Analysis

  • max time kernel
    310s
  • max time network
    324s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-11-2020 06:28

Errors

Reason
Machine shutdown

General

  • Target

    chrome-assests/ie10-viewport-bug-workaround.html

  • Size

    377B

  • MD5

    f1eb316adbfa88081b8f3b840c852ace

  • SHA1

    459bd301af4d287e87985dea4870115fafa07d9c

  • SHA256

    a48aca6a9cd0818f3c3705fb1669f476e3641d32d2f526f6b7ced6af4c37d1b2

  • SHA512

    b4a48cef527e182b18de977af2a617dbebc8333f7ea39c7f0066e6bad31ea8f380a54f5f7b61e42aae0e40f432f8040673179e5a566f474da39179a0e083c847

Score
8/10

Malware Config

Signatures

  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\chrome-assests\ie10-viewport-bug-workaround.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3772 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2340
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0 /state0:0xa3ad3055 /state1:0x41c64e6d
    1⤵
    • Modifies WinLogon to allow AutoLogon
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:3960

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

2
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    MD5

    ffc04cd305e33221116feebf2eaa50b0

    SHA1

    6aeecd1a32ce6655a43e6b35cb2d0cb45876c9d4

    SHA256

    e0215011ac1136f278389a2a9b9572d9cdbb704f4a2a6d4b9cb8e99eba316de4

    SHA512

    ecd09a4db7f337f7b4b767edca0615262af8785c3dd85e6369037c04eda0865c59949a406e6e016ba8e893e7f740881be22909aa472ea6fd1c38aa3902979a01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
    MD5

    e98da34780455046d7b7f5d00e5fdb0e

    SHA1

    f65f77614f6ce68278b70a26530fb2843cc17548

    SHA256

    88da0dda086b06e49463277bb3036313b9fcb506814825ee5c01f973b1175bd1

    SHA512

    da4a60f62f29878a0addc6f673885a8e9f6e38722034a426d415aeaab6217a472388ab0629c5350bdd2c2b445af0b1981527a0f298bec2629f6a1e40cd151c59

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7N8FJ4S4.cookie
    MD5

    4b4f30a1df5249240943b7d7fccea9ff

    SHA1

    fb3443fa6cc1830292caa523a61087a19b90b60a

    SHA256

    d66e92fbaeeae29a1a11120744713b8e3849d51093a36926cec62fdeff6033bb

    SHA512

    973b4e502fcb51a8aa830578ed3eec9a454f2594f2b20ec442f6b8eafb3aee338fd435736ffc02dc868aa9e2bd0e45fe302642ff6a9b3994ddb6759085efdfae

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\IKZLW7L2.cookie
    MD5

    69539487becb14d0596923310f28ab0a

    SHA1

    8d0ca184c6c5e707a44392395916084417b8ad93

    SHA256

    0f23e183d0c0b80dfa8639e48d54d022954935e33ad2668371ee86f4a71e13fc

    SHA512

    dbc892280713a102636d8a17e6aa2b55d5f7cb18487e2c306a9e5d332926055bcaabaedad96c8abd5c01c214a8d018b06e4d9d5970a7a0bab99bbaa9310ce5ef

  • memory/2340-0-0x0000000000000000-mapping.dmp