Analysis

  • max time kernel
    74s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22-09-2022 13:38

General

  • Target

    WhatsApp/About/AppXRuntime.xml

  • Size

    3KB

  • MD5

    88d794ea092ef395433cfa321d06e5e4

  • SHA1

    f1f7c7dfbd04ac5a92cbde88bd4f087781d63c40

  • SHA256

    5afc969e4212a6511f307385c99b8868e8c873183dc271bbb95ba571b24eb53e

  • SHA512

    ebb770102b8202de4bb7319cbc2cda860e4de5d1e95f0fbef4d4890aa2b22cd48cf73909d028a37b507926b4fad573716fba16e50b8f9eca8d5feab00ac17cca

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\WhatsApp\About\AppXRuntime.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:316
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1936
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:648

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9MRI0SKV.txt

    Filesize

    597B

    MD5

    b31d3c2f3facfde0f4e04b1d5279eebb

    SHA1

    4653e42f026dda4d4cc1a0ae5036afdeadd8d764

    SHA256

    1a51791253e9fcb0f4f225ca9a225beca175c01ccef636af691848f939f0c84d

    SHA512

    74c037448b0810ab1a79a580cfb2e9f63e9b7f87c9d47aae6d36934a15d8fa97a07dd50b6fb41ff0e34444cae80ab3932a32329abe7ac2d82222b0a7ee0c13cc

  • memory/316-54-0x0000000076121000-0x0000000076123000-memory.dmp

    Filesize

    8KB