Analysis

  • max time kernel
    73s
  • max time network
    252s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    23-05-2022 08:53

General

  • Target

    https://go.pardot.com/e/984471/ail-paths-one-link-Fax-Outlook/8brb2/106448077/tasos%40betologic.com?h=s6hISiaojIn1KXS7BpTrWr1XN6w7ZwPflWLoQ-M6x3I

  • Sample

    220523-ktl4asceh6

Score
1/10

Malware Config

Signatures 5

  • Modifies Internet Explorer settings ⋅ 1 TTPs 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 6 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes 2

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://go.pardot.com/e/984471/ail-paths-one-link-Fax-Outlook/8brb2/106448077/tasos%40betologic.com?h=s6hISiaojIn1KXS7BpTrWr1XN6w7ZwPflWLoQ-M6x3I
    Modifies Internet Explorer settings
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4772 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4784

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          6feb4750c81f3cccd89d617256efff07

                          SHA1

                          65aa1afa690bb208466f5326b3f39be900ca3751

                          SHA256

                          d7d6f9f42427e271f85faeac6705b729d6d30bf406de86ef908327703fb71a09

                          SHA512

                          f8b0b74732e601a3a670366c91c688ebe92e30af219f375a10cdf0dbf7344ccf5c489453129d4b15321d2017a651ef34ce026145692a54c239b418252fd23212

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          6f970e2f759b90fcd8a0a5e57b152790

                          SHA1

                          b1004ca1a397ad9fbf2eabefcb3a81fe27210d36

                          SHA256

                          a9eec986fa21c78f173fd5c2f5aa2621851c35d560537731bbea9ef452cb932b

                          SHA512

                          cb7bb05ba7568d5f535469bb0cee71ce1e9f74c3d8259af706f14692bdd8db86511cd43c1ae2e93914e8669ad2e24576577746c4d25f8655911a88f7adf8a849