Analysis

  • max time kernel
    14s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    01/03/2023, 15:51

General

  • Target

    ap-file-vaultFile1590239415561324417.vol--1306992585.zip

  • Size

    9KB

  • MD5

    818bedded2d61ba7c58ecb70db84a3af

  • SHA1

    10595687bef6e9bba9d841f119655cf2f4645c71

  • SHA256

    52641bb237b0df5f88e95862bfcb177c7657602a51bbb4eedef0a91fde1a79cc

  • SHA512

    a3d475da6f47f0fbc223bd17217efe78404674cb092e3ae96f8d43fbf4c9dc1f403630faac38b0001390fa8caec8860f959b107ffbdcce8c7979919bfd533995

  • SSDEEP

    192:d1B33TX3X53I0kIHoptQo1hkbdhIZ0DVJx6:F33TX3Xp9lEahxhbz6

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ap-file-vaultFile1590239415561324417.vol--1306992585.zip
    1⤵
      PID:1980
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1008

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1008-55-0x0000000000370000-0x0000000000372000-memory.dmp

      Filesize

      8KB

    • memory/1984-54-0x0000000002B10000-0x0000000002B20000-memory.dmp

      Filesize

      64KB