Overview

overview

5

Static

static

Document#8...).html

windows10-1703-x64

5

Resubmissions

16-09-2022 19:13

220916-xw7t1agdg8 10

16-09-2022 19:09

220916-xt8zaagdf7 5

16-09-2022 19:07

220916-xsnxqacbgk 3

Analysis

  • max time kernel
    161s
  • max time network
    161s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16-09-2022 19:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Document#851980(Sep15).html

  • Size

    711KB

  • MD5

    b5f297c838ea8e0311f0ffd7ae2de97d

  • SHA1

    268d48fb52b4e58077c93dd44a4579b80bd76b03

  • SHA256

    0384750607deffb5a41a559dc3213c6fe63142c06f494987ed2183fa8045c0db

  • SHA512

    d6ce008bae11121cc439fa832096fbe41f48ebe3f316ec12c75874104400f9352fde478ff836779c005fed9550fea425cf6988f9d6176a51c94505f07b954a2e

  • SSDEEP

    12288:zYcg+MduTLzsQ1ICbDvUGchAGl0gdgKxv:0n+MdyHDICMhlPq0v

Score
5/10
microsoftphishing

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
    phishingmicrosoft
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 53 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Document#851980(Sep15).html
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3292
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3896
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:5052
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4580
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3740
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4772
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x348
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1556
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:5104
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:1316
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
      PID:5196
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:5364
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:5500

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      0708e559410e8dc68f3dd1a7622ccf08

      SHA1

      ab4cfa91b39bd11461edbf133d889f04789afa1e

      SHA256

      ab31d03e4e5401bd3df1c339982d79631980777a9d7d4d49c694ee6385a5b30c

      SHA512

      76f45998ef092b990edca0b010c37f213571eeed419393055bb8fbbfe11818b45b2de1719436a6236e0b8a2bcec1bcb8b1cfa621b74e7e6088db2219afa66b78

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      404B

      MD5

      03c485b000ff85eee0d98ac1a164f104

      SHA1

      0fd733d6025657db643a53410575d2e36a124735

      SHA256

      3425c13f8071db8a6e14d99cf473d23644cb19f848c82b43306eed2e9992edd7

      SHA512

      16b85179953b05573c254dc922ff32f392e47558871e0cde3a2b079cb98c42fa63ffc91fd267cff3f99ba87e43162a1a6a29c981252d4501255634e29a3accf8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AHIW4P9K.cookie
      Filesize

      609B

      MD5

      b9c8682963d6c395095d8695a58c679c

      SHA1

      c09cd36702c47a2007743172357a18d365abcb7f

      SHA256

      435bc1ab89ac0378bbe3e479dc7926e6c84e46ce8b83e44eca9aea4023a8aa57

      SHA512

      4ff5ec17f6bc2c22164cedff56515923ea4cf484348c092ff37a118b9e8ee9c313f7b8ad430ab419f7771fb88854d175469c3c66f7b8128cb5df0f8bba665484

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\GR7OH3UA.cookie
      Filesize

      610B

      MD5

      f6437d50ca9e3f74802512bdc96435fd

      SHA1

      1cd9841da6538f8a095b2349aecc243130717880

      SHA256

      9be0f28fcb2cfef0b035baba604314e75626528c71ad0c20595690e79a483990

      SHA512

      bb07b913b4e7599025f71aba9abd3ecfbb3f834eefca0c07ce5035799866234e577bdb13d6ed3b476d722d3baf2cb1a07ec564405986cc65ecff70d9b1eb7241

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
      Filesize

      1KB

      MD5

      8e8df612036e5bfbac1933ba916721b3

      SHA1

      c017ae04863e469cf3b0b116fe428d0b3132e7db

      SHA256

      a02421a96825229991036af9d785f20991bab49e8f40c463a74fa0fe79f10cc7

      SHA512

      70b00eae51dd1b49bfac3953a1b191a8eb1c4914ad64f823db2620c8029ac02c4f6d631b13a807f97f5bed1554773d216ddd6ec57cfa4dff79694a3ee8fb5313

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
      Filesize

      416B

      MD5

      36e4e0934c79e99d7c510d502bbb41da

      SHA1

      5294e5f5e71d3fa4ced92fc496872926998f4de8

      SHA256

      876c5a30be1786573880930085d24446975b8e13c161bf6dd21c772612546baa

      SHA512

      d538c428406620239a0cd9e173b79d29c71de540aadaefd848cb428690636e2fa774f7d887fa6b51df5543e0147573a05fcfbb1866b327983db96562e2689126

      Download Submit

    • memory/3896-121-0x0000013758F20000-0x0000013758F30000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3896-120-0x0000013758E20000-0x0000013758E30000-memory.dmp

      Filesize

      64KB

      Download