Analysis

  • max time kernel
    213s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    27-05-2022 19:42

General

  • Target

    http://rebrand.ly/0ljhgr6

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess ⋅ 2 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 54 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 6 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://rebrand.ly/0ljhgr6
    Suspicious use of NtCreateProcessExOtherParentProcess
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4828 CREDAT:17410 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4716
  • C:\Windows\SysWOW64\werfault.exe
    werfault.exe /h /shared Global\d98925a17463438f8f6b145650b0da57 /t 5112 /p 4716
    PID:2092

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          37b13d6bec0f9d6ad3f77acc6e890814

                          SHA1

                          10154a64ec63c85f1412787b3e4a60fbbd0a599b

                          SHA256

                          6f11a9154d2bb4945e5b3c92ad4a573917b51734c08fc38c2d77ab9323b1a2cd

                          SHA512

                          148d102e23d1d9df9446ab1777cdabd4f0d5e1b89953ff75884446e13f16b851fe8fa6c23ecac742c7864efcead2398f356fe02a150f5f5e208ba32c72cdef21

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                          MD5

                          b3311b0f15f4d8e1f92f11b31cf5de77

                          SHA1

                          88299574d981f33453599e54e32fd159b0bfa5f1

                          SHA256

                          1de074a9ff2f4ec3572096bf3a80eaa51dfab0357cb88f8c3ad278f3d87007e0

                          SHA512

                          6c507595fb1cfcbfc3ecb20d6f6fc57289ddcb2c50efac49627a5495fd24ef549e99ba1e1c2ed539f5943eec73d8bfe1da940ae3976ffcf3f8ca700656fa16d9

                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1dmutkj\imagestore.dat
                          MD5

                          f8efef3c2e344069c9edb089ed63aad1

                          SHA1

                          9c5ece6b3947505ed1a0d97443c2016736a39f22

                          SHA256

                          bee9844cb1f4b5ef18a35c5951535d7eed9ea3f1de0162b1d9fe9018091736ef

                          SHA512

                          c586b549f19a86ee3bea6eab3a7b0fe1d73fb6c201b7e0d6b7772c32ade78cdd80249437eaba86d2dd82ed52363fb659a4fc263d4dc0bf887fcf0dccd240d1d4

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZY4V0BL6\favicon[1].ico
                          MD5

                          79986902129349e2e4be24ec29797b58

                          SHA1

                          185e9e3737e9e786d222241acdb9bf924ec42c7c

                          SHA256

                          5ae4ab61528007a712ebfe7d7a9a237cc8beae0a339a953a79ee43c5b69cc8fc

                          SHA512

                          452e3cdbed2ce9ddfc1041ad7f793b2160b204b0cc06b2aec2c3f730e3dc5eba910ea3eb07903e25510aac35ea54a2fc2e43cd8e19b21681d61fb009ade55805