Overview
overview
7Static
static
1First Unit.../JS.js
windows10-2004-x64
3First Unit.../JS.js
windows11-ltsc_2024-x64
3First Unit...on.svg
windows10-2004-x64
3First Unit...on.svg
windows11-ltsc_2024-x64
4First Unit...dle.js
windows10-2004-x64
3First Unit...dle.js
windows11-ltsc_2024-x64
3First Unit...dle.js
windows10-2004-x64
3First Unit...dle.js
windows11-ltsc_2024-x64
3First Unit...min.js
windows10-2004-x64
3First Unit...min.js
windows11-ltsc_2024-x64
3First Unit...rap.js
windows10-2004-x64
3First Unit...rap.js
windows11-ltsc_2024-x64
3First Unit...rap.js
windows10-2004-x64
3First Unit...rap.js
windows11-ltsc_2024-x64
3First Unit...min.js
windows10-2004-x64
3First Unit...min.js
windows11-ltsc_2024-x64
3First Unit...d.html
windows10-2004-x64
3First Unit...d.html
windows11-ltsc_2024-x64
3First Unit...e.html
windows10-2004-x64
3First Unit...e.html
windows11-ltsc_2024-x64
3First Unit...ut.lnk
windows10-2004-x64
7First Unit...ut.lnk
windows11-ltsc_2024-x64
3First Unit...n.html
windows10-2004-x64
3First Unit...n.html
windows11-ltsc_2024-x64
3First Unit...2.html
windows10-2004-x64
3First Unit...2.html
windows11-ltsc_2024-x64
3First Unit...unk.js
windows10-2004-x64
3First Unit...unk.js
windows11-ltsc_2024-x64
3First Unit...min.js
windows10-2004-x64
3First Unit...min.js
windows11-ltsc_2024-x64
3First Unit...min.js
windows10-2004-x64
3First Unit...min.js
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/10/2026, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
First United Bank/JS.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
First United Bank/JS.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
First United Bank/Settings/underwork/static/img/construction.svg
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
First United Bank/Settings/underwork/static/img/construction.svg
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.min.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.bundle.min.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.min.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
First United Bank/Settings/underwork/static/vendor/bootstrap/js/bootstrap.min.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
First United Bank/cod.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
First United Bank/cod.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
First United Bank/done.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
First United Bank/done.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
First United Bank/file/lolo - Shortcut.lnk
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
First United Bank/file/lolo - Shortcut.lnk
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
First United Bank/login.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
First United Bank/login.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
First United Bank/login2.html
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
First United Bank/login2.html
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
First United Bank/processing/done_files/13.884592655f8e03c201b2.chunk.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
First United Bank/processing/done_files/13.884592655f8e03c201b2.chunk.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
First United Bank/processing/done_files/AppMeasurement.min.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
First United Bank/processing/done_files/AppMeasurement.min.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
First United Bank/processing/done_files/RC59736ece5d774b119d38fc68ef2eb150-source.min.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
First United Bank/processing/done_files/RC59736ece5d774b119d38fc68ef2eb150-source.min.js
Resource
win11ltsc2024-20260911-en
General
- Target First United Bank/Settings/underwork/static/img/construction.svg
- Size 14KB
- Sample261001-w23a2avamd
- SHA256 34e11241c18bfef0e2b9533f6c143713b77a28a55123f225375d8a368b60840b
- MD5 f6f3fc94a20339a31ba26813a81da54d
- SHA1 5ebd41043c7ceaad096424e39adb32c86b22a5e4
- SHA512 292bfc298eb4debc4d56f6cf8079acec63be34401430889203c16bc34eed262d530045e644159184f0e9e42b03dc0874bc56cb810fef007d5af81e9b28883b7d
- SSDEEP 192:qKROm6aSRyMFsda51kjTQMlOU7b8CrgQBUgQBSehu:dwyMFsdjWU7DUdk
- TLSH T14B62A576471C699AF210C3DDC6C464FF645E9CE7E56643ACC782A21B7E310E7827C928
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1727323775" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "497644144" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3014aac9da51dd01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281618" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{92696473-BDC5-11F1-8007-E240DD933837} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e0000000000200000000001066000000010000200000001c9fdcef954c84cde0d958792c5afcc0e32941a256f6e8abba67abdc7a3e7026000000000e800000000200002000000018d9c71f37cbf4b7b7a0ab4af0aea437116a49f8e99bc466d8430e0b35558b1820000000c950a6ba6e26820e4550703bc070cb168ed6cf74b7fefe3e637c38a9477e23b840000000d2f2d0e6fda89d05c17f226614a0ac923150dd5ec108bea811385d8a482579013b3c4e330fdc11a4603ccaa1f76722c4a87b8ef14793a697d5ee5188a9e3b4b5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31281618" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1733886329" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3032a5c9da51dd01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f916af097bf064c9e2f3ef66abc66e000000000020000000000106600000001000020000000b26baeff798ad5dac8f80257bcf83a98fe1d6ab82f0cfd38771778eafa27bf9f000000000e80000000020000200000001796128af2c762e1f32ad0371b7aa7a6ce5b95984ca96197abfe1a458a7d9ca22000000059e6441813239adc21cf5fec1eb6d5365755125b761e238587644231c14b65fd40000000491626c9301d729d4b4807936ceef41d4dd793fffea401e7e98cd0640aef2083e30ee15d9d52ba7d0c301557e28d3c98115166ad2c3b0ccae480d198a314280c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2888 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2888 iexplore.exe 2888 iexplore.exe 5116 IEXPLORE.EXE 5116 IEXPLORE.EXE 5116 IEXPLORE.EXE 5116 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2888 wrote to memory of 5116 2888 iexplore.exe 86
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\First United Bank\Settings\underwork\static\img\construction.svg"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5116
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 a8ae89c4320a877bfdc7fa166071f811f55589e0639c14cffe37d659daac0db6
- MD5 7949983f78ba72edb5343d94a6da399b
- SHA1 bbc848bec8705929e36130a2e059bbf690431dcf
- SHA512 0e492c2145956f11c245b71ed207a1552c58e7ffaf003524b48142a28f52ccfc2fd03b7b3de862cb9844b476297c77c8e41f92625c6fd17e3c8b4be36aae859c
- TLSH T1DBF0DC82233CEFF078610D9D1AAC979EB130FAE354C8080FA02D4AD591E636F280E535
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 c88f92feca2b34594386de0a97846a3b5795895fb4d3f2a5047717490342654b
- MD5 a7db16fb07f47b865fa289b194eae9f3
- SHA1 ac3135a156f019b98de9ab20b80b9ccf4ff9e9e5
- SHA512 8984d1c6fb7a5d754c54f97fdfe6c246effb074917c4b06e1d7501eb3f1494ab00b2ac5303f3b5d63cff40da7f3c233d626cd9e658262c1343d1244c3bb2083e
- TLSH T18DE0C03825FA815FF1E5E53847C5742565AAF032046DF3B839C44B08E706640AC03929
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EFFG4FKD\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH