Analysis

  • max time kernel
    67s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 13:49

General

  • Target

    email-html-1.html

  • Size

    806B

  • MD5

    48218676a64a025a810976561915edb3

  • SHA1

    08ae63a9b48ee7df19572247fd5e5729bfb622af

  • SHA256

    49df2e11a91ae6ab81fe25ff9d8ea04145225cf19c4f6a7e563084e86a826b87

  • SHA512

    16239c41b8369c8aeea410f2f8d43dbfa7173ba86cea897ef65b203a738f9b1bdef8b842f36e97d1e5dae875b2aa32934fbfd5c159e94fee79395d242dac8988

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:560

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    61KB

    MD5

    3dcf580a93972319e82cafbc047d34d5

    SHA1

    8528d2a1363e5de77dc3b1142850e51ead0f4b6b

    SHA256

    40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

    SHA512

    98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    7f3133b7df8363040fd26ba5d70a73f1

    SHA1

    4f7ae4392627339e7449e0a640c2839877f09442

    SHA256

    ac4cef395b59d06e6e55db89400bec6392bb2e06edf360abad5a0b3e150a88dd

    SHA512

    6467e53240c86af10d7f3ac614dbc840a843d537f069751adbe2c21fcfcf99eefd149377b6d4e26812e7cd1e22c42ed3eb9bb4eda2c597093ee68d7df5f8dea7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2UH0PJGC.txt
    Filesize

    607B

    MD5

    a864f7b3f860c8586152442a8f63506e

    SHA1

    3d1bb8da972bcf5177ce8ba235118947e4401be9

    SHA256

    802ed00ace000ff53d2d9baaab0b56dddf9415f8c45986084139041212d4b2ff

    SHA512

    85d5a182fb974bb702f3fdf66f2a00c0b6fa23810c53a2efe70473dbf592c942cda8f88008e725911a087a525570c1458667a3292c45a15edc7d07dc2fdedaa1