Analysis

  • max time kernel
    104s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2022, 12:00

General

  • Target

    http://rndtech.co.uk

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://rndtech.co.uk
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4332
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:17414 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2428

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

          Filesize

          717B

          MD5

          ec8ff3b1ded0246437b1472c69dd1811

          SHA1

          d813e874c2524e3a7da6c466c67854ad16800326

          SHA256

          e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

          SHA512

          e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          0a8ccb22b686f8477bd7c0815474980f

          SHA1

          4a8127d2f3e3840737696dbbbae0bdaea33da790

          SHA256

          1792128e4ffcb7422d38888abd7879f2958acaebddd325a27a2144bea963e825

          SHA512

          53cb292ad44cb41d9f1e68d4b532a0fb6396b74a86edb2c95033d27620f60b58b6c45ba97291f8397a07a6556952f611901b88bd1983027197555983093738f9

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

          Filesize

          192B

          MD5

          68fdafa8e725657ec341f58c59f0e873

          SHA1

          a2852c2cb47a7cbc94c0bc53c24719d538e0e695

          SHA256

          64e303c407ac003754e394efd0c4b0cbfcfa0eab08f022dd430c070df6c682ab

          SHA512

          a12c2d478eee766f107af08a1b54a4878f6f7ad3f72ccc4a5d912e7f10d2d5768bef3ef1e2899d77734d760346e361c2e13f9b387b1ad6b0fa15e9db6463d28b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          ffcc55e6a00ddc593ecb8bd8acb86a3c

          SHA1

          ca2fbfe78c40f6a3c88972cdcaebcc724604c05e

          SHA256

          027669cbcc296e4ef1296bc282f07e8581af40b75c0e4110c54ac36ddbb85135

          SHA512

          d0eeb358db48c86bec6debe03e432c29ffcf7e97f99747845b1244cc3e3333255ae0b1fb52a04174fe87eb34184b3a1e9269a3526939c377340eac3d325e40fb

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4IGDP7OE\rndtech.co[1].xml

          Filesize

          13B

          MD5

          c1ddea3ef6bbef3e7060a1a9ad89e4c5

          SHA1

          35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

          SHA256

          b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

          SHA512

          6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4IGDP7OE\rndtech.co[1].xml

          Filesize

          13B

          MD5

          c1ddea3ef6bbef3e7060a1a9ad89e4c5

          SHA1

          35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

          SHA256

          b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

          SHA512

          6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

          Filesize

          97KB

          MD5

          5c2df7ff88c76b0821c9595baa051ed4

          SHA1

          554fc575331b8d2944161135b29a358e7d84fba1

          SHA256

          c2ba69ed317c878ce28fd741479b0ba32b10569b197d00aa03a27805a7d7d1a5

          SHA512

          d270f16310274bb3f619f788d489250f60f5210b50e39a0a1d550144bd08f5a89742f22a2308b0df778cf42d4497c1f2a70e6812e30f77b2b02e1b927dde4549

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\web.assets_frontend.0[1].css

          Filesize

          239KB

          MD5

          754160d30f3b3f19c579268053ec83ed

          SHA1

          e07a12a409df659fa0f1ce7752ea22aa24c1c435

          SHA256

          962b06249515348bc836ac7d5ded4981df229b23ee62eaf13ba234a065efb8f7

          SHA512

          172fdc8180c383a1c28e018a9184a4659ef1bce1686fa9a49d6edf5f6e770b0dab72fc39e3c3a5040fcbf53404e2972074f13eb193c186027b6c885679f94ddd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\web.assets_frontend[1].js

          Filesize

          72KB

          MD5

          a2f26b9b6626b95ac43c8b42459bfbf8

          SHA1

          e4dbeabe2b5ae0ff3bb310e4f2bd067e5c2e8319

          SHA256

          0ee5cc4ddb165027cafc1d2aafa0b57d7670437b53ef5d41cd599ff792e8c7f3

          SHA512

          8a6386576cf1990980f1746d0725e96f11c5fe1ab42417ba53b676b93a34a0febde803f02325bda7ebce8fd18f6fa27990fa7d67762ec994200bde61d94443ea

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\logo[1].png

          Filesize

          2KB

          MD5

          af0e30e95e95a16e4e7191bd0f3f6512

          SHA1

          3d456de56d836300b7d93a599f681cbd70fb514d

          SHA256

          1928f02bffc464fe66e4de6d111b78bc788da8e374e6531023cec8aa92bcec24

          SHA512

          22c28fff6aa28c3c77b08bfca89880df55e999a01892668900d7b5b465ff2bdf1604488fa3055b85f0aea1d981d3e8d77ee443f87c10e2d4263fa095119de8e7

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\web.assets_common[1].js

          Filesize

          1.0MB

          MD5

          d139c1c35633cbcfb78858a1df2c6af1

          SHA1

          51a56ee19a48c00a764d408f421023588744d126

          SHA256

          a184eaf64580a2f73078246afdc79970d8a6b42b3816c3b47785da3e30ab9289

          SHA512

          8f2f9ba418ff2ef67d5563214acd25ab62fb88da69380d7033986c90ed90f7b386f0c795f10a4d687716ad44c5b23121ff17ac9804c4b0272b207ed94a2a1b95

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\favicon[1].jpg

          Filesize

          97KB

          MD5

          eb629cc28b65bb3ca520ac7b1014d755

          SHA1

          4de83fa46d3622e620fce94b37395bf7fb69c5ae

          SHA256

          95af02edc6f600dcdaab515166395c9be4cc3d05a15a2a56190187c7ad82d13c

          SHA512

          57d19853b00058353ed9fe0e782ec63e7c2f1f861dbe66a2be990fe9c488907df6ea0377602979656d6fb236976b67f820ff5a860c3c596b864b61ce615c5743

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\fontawesome-webfont[1].eot

          Filesize

          161KB

          MD5

          674f50d287a8c48dc19ba404d20fe713

          SHA1

          d980c2ce873dc43af460d4d572d441304499f400

          SHA256

          7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979

          SHA512

          c160d3d77e67eff986043461693b2a831e1175f579490d7f0b411005ea81bd4f5850ff534f6721b727c002973f3f9027ea960fac4317d37db1d4cb53ec9d343a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\web.assets_common.0[1].css

          Filesize

          112KB

          MD5

          16ccefc9998dd6c9a430d4a3b7ca6515

          SHA1

          c3116c0ee2d4721287c3e269f92e6a7d10d47da6

          SHA256

          d06a4d1709fb7abb3b8c1d5065d38e1399728b770a6610a378e1996b08c9cbb2

          SHA512

          f3e908cae4349900d52ed0600bfedb86e3c7fd6414cabc2ccb7250e52d20c510d756efaa3b70ce161e895ff3a1310fff3349826a81459732231df7bdb12e8429

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\web.assets_frontend.1[1].css

          Filesize

          14KB

          MD5

          64d2bc31bd1c9fd02de8bf4475f06a16

          SHA1

          20762147556a63ce7d8b0d2f582c0f6c6ab9edd3

          SHA256

          2c534bde951fa41d804f46552f571cc7556fcb7c2a5a0da6591469af71ee6e94

          SHA512

          86eaee692a3652e3c3717b628f1aadc2225ab0e4198a327caf134a438b7dd0df6022ac505aae70e17ada438d56b945a24a30345874d61bbcc9317a6a4197d847