69724cb60497a91e9201bce926eb113d3c3
SHA51295dc0894d5ab091f38b575854fe0a6ed00894e9e27d83dee691ddc93d64910e1ac112b104b777c712972adf2e3c656e5c7cbfcd1768207ab6bb4f061b0aa5cfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b67ff78c9aba2e7ab657a6e76e792023
SHA1ccfb99748a3f8776b4c5957ebf08fe11824bfbde
SHA256daab98507939acac4308f271bc10e94a08945853d48071def889670d165bff4c
SHA512967e2622175e6ded1bda164f9f7470e3d2c3984fe2d500e325fa7b439088df75bcf9172fe03669bc77fb121d27be8731c593a2476fbe796cdacdd2d3622e0907
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d48ff7359e9127ce7cb7aa799d202bbf
SHA19b11c6a46d38fd7aa17933473de8346a1ca2911b
SHA25621627e626ad87184c2fe47892fb3792920fc3c22e87f3a88f9b3bd5ad0a3cb7c
SHA51214fb8fd0238ab92882f6202bb068f207eaa6db820c4ec290bb344325157cfcf5e315e3f83bdbb3ca0ebe4a88359675259ba3a5b773bdbba667680390753a6ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a36f7d8576e09a48ca4860c73b9fb504
SHA12abb7611dfc02c91fd26d38c9c3741f540b321b6
SHA256ef81cc7dbd178ae4eb26a1ebe50f5a7a6b75f662e211aa72b4614ec8a23bc811
SHA512732577f7a3f8a0b8e460f86257f765c71ef24563294bb7603bea6ed00aa7f55f5ca288a6a00d7aa84ef45084bd8c65f390c902c42176d2878489349f44f4017d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b