Analysis

  • max time kernel
    73s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    25-03-2021 12:08

General

  • Target

    inj/com.moneybookers.skrillpayments.neteller/index.html

  • Size

    36KB

  • MD5

    0a6041b0c59dd8cc3ca210b5368235ca

  • SHA1

    e4eaccfc4867d8b4863264a93c4406b4d179e3e8

  • SHA256

    1bba830d7adb141f5c8a188db35e46cd1c7e380aff16a7e668e8725ab6cc7afe

  • SHA512

    3d152a306f721e9e7923bc2dfb6be895a3072af87c4f3437443ff46f0d5c1549abf94120d20c1056549c4f0e061a57cedb61209f474fdfa0c6db43cfb1929760

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\inj\com.moneybookers.skrillpayments.neteller\index.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1808

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2032-2-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

    Filesize

    2.5MB