Analysis

  • max time kernel
    125s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 22:04

General

  • Target

    base/FCUI.exe.xml

  • Size

    270B

  • MD5

    455e49ce62c15e710109e27d796bc07b

  • SHA1

    c5fb946c32bbf485298ccce382dd7ef360e2b80f

  • SHA256

    6353cd37e2d0debdcec72ecad91e6022dc14b355462a1cc0350993f8a268017e

  • SHA512

    09e45a644654e477116ca6d8fe96f2cdb3b1fb5269c4a694cb7e8e3e387ce440e250bea4f9b792d4ffb56a057379447e1d7ce49aa3416fe0181ef0f5b53f532e

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\base\FCUI.exe.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:584

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C0ITJ66O.txt

    Filesize

    608B

    MD5

    1d9eb6d1a92ea9ff79194ef1f88f2244

    SHA1

    fbc853377952aa041de8865df8dd0eeb30e1bdbc

    SHA256

    38a85926dba9c4f5fe41d2793a7a8d3c66c8c2573fb38c366466f7edcc9505af

    SHA512

    838724ec43f0283ad89357ddfc4e32ab9a3ff72cde7c4d26191cc0e0ea8c71867c8d8979d3892a254097032b09f49ce4e3fb54c174dbe90c3b0ed31f48dfa7ce

  • memory/1256-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

    Filesize

    8KB