Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    17/01/2023, 10:35

General

  • Target

    1060/2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538.exe

  • Size

    415KB

  • MD5

    552911a7b0d4b3839ff7c63e5974b440

  • SHA1

    03fe3f86ebf2116f4f0ca22eb61432a6c02c2011

  • SHA256

    2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538

  • SHA512

    dd9b020d73f70721f677c916f1d2801a0f0bcf510d9eae58f61e9afba3492b92a4e606db075fc35d3a4ac63ca9c2008c364b8c561be1f411161178bea626b3ce

  • SSDEEP

    3072:KWymqz02O0zEr4cMwDqZ+wDqZ4wDqZHpP:KNrBuIZ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1060\2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538.exe
    "C:\Users\Admin\AppData\Local\Temp\1060\2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://paste2.org/DWeAUtKE
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:996
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:340994 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1964
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:668694 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:668

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e46b4c4b873c7833a31c81e380099197

          SHA1

          3b6af59c435fad022dd8856b741d880f9e5b54e1

          SHA256

          b05699ba87e43a46b03027cd0a3f74029e5055a2d7e146f8aaaf589721c68b4c

          SHA512

          d280c20bb49f6beda727a7b9c6520ffb0ea3281f5b6f3ed10d90b64dd5071b5a6b783a682eddbe9795367c6e17ae7fec795d205e25345a415bb8700780780757

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          e4155480a3c1ba1fb59057fe99424b02

          SHA1

          0bcc9c513e557f6e82fe0dc078696eeb408e5b1f

          SHA256

          e46b3f0ab5c00f37aa6f5699d51ce93616dc49469b7947c68be341611c993235

          SHA512

          7721e1060b892070885b5686b0acb2bb01431aeaebd3cc0e7de22a761d125839405ab84b9817349b7322a3bfa167c8a29cedaea160ec907e411f27f3cb31626d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\46XILC9P\4Z9E626S.htm

          Filesize

          38KB

          MD5

          2db16f6f35ed28e938c5c153a3a6297d

          SHA1

          44aad1c754462a3c9cb4dfb21e8eff04f6201b65

          SHA256

          f24abc7a4de62c178793b1d060ffbff65912e860b5b05886641ff8ac1e3107a3

          SHA512

          561d8fc3d54caf1f2e010ce01aad0b85c3384db65a6da9a1bff1211001aba7c50a74c5c2d45f682333177de1057390b3f7a7c56794c463edad2748ce638c6434

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\32L0DHYP.txt

          Filesize

          346B

          MD5

          80decda3273101d973768f6952d3c738

          SHA1

          97d8ee05dd569df2c0f840562d13c3dfd21b3018

          SHA256

          1c2970b4c2f8c61a7812e08370d2968e06f1bc9c86839c03c0a6b967b13a7e47

          SHA512

          3a63c85d664d4c6fd908dccbcd71f98cbcee74d096c21d74d3d76ffa6715b6a0d9d04653a6b54f428339ccb801caf89c383a15b58b6dd1cf9dcb251d8a888fe5

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C9YCYMMP.txt

          Filesize

          601B

          MD5

          4d3655f3e035c90bf68ca70b8a37f8b5

          SHA1

          18658b0d4c4b9e60e5a90ca2ec5a3a2dbb2b4851

          SHA256

          50c9e329fc004ddbd12268f37f541ad464bedafbf7d8cea10546d681fef7c247

          SHA512

          11c92d5807763de2bd4ebe011910da58292ed8b16a5aff7c2efc2324b028ed743af4b05741fb88639d2bf3385291b161645dda1269b58878c5c500309325d400

        • memory/1724-54-0x0000000000C10000-0x0000000000C7E000-memory.dmp

          Filesize

          440KB

        • memory/1724-55-0x0000000075E01000-0x0000000075E03000-memory.dmp

          Filesize

          8KB

        • memory/1724-56-0x0000000004F55000-0x0000000004F66000-memory.dmp

          Filesize

          68KB

        • memory/1724-57-0x0000000004F55000-0x0000000004F66000-memory.dmp

          Filesize

          68KB