Resubmissions

08-09-2022 17:44

220908-wblklafbe7 3

07-09-2022 00:27

220907-arqnlaafh7 1

05-09-2022 16:52

220905-vdthjsehd3 3

05-09-2022 16:42

220905-t7p7jsegc2 7

05-09-2022 16:37

220905-t49f1sefh3 3

31-08-2022 06:37

220831-hdwlpabhc7 1

31-08-2022 06:32

220831-haw32sabhk 10

31-08-2022 05:40

220831-gcy5rahffl 10

Analysis

  • max time kernel
    142s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2022 00:27

General

  • Target

    http://20.7.14.99/server/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 48 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://20.7.14.99/server/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4664
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4664 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:928

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat
    Filesize

    30KB

    MD5

    592e4223fedff3e77cd4e92b89090018

    SHA1

    16de53e4312ff9218f0d680170659ea3147dd275

    SHA256

    afe53585a05890fd509518ea942a7b2efd5d79645df8df5eb5a298c5d84f20d0

    SHA512

    9fb2e01c7ba1b89cbf7d1b7ad149e6ed1600e025d3d05aa05a4e09d111459309617163db0f525aa8feffca0d791d5d25942a3dfc8f5ff1aa50501878b32e6b90

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\26HZJLHZ\favicon[2].ico
    Filesize

    30KB

    MD5

    6eb4a43cb64c97f76562af703893c8fd

    SHA1

    c50c4273b9d2433c6069454f971ed6653e07c126

    SHA256

    1d7c95c5eea00a8083a95810f902682f9e26e7fbb7876b022a403642d776d0c9

    SHA512

    3bae9380d8f0d45617ecf9d0d43818b7f8f83b61ecbd5e6dbd189c19d5853f92aa47965ad257cf712e49c03652f129dca47e8a8dbd86d62e614acc99ea931181