Analysis

  • max time kernel
    182s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 16:54

General

  • Target

    temp/ppt/slideLayouts/_rels/slideLayout2.xml

  • Size

    311B

  • MD5

    3403b99991b21ed32f5d796eae81897b

  • SHA1

    0e95a84096cd52097d3d2cdefa3f259e598be0b1

  • SHA256

    8246d333bf3764cd35563e3df1828c26bbc28890815a2987caf3e592791ba60d

  • SHA512

    29836bb54ac0f53bc11e5df71e76ab6a0eb0c005aba71a83685c0f1bdba8406662fbd51e79eec215f79cbafa4b2a88b1ddc087a0d6f0fdf1a6d666f068553495

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\temp\ppt\slideLayouts\_rels\slideLayout2.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\temp\ppt\slideLayouts\_rels\slideLayout2.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    33b7e09d1c6e875887fd38ae0a7ee659

    SHA1

    192864bc83504fafbd87af8c3834b835076c414a

    SHA256

    f200eaab5663e542461bbae7aac0473f6455eec451011f016c84920520b19dfb

    SHA512

    b1d6872519f5956bb511b4eca8e1b79123482e9aacb1cef704c1d3ef7f9daade10573dd206df4c62c623bbfb10f757f01c914bfc2b0e9ab567981ea08b404799

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    434B

    MD5

    ab890035d36c5860d5c82dd57386ced1

    SHA1

    e9cc961e0856de824ecbec4db709f77555ba99b3

    SHA256

    9f6a20687655f98adc1b8374862a0aabb1565434a7d080b40d3ec34e6e7a0f63

    SHA512

    e070280f30822081287068da2191c5173f6fa9a2a247288e4aa4ff5e75394618776680af26ff09e0f01ee8e1ce4a48cb31d1102767d3b61d1d2fa3962824249f

  • memory/4648-132-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-133-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-134-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-135-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-136-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-137-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-138-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-139-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB

  • memory/4648-140-0x00007FFF5A410000-0x00007FFF5A420000-memory.dmp
    Filesize

    64KB