Analysis

  • max time kernel
    78s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2022 17:41

General

  • Target

    https://canopywell.wordpress.com/

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://canopywell.wordpress.com/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4796 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    ec21d7b0db946b7ecab4c4ead789e338

    SHA1

    b708c1a90566be72204ed5340bd05d7224e51403

    SHA256

    e15133cd7594e706cf5141df1a4780c26e101c85c68262346f91b38d546cd47e

    SHA512

    d34772501233d31566db776e19b58a4d5b0ee4a76613ac0e9960edaf42bcda35af3d83592f71cb53a1ef9f428ea6e67e0624bd1c84d29f04c7a360ffbc03d1fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    ad5a5a6c87d5f2d1e06d8ee8ed092c6d

    SHA1

    655ba36054f79913ad9ae4641c6ec2baa9fc1c0b

    SHA256

    b248cd4559a2a705294ce11f4e2fa18289ddf09b2d3246d56308a1ca1c790425

    SHA512

    f1a8995f44735da7d0f45b02d14591ab0604a014993dd5c426eb904458abafbe4f526ef2708b46098b9243cf85fac9707628984cd249c62b2c430b552c9c1b93

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

    Filesize

    5KB

    MD5

    03ecde50ed3a40965f0d063a5517b7fe

    SHA1

    91c8a30d6aea07585453397fb4be35531158311b

    SHA256

    d49f99f6616ddf2111c6462221c0ef6fcc946eeec0e9d03459c45866f5c1fcf9

    SHA512

    9cae5bbf50595ebcf6af990e109ba0fc283df6becc45008e3247d7570c713c9991ec16e54a0e9f7c1c377cb695bbc7364a6acc6dcc118898807f3bede207eafc