Resubmissions

31/01/2023, 21:40

230131-1jhk5acd7z 5

31/01/2023, 21:36

230131-1gd5xscd7v 3

31/01/2023, 21:32

230131-1dzbpacd6y 5

Analysis

  • max time kernel
    141s
  • max time network
    156s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/01/2023, 21:40

General

  • Target

    Data/Packaged/Main.xml

  • Size

    1KB

  • MD5

    7b53ebd64e5781e02eaefb6739a6b556

  • SHA1

    d5332b200cf5dcea0419afdb66a15d89b9eb619f

  • SHA256

    b975c9251ef7394dcc69f49e54dc5aa5e8df32f9b5e8c687484ddd840eb94d20

  • SHA512

    c4a25c07e19760547e91818ba6e9ec3fe89206c29429668731c7563b7407cb56d8c0adca519bf96dc82a1631e82cfe63b68439cad4102ea2a1df438bac8400fd

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Data\Packaged\Main.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Data\Packaged\Main.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1788 CREDAT:82945 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4168

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          415f2185a9c64b830e7558bce25207be

          SHA1

          5b9087daa5a7c1b42fa0d84b25de64ecc9ab335b

          SHA256

          9845be82fb85d04acc616713931ce35e21b76fb6bd0c76945417c9377200607b

          SHA512

          a6385a6c7a0c8eb7f4dc5dbaba72d34e921ece1bda233687a38520b10fdb1a1451339ff6a4e63e6ce3840dfeadaf01e2d95cc01554830f88811989a814ccfbac

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          8ed652238a71543bebf3336d2390db11

          SHA1

          3a371e45c0beda7d1fa2dbc562d3d732bfd350a2

          SHA256

          9afa9051fd2ce28317edbb20f389c5a95c6c0a9676eb136c599000fec5f94fde

          SHA512

          00d1b4d059431c0bfea4688dc02d2c2f685e6010e58e0935757b68b81de90479b3d47e4519cbc68e0ae2259d8fe74e5ebaf759818e7ec25c5dec7d4d9537030d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\3UE0YGLR.cookie

          Filesize

          611B

          MD5

          02b31b8528b2eeb6f9d55fc13f3a9de8

          SHA1

          70ff937e2a2520b6bdadf7f1f3cd0b12f9fed577

          SHA256

          e68b2c5037b26f2b45065da9745d94f0e64e60fdc9cc68e9c8b137556b19b9b3

          SHA512

          9236133206c4355412a2df547e14cec1085d6ad65fdf709c5a18890e5fd5f5b125d4d44cad1865738ae944174877446f1d4d55b8ca8dfc367a8c8c5f1b6c29eb

        • memory/2784-116-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-117-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-118-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-119-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-120-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-121-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-122-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB

        • memory/2784-123-0x00007FFCA50A0000-0x00007FFCA50B0000-memory.dmp

          Filesize

          64KB