Overview

overview

1

Static

static

var/www/ht...eex.js

windows7-x64

1

var/www/ht...eex.js

windows10-2004-x64

1

var/www/ht...eex.js

windows7-x64

1

var/www/ht...eex.js

windows10-2004-x64

1

var/www/ht...dex.js

windows7-x64

1

var/www/ht...dex.js

windows10-2004-x64

1

var/www/ht...t.html

windows7-x64

1

var/www/ht...t.html

windows10-2004-x64

1

var/www/ht...b.html

windows7-x64

1

var/www/ht...b.html

windows10-2004-x64

1

var/www/ht...v.html

windows7-x64

1

var/www/ht...v.html

windows10-2004-x64

1

var/www/ht...n.html

windows7-x64

1

var/www/ht...n.html

windows10-2004-x64

1

var/www/ht...6.html

windows7-x64

1

var/www/ht...6.html

windows10-2004-x64

1

var/www/ht...ent.js

windows7-x64

1

var/www/ht...ent.js

windows10-2004-x64

1

var/www/ht...s.html

windows7-x64

1

var/www/ht...s.html

windows10-2004-x64

1

var/www/ht...g.html

windows7-x64

1

var/www/ht...g.html

windows10-2004-x64

1

var/www/ht...t.html

windows7-x64

1

var/www/ht...t.html

windows10-2004-x64

1

var/www/ht...b.html

windows7-x64

1

var/www/ht...b.html

windows10-2004-x64

1

var/www/ht...v.html

windows7-x64

1

var/www/ht...v.html

windows10-2004-x64

1

var/www/ht...ent.js

windows7-x64

1

var/www/ht...ent.js

windows10-2004-x64

1

var/www/ht...04.xml

windows7-x64

1

var/www/ht...04.xml

windows10-2004-x64

1

Analysis

  • max time kernel
    116s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2022 08:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    var/www/html/tata-pravesh/public/images/login/www.scarlet.be/customercare/_fonts/myScarlet20170504.xml

  • Size

    14KB

  • MD5

    0e55270998fc0c67aa140fc2cb9117e1

  • SHA1

    be0b50a0d2d306f15fd81b97a3a22384ec15b54a

  • SHA256

    16954b97a5218be8d0f5bf0a96db937ed436ec395ec6a28523d6cbe31850e257

  • SHA512

    49d4b74d7603c1645566efe54dcd5084a3273229ee96389cac0ff6eb18d22d930e531505edd73b73d8d410d94baf676e67f832faad915850b86069b872d0df3c

  • SSDEEP

    384:TWHLM3ZLBFNRFOdyN15FzfIc0AFqrORK9+fbtbnehCqXjhK7K:TmWpBFDFdFfIsUSRKYRDwpXjhK7K

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\var\www\html\tata-pravesh\public\images\login\www.scarlet.be\customercare\_fonts\myScarlet20170504.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UH3PJOX2.txt
    Filesize

    603B

    MD5

    de0749397f5fd58b538d4fd46e9477ac

    SHA1

    007ce99fc127e0a28e47eeceb91a0543d5c504f9

    SHA256

    c87a0de99150c4dc46d7ba9965672100b07c5ac899697d273b0e1add4e60ba37

    SHA512

    6d15a9e903ed37bcd5742f7b6e483273b89aa7bf8a1086c03b610423307dc551922b4bc81613d2153a83211b962f05854718cc31a6fec9fecd9b857f9088710d

    Download Submit
  • memory/1444-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp
    Filesize

    8KB

    Download