Analysis

  • max time kernel
    142s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 19:00

General

  • Target

    主题之家.html

  • Size

    265B

  • MD5

    37ef2c6740fbf2297744f81fab16f81a

  • SHA1

    861e9922f9e308f9648b66c254573afdb798ce37

  • SHA256

    916d15c31c84fdecb989ae5a05fe69dc190b7aff233d73b7cc7e70d5b9f26d7f

  • SHA512

    7cec309861a4048ee799be6b21dddab1384e810227a29fdaf11349ca667b0b4c9667fb419b5b5d31ac562d1f1fa8bf271def513f0c2bee44638e92663502c96a

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\主题之家.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1432

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    9ae4d288bf5b74b3959a4d5be563bd6f

    SHA1

    f7b7003e2dcafe74e0bf12424a08a7662d9db9ce

    SHA256

    89754417aa8a56c3948c831291474a092ad6f9e12516b432a5f03bc79501786f

    SHA512

    1481a70b88b3e212defa892b625bca7eee00690950aecea49cb1581f5b3a3c16e76915023e87ce0361feb6489929b1c0ae2a98c6e76b0d292947c64e53f1ceb7

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

    Filesize

    13KB

    MD5

    540d7f94d66be28a0e9e725d4058254d

    SHA1

    f8b1f6348913b9713b030f045160d5b9ca0155e7

    SHA256

    4021824398579347b59ae81a78d7d0d934ad8b6cc7584cffd72ff313a4b3919d

    SHA512

    c5c09a9dd393fa9aa0e936b10bd54333a12e69da7e89d42c4d66b5c5fa6d68ae2216ce4ddfef81dfa45650421b1fbd15daddd0b1b3c8c58f6423c37d65b99d06

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3D8PV059.txt

    Filesize

    608B

    MD5

    67743fd0d574ff5cc9eb19c4f197ad1e

    SHA1

    17bb12171cb0ea54a127d4035a3bc478bf99856f

    SHA256

    4aec737a09eb24327050c9ecd352aa7e1ebb55f275764f851550f60b2d7bab36

    SHA512

    f266944a5ec1a48d787f5cee741d00acb356b95eb72e348b6f4f794e207122ae0a6a1a5b3fea0188b21e149ebc12fdebd6fb16c4e311328b693a78f7469a8349