Analysis
-
max time kernel
300s -
max time network
240s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 13:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://2001:7f8:1::a500:6762:1
Resource
win7-20240729-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://2001:7f8:1::a500:6762:1
Resource
android-x86-arm-20240910-en
android-9-x86
2 signatures
300 seconds
Behavioral task
behavioral3
Sample
http://2001:7f8:1::a500:6762:1
Resource
android-x64-20240910-en
android-10-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
http://2001:7f8:1::a500:6762:1
Resource
android-x64-arm64-20240910-en
android-11-x64
2 signatures
300 seconds
Behavioral task
behavioral5
Sample
http://2001:7f8:1::a500:6762:1
Resource
macos-20241101-en
macos-10.15-amd64
1 signatures
300 seconds
General
-
Target
http://2001:7f8:1::a500:6762:1
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2836 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe 2836 explorer.exe
Processes
-
C:\Windows\explorer.exeexplorer http://2001:7f8:1::a500:6762:11⤵PID:2272
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2836