Analysis

  • max time kernel
    277s
  • max time network
    295s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-11-2020 06:28

Errors

Reason
Machine shutdown

General

  • Target

    ch/index.html

  • Size

    57KB

  • MD5

    f2ee9a40cf33ebf2319b55311777aea1

  • SHA1

    200e696b1e4b8cacf5e87eee2d7c1072b015b53c

  • SHA256

    61aff9ecf65c84242a4fce680ebc80ec15c3f56472d22ca2d83be9cac95c64c2

  • SHA512

    d8794362aa53ce35fc20fc395e76ecf78c371595029efd73909db446148fa251a70fdcd34ab67bdd0f1e0ac08e08651306bd15224d44755ed86e32cb4f003a3f

Score
8/10

Malware Config

Signatures

  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ch\index.html
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1704
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0 /state0:0xa3ad1855 /state1:0x41c64e6d
    1⤵
    • Modifies WinLogon to allow AutoLogon
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

3
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    MD5

    ffc04cd305e33221116feebf2eaa50b0

    SHA1

    6aeecd1a32ce6655a43e6b35cb2d0cb45876c9d4

    SHA256

    e0215011ac1136f278389a2a9b9572d9cdbb704f4a2a6d4b9cb8e99eba316de4

    SHA512

    ecd09a4db7f337f7b4b767edca0615262af8785c3dd85e6369037c04eda0865c59949a406e6e016ba8e893e7f740881be22909aa472ea6fd1c38aa3902979a01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    MD5

    f7974a480be2dc5991c6809528061a95

    SHA1

    935c9be41b4a9cd00b0186e32cc62553e2e8cfbc

    SHA256

    fa18934b5c30a61aa162554db59752d32da0cc5a5cad6c098e299e61b628d0a5

    SHA512

    0b4c1cc91bc2c964a67b4897c59a9690e1b7b201f8eabb67bcec19edc87c7bcaa57f42d01c849d724507ebd3578b6367aedf12bf94a27abdd7ba8ed4d0560351

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\71UQJDP8.cookie
    MD5

    fb4d33ee8d949cac9823a7cdbce3c76a

    SHA1

    f75ca6c204201aad525137cc4d1d17f374113401

    SHA256

    2b4931bbd87f948414931e132a7173e8eaf4a5c8187c8e6c3d5821eccb3b3146

    SHA512

    e2ea14989d9641a0ea7bcf528ab033c350e074dfc52de060eabdf60d4b32dcaaf82f643a09a1473cffbe87669c7ecf9ca618aca34d3f63c18856e90ca00dd086

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JVMQO1QV.cookie
    MD5

    a4cc9fb28aa4fe7552a8685ca69e3a55

    SHA1

    ec10361698802698868a404216b151ebd93e126a

    SHA256

    96b6673e63f5f3034dfa1a4aabff28c31c7e3b413cd73078b4c02506f1a1845f

    SHA512

    2e4943219bcfe8750131bcd7f69c098247c95885570221b0a021cf900cc873f01ba5d6ebe4fe22c2c1cf4786b609666f576b6f46a5d32c224d9ada50359ae4a6

  • memory/1704-0-0x0000000000000000-mapping.dmp