Analysis

  • max time kernel
    74s
  • max time network
    223s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/09/2022, 22:17

General

  • Target

    929635aa1d7399793a94c86598581addee1936a62447ec6f60eb23a254f83f67.html

  • Size

    6KB

  • MD5

    5050d6ee596024d6278bb5d9a9160701

  • SHA1

    27f0f35b39e40ad2786556a25189f5ebebc7b789

  • SHA256

    929635aa1d7399793a94c86598581addee1936a62447ec6f60eb23a254f83f67

  • SHA512

    9df19ed4b2ccb84dd96bcb1cc9dec0b23a35dbbb988ea270e9e3f230f2c70c40954e1e073744d614f98fda4d43dc34e4d1817f7752de865fe55fa3c4e76efafe

  • SSDEEP

    192:kCgUXmXbXqW0N0v0CaBz0wY8yr/kf2jRnQ5/e:kIIr/kG

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\929635aa1d7399793a94c86598581addee1936a62447ec6f60eb23a254f83f67.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JRK17AQI.cookie

    Filesize

    605B

    MD5

    8bfcd727f42e8a97c9d0a6ae88bafc2b

    SHA1

    c4aa32a91bad1e57e04e782ceed42d77d3e178e0

    SHA256

    f8cc82200a4d168ec3eb9eda4528418076ba52d72d0399fe8824b15c4c6a1e3c

    SHA512

    097a505449d714a2a64a710d7de25b4a18b35b49ef8c9d3b501586c901799fba3b0bc2ceab1a7e333a5dad9ded8c4559cdc9ba90b60d67aa01d0ff0d8e10f10d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\R5A6JQIG.cookie

    Filesize

    605B

    MD5

    f4dc991900a001ed2fcdd886ec094c82

    SHA1

    119ee3520753a38e572b5737edafc44ce965718d

    SHA256

    558b51fcc26300bf5a8e130ff59f5644a4983ec8eaba900ebe6bcce49dc9044c

    SHA512

    53496c4914d22419450615a71598392596e6d453c10e1f4b21b6706ec744ae72d2e3119cdd716b8251e4d4e1e2832abac82eb2250c62c875b25878d1253868c4