Analysis

  • max time kernel
    128s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2022, 13:42

General

  • Target

    wp-asset-clean-up-pro/assets/icons/loader-horizontal.xml

  • Size

    1KB

  • MD5

    4736ab1e105207ce7d8a62d29bce9b13

  • SHA1

    6521eceda5160b4924c6e006d2dd2985abd1e1a0

  • SHA256

    55509258846ba5d7f4eb075fd4f8fa4c2c951b6fc6d9dc8da49728b0b38a3fbd

  • SHA512

    9a479c7b9d2b0b7d3b46711b51af7731a1770ce0ba06c4ce8ac6ee876b231be79eb29695f9aea5e5cdba3a95b57c4e985251b1139185584cf1bda0475f53a04c

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\wp-asset-clean-up-pro\assets\icons\loader-horizontal.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1512

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3JH55RLG.txt

    Filesize

    535B

    MD5

    3ff9ca3fb553417ce18fb340285faca3

    SHA1

    02412396423c2bf8b43e3733408b42fb0f00e8a8

    SHA256

    39ce6e8d8149a68358465125699edb84b605604cd239f9d2d537d90d57bb7544

    SHA512

    5593b4620d287347324133cd0c8497ffe9622861866a095c127848a90a691f96f77101e63a40340c42edfe7285d080749832262533001961d4d2ba085bc79215

  • memory/1160-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

    Filesize

    8KB