Analysis

  • max time kernel
    183s
  • max time network
    203s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-01-2023 11:18

General

  • Target

    https://www.ziprecruiter.com/k/t/AAKVVMVXF5DhIJ6qn4recwygmxIABRun1afyFfjEzpiEIWdopxgPVKJXHtDNW7VYAF6Fh2TUSjoYj7VSw0M18DxvMTZxVOzaVMVYDNKhwGS5KBr3SqzQqxMjJuD3AV7qSzor7jzAVTkn8i72E0-jM-PHCVty_yJBupzwj4_qEpXJIqfbUX_HCt8io-Q88D_3GBvfXIk32W8Y7CsoaAP2Uug_s3TYvPLecQtImIv1Yvdb8wX3sUf4GfVC4IHwhvxtfcA6Hk6my79Wy1C2Wv6xX0Mob1jd4MbF61GHzGLYkC1dj8epX-gboaMaMkn0bLP4aulDHny1N640m7zKkTLntUw7dSSClKQXQhGPtvxw

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.ziprecruiter.com/k/t/AAKVVMVXF5DhIJ6qn4recwygmxIABRun1afyFfjEzpiEIWdopxgPVKJXHtDNW7VYAF6Fh2TUSjoYj7VSw0M18DxvMTZxVOzaVMVYDNKhwGS5KBr3SqzQqxMjJuD3AV7qSzor7jzAVTkn8i72E0-jM-PHCVty_yJBupzwj4_qEpXJIqfbUX_HCt8io-Q88D_3GBvfXIk32W8Y7CsoaAP2Uug_s3TYvPLecQtImIv1Yvdb8wX3sUf4GfVC4IHwhvxtfcA6Hk6my79Wy1C2Wv6xX0Mob1jd4MbF61GHzGLYkC1dj8epX-gboaMaMkn0bLP4aulDHny1N640m7zKkTLntUw7dSSClKQXQhGPtvxw
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3976

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
    Filesize

    1KB

    MD5

    e75dfec651f2c06025cc7e76fe1dffd8

    SHA1

    db830b11de299a2010fdcc73bf10ede7a7705e4e

    SHA256

    a8760606853655602402154f1d10380720cfdae50ccaab91d349476bcf39173c

    SHA512

    8935d95e2f201cec5dfe875c25c9dff49ad28a41c7a76be3892916105a8fa99ac8df20c291456387fc64e5a3dead0da88bc3f12d968065b7fd188ef77cdb50ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    1KB

    MD5

    7003ac003161ee9478c0cfed89916fa5

    SHA1

    4d87f137d58c5d024013d4ca4a0d667ef77e6ed2

    SHA256

    9eb7e06e61420169b8945957eda7da04edce0eba081c21764670e5e803e75a43

    SHA512

    0b422fc6fc54a4004ab3bd81d3eef8db4e126aaf8d9f4a437dbf7dc69c5df5dee9bfad4a79ea45dfdaa66b8c6283610f10c5f368dd73465015be4ad4cbd4e5ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    b011d2725e33c0bae4cc6110f1228caa

    SHA1

    98595cb1500ab32b457063d29a60a8ae5496b49b

    SHA256

    cfb146a5a70caac0842df76ab5cffbb524b9964c4a4250473189d053f24ea9ae

    SHA512

    60e98f54414f8e14185dd66570b6f4e1cee6471648b700391e59042249e9546d9baa19a6dd0c0b6b8ea17e1eb4059303b7a584507624d0634a50d957af21bfc0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_51D4699549625CAD0B50E0C1F54704AA
    Filesize

    278B

    MD5

    6b93e03c6f317cc373032d1004512de3

    SHA1

    f3422b51dc2b2ec7010d47267dceafaae1989467

    SHA256

    339bef084d36db6a212f84ef0565940369314a4d5acf8f1d5812f336e6a5459a

    SHA512

    588d62327151ee952f4c419859ce116b7e0ccc4c7c1574365934576a94ec8ed8506cac10aa87459298a4970f6fa3375d2eac74581e4d3d6f4056add370a240d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
    Filesize

    416B

    MD5

    632e1f30f228aa728b2c27781e58d991

    SHA1

    6195c41a12cebff13629fd1c9f71fe0c72570a74

    SHA256

    ba766edb7a98de0f918da0730b06112f204245fcd6f2ad06505965e92b0296b9

    SHA512

    be721288ff775a15c758939dadea6e637183d8cc16704f2b9e01961b1a0983e7deb098832da5aab91424f2634abae68b35ac08d52e8976f404e08150d914deac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
    Filesize

    408B

    MD5

    c8bec716885a032002f7918caba43f67

    SHA1

    ac4b5c71e84000e0ca32e12aff4d54b26d83f027

    SHA256

    f4bc8daad6060f3b5eba19ea1b26232ef52c1317fb6446092396d0cb9a6db465

    SHA512

    5901ab76ab8aaba398b6a61935d3eb1cc786719854605890b35c86d484acc9b0bad5b6aef9c54cf22745100b51d1769e6b779f81438b95e500e1e2899a4cd7e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    434B

    MD5

    3bdc9f6ba20677a976afeff1d1b2ccda

    SHA1

    96494d82be3939a2b57ce2c02ea902094ee5ff1c

    SHA256

    c1d08f42136932d8a3de001d174d9f9b43d33bf3795d7dc825853ec76bbdeab3

    SHA512

    f0d47489e07241db92c91f3a25d4325be22dbe556d34e10948e4b26344677937128d6231426359d79e8fbb916dcd9c98e78cc36cec3d3994d6745058a3cec638

