Analysis

  • max time kernel
    88s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 17:22

General

  • Target

    http://bit.ly/listRatVip

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand google.
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://bit.ly/listRatVip
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4288 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat
    Filesize

    5KB

    MD5

    754c6e0b1c2ef77d758ff5b071e41db3

    SHA1

    c65e40075027c3a42c391da484cd9a86351b5e2c

    SHA256

    76162599d9ce467b630f72bafb21263c367095b51af7ca60724e561f717e65f8

    SHA512

    f2f2776b673c9d88045054551e03a0c43a4e554160d5065eb1f144e1566ee6f17a9b98b7b43f8898338bdd5c38f1b56ae6ef45277062abb8aa349f052f44a966