Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 17:55

General

  • Target

    http://yaohouo.com

  • Sample

    220520-whmq8sebhp

Score
1/10

Malware Config

Signatures 4

  • Modifies Internet Explorer settings ⋅ 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 6 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes 3

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://yaohouo.com
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4260 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2132
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
    PID:3652

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          fa526918a211e850a6078fb1d00b2045

                          SHA1

                          75bad6b9476e0655e6a2947a682e81df689682f3

                          SHA256

                          396b94c667643afa59d155ef4d812da6f4d67dd50cec97194e1ca3a1b3ece3fe

                          SHA512

                          27a3e00ba0e478d8a79cbbd134ef7beaff7fde2fc57aecfaf022806af41c2a85183fda3e1abc2dec38d27a7f22960db3549721b8d821ea659a5592b430de1ed6

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          20f64d09077861f219bf9f0e34f97b2c

                          SHA1

                          18230bb8552fdfe8eeb40316800c0ac6d83587d7

                          SHA256

                          1e004b0ff5b4774e9c4df99ba830863f5d51ffe9a650ccba8271436b196511f6

                          SHA512

                          d41efebf85bd63b0f8793992064a1bae678901bb2be99ae2f0fc0aa7718dac83a8ba8427150a3757c4f988a4a2a3c010fc99e53007a92d4701774567b7599750

                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2klo80q\imagestore.dat
                          MD5

                          85b59ade7b57b21affd9d3ab8727504b

                          SHA1

                          4dfaebb16d21c40adff9d55fee692480c4dd89f0

                          SHA256

                          8f9be0cfff86af494c2e074a9746eadb97516e012dd3a0b2155450b4ef7d0cff

                          SHA512

                          c3a0c392e9fefdcee9726a213b206423b6a5094d24637734308b4e375cd51f73f3d3baa9d744a7969969c606e251f988e38bf0800b27af6de8820144f441bc6f

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AWDQ28Q6\favicon[1].ico
                          MD5

                          178819cc32a7774822e3550c57cd20aa

                          SHA1

                          c8050ec440e8cc1367a6115934edc0bf94a0d343

                          SHA256

                          8565aaa87282f585b8a021ee0e693f662eb179df62890d01e086cc9f23dec1d2

                          SHA512

                          794c0578a7521c093c27a5592ab6f4874742f6db4c53e9b0b07acfecabf8575117ff1808ff0f0426594f4981f5933c756647b146b7ac815decaa9c5fcec246fa