Analysis

  • max time kernel
    97s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 19:00

General

  • Target

    桌面美化软件.html

  • Size

    269B

  • MD5

    80fcfacdca2dd7d7bdb67850d4f1e06f

  • SHA1

    3e499f4d57ad2e92e4db323d23cba035399dec1d

  • SHA256

    cc4282aa26ffb2812f841f593dca8fc41cd395b56773785dad5a934495f7a849

  • SHA512

    f4f4c444d023a1b70659eb8b56eff963f08a16437da676c332b915b893c2ca51e554d2679accdeb27b645b2d941a4978e8a546341945ea897c7b363a436ba167

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\桌面美化软件.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1052

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\14QQ058P.txt

    Filesize

    608B

    MD5

    2a7093cfd85850fbb92451fba66a509f

    SHA1

    e02e27800f373c637bac18ba76e81c9872c7eaf1

    SHA256

    683b7d266771cac3f7dfc6c49148d53633ce94ccb9e95996bc8da844103a46e1

    SHA512

    f38f0f12885da638034f6fa5569f8e0a06dbf679388e8a7b5f78486771868000af70aeb9df737114dfac2d9758aad9856655df70499d5bda5be392beb58f27aa