Analysis

  • max time kernel
    129s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 23:58

General

  • Target

    sxw/admin/Editor/include/about.htm

  • Size

    1KB

  • MD5

    1df3741f7e8f2f27cfb86fd10bd48cb7

  • SHA1

    b07c4feb18b0d315a11ac2778e2e6ee7e0829ac2

  • SHA256

    a4350f07dd66503f0e8b8fab36cacf69b42e77cd70ee3c454012bd9c0eedf9dd

  • SHA512

    c94e695b8eee888337106d53d251988ebe536392e06c94c624310d20edd1c642f58d4246f1b2dc2dd9bcdf26d1546bc545883efcb129709befb4d593ef485d53

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sxw\admin\Editor\include\about.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1112 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:952

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Y3JRZ1FQ.txt

    Filesize

    606B

    MD5

    028ad52ca4900b87d55c4cc3b19141bd

    SHA1

    f0a0c3c84a299d54e3a3b2a2ca322f4a4a838a82

    SHA256

    b78c237f2e46723107bc05a81983dbfec0a93264e1ae808e069b53b87940943b

    SHA512

    af05773867f9b0a86f48580b32df83b6bc097589706d608125a45444f2e6ed581ff9ebd79ea5c5dde517abc9018ee7e496b8dfd8533032c23ead94bb5fd2d4cb