Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 19:00

General

  • Target

    懒人上网请点这里.html

  • Size

    262B

  • MD5

    a323a799dca17510b9ad75dc00870997

  • SHA1

    f3c5d36c30a1e3d116bdbf50181446fd46b8ed48

  • SHA256

    215de640fa7a1c60e845ddca298fe2367481a56e329f89a51e7a9f5b243260b6

  • SHA512

    c27a2a8aa84a2f826e4afb984157f3a869dc635b67d24fbd613d004dde05f123d546aeaf940944800d93338df4b9c3fadf06e775f72d384c1ce0e0b69618e7b9

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\懒人上网请点这里.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4408

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    e32d02ce684c01ef3af05fae9066160e

    SHA1

    29c7a6e8ed553ac2765634265d1db041d6d422ec

    SHA256

    b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

    SHA512

    e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    bb391a9e6a89d64fe0e118f9d73578c8

    SHA1

    e1cff3d241ecd3152b757b2d7b1518dba3d96f6f

    SHA256

    b04638b67b737c12236cb10a294f1033f81307c7fec7bb7b5aff6b7862dff778

    SHA512

    20c86afa951f5e35ade367e1c029756547b6ae7f040eee058b42a6c3c890ed67b21a7f37f88c697024a197a706b08bdfb4a3b0e904ff10d84f9382e8870f90c6