Analysis

  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-10-2022 09:29

General

  • Target

    2.8.7.4(2k-XP)/ln.html

  • Size

    253KB

  • MD5

    6359288b93552e628ef8d7a948096d74

  • SHA1

    6dc99c96736dd47e686b0ee2be519316a71cd4f8

  • SHA256

    ce69dff10c80d130a002c6f1c1fcd4b1138e96167ce093f0af694311b4ea221d

  • SHA512

    3073cddd6ace77c4f3b713e8e762913694cda8cb53971b4877b9a159444b373cf0568ae5cab9f2ffaee6beaea8c4268e136164e4f7246cca51c8359d71ce9707

  • SSDEEP

    6144:ZX7Sh0dsr3ZpNSL8vhbcg7kdlQ3bF63/gXQoA6ErMGbjvnd7gMBWlBG26ja:ZLirppNSovlWFoA6ErMGbjvnd7gMklBx

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2.8.7.4(2k-XP)\ln.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:364 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2276

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    fceed7a5f76725fb398c6a91ff552899

    SHA1

    237aec000ae7c7c35a639664b1ad6c0d842a0749

    SHA256

    2888c66a6908f10474313b2fef31aeeff40cffe1bcbd19b84b29334ff6a71383

    SHA512

    adfba4e72523d38395c13122d6498d9b48d93b2967858f0208549e3830c9b47ee3e98249b98fe585aeeeffe491a6985a98c80a3be581abccf4239bad4d1cdef3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    149c3170edf4e4af8630761f3cdc56b8

    SHA1

    d724d4b16c6d4860292ec5c6f102e4c4f10498ae

    SHA256

    59102b46057ababf4f563d11b8fb31c630d2231a5fe3899ba264fe61006adea5

    SHA512

    1483156842c686f503756145eb094057480974ff18eab0325bd1dd8c17e80b810901294bf55db9ff3f2b58ae4d7cc068e71ab014f06ac19faff059020b8c4bc2