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_51D4699549625CAD0B50E0C1F54704AA
    Filesize

    400B

    MD5

    efe1a41c2b40d5e324ec802ff9bce879

    SHA1

    aaebfd9d29b0f6ceac71080bcb0faa8930432312

    SHA256

    33a5e98f72b0a29c29e2266302025ef3c3e93500ef71aaafbd97aa02122cdad4

    SHA512

    adf397405999aaa400750f27b0cf1d6abf6f792698729cf0e07641a5a503d4356cb1251dee913b72a7d832c01ee8cba248b5826f15dd9be885b65cbc21d8cf1d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\47FBLJB2.cookie
    Filesize

    611B

    MD5

    b8ea2668eabaa33c945ad06ce567082e

    SHA1

    30cd1cbfe0c634e7bbfc358ba7498b46a03b8302

    SHA256

    4fff507f807272a560c9157e6f22cf6dadbbd4f63cac6fe8e3497a4d5ae70d9e

    SHA512

    b7629225def5795da350e291e65c8c721aefd0f2b8dab0cb3d6675c92d1bffc292171bca8ed1d0666fa6df05576c52914b217a169fb0ba8c4e2ede72591582e8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\A1MRVISL.cookie
    Filesize

    504B

    MD5

    19e7f11a521d4bd072ec87f11a59247d

    SHA1

    6881db22f58f07004b09431a668a85b7da7ad3e4

    SHA256

    45eb3de585af9ee9b9e18e2f2f9af873a1b7825dc6f7261e60d186694a2362f1

    SHA512

    49a9716254f75be614c01ab3038b69540ec3a016cfdad16c5b79e0945d4a9e5131dc2ffe6b76a9ee501cbb2be1928a8d424fef2e6ee43e93a3988b5262186597

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\L2KLAPB5.cookie
    Filesize

    804B

    MD5

    355820b11c72b498115f6864807404a1

    SHA1

    036279eef477c68e42a27928a876dd4bddf9309b

    SHA256

    cf89ee112dd856a51ce8939bd173728857456276c39ef46e4d5aac5665453240

    SHA512

    3f0dc8863005658466f60584a4992da819d5da58e0d6266c0e27607acaaa8f5a7e006eadfea0b5823abf7a9134765557681a382bd9494d193c5114bb6913e6b3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LGZQ1MU7.cookie
    Filesize

    804B

    MD5

    03eb3e1c2765bdbdb5c434883e0305d0

    SHA1

    051fc222856345d8d26db90d743ed0437abb0962

    SHA256

    3add1c09d0405feee2fb50868ab19307ac62d8d5116c70465d58c44f4a831bc7

    SHA512

    18663190ab2be38e0e43a4f1528d3855b357dec72c8a6987e9bb6aeb492f308b2a9bca8c531061f7152ae715ec5241862b7b63422c0dfa137285a46dc5d70d6e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MCJLET7W.cookie
    Filesize

    508B

    MD5

    4fd22cb26bd613e9b8b8a2931abdcf30

    SHA1

    de719717a904a97b0b775986066f0a3b2f0b1466

    SHA256

    2508ace43edd1c2891adff639c7fb49eab98821660ee57a2a241325efbe230c8

    SHA512

    5eb8d7c4a6db04a83fe792769e10a54f824ed3ebca890d8704b00940c7896497060dae2c9765dd3ab3d4e0ea8563ac94d35f278ead618605b7e03e2d00e62e53

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\OCBS81K7.cookie
    Filesize

    1KB

    MD5

    5b7d8e373687d92c5e52bef0ebed02b0

    SHA1

    9b90744010cdc259346df64daf10f6f239a4d798

    SHA256

    7c8a2b8815d8814933ba440d9d9833408acc4755f0a5cdabadbb30a664d510ae

    SHA512

    80a49482b91fb740161f9b028592992931e294de0cb79d19023a70e6ea0a15a52cc6cfe393730e0494f170bd3e331d5c67f0982c8ea2f3ec0c4a68d402f1f6b0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YSP59F2J.cookie
    Filesize

    641B

    MD5

    12152d5d7c627552e4177268007063ba

    SHA1

    72ebd733fbf267ef24b1c62d1b16f18f3d434510

    SHA256

    27f4c06cf01c4dd3e1045a227711621577f0f88cb409cf4790b3494fb0f7555e

    SHA512

    147a1eb8e85f3456abb27d9502bacb5ba734a045b38d742fac3a32861480deb24014fabd2d28efeeeb60597847ba11ff035d51780caa4d5bf93de8566cc8d4cf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZWIS5LRP.cookie
    Filesize

    618B

    MD5

    6d056cdbc79772a41eb4bf63d7363475

    SHA1

    7a01e6e2e03d93456d89bd00367a28e45eb5195c

    SHA256

    b5455a9fb023230de040f7718f89ade89bb48e6c6f2e0a5450feac2b87ef40bd

    SHA512

    7f866272051fd2ce5ab1d0ca7eb9cbebd581c45f146899b4c5c9a5b6a31f55558b9021f03618e7ffca856597577a51174713ccbd2042e4b30f2918a71803a327