Analysis

  • max time kernel
    124s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-03-2023 08:04

General

  • Target

    https://appstoreconnect.apple.com/activation_ds?key=492333861a19d6eb71b21c7d6466b980&providerName=Hitachi%20Energy%20Holdings%20Ltd&subType=COMPANY

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand apple.
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://appstoreconnect.apple.com/activation_ds?key=492333861a19d6eb71b21c7d6466b980&providerName=Hitachi%20Energy%20Holdings%20Ltd&subType=COMPANY
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4784 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2016

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat
    Filesize

    5KB

    MD5

    8146f903758ce9134950f892ecdcdcc8

    SHA1

    5804d9fcc0e4ddc29516543b3550590ef4de6339

    SHA256

    6f37cc15ba843e3745f29bc8f9ee10cb068c2572bbc84b3382fb7441ed8c0e13

    SHA512

    2d91d3b2d85463a175716abe96f5ea50e3f7df5ead7902c052158bb1387969994cf9259548b9b8180da02e5aec4b2b4c992bcd28facc8639e104e90b249dc5aa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\SFProIcons_regular[1].woff
    Filesize

    10KB

    MD5

    9caca193fe7bff016ef17e26937711d9

    SHA1

    121e523fe8f27d18017c2f7a056f2f14bf43bfc9

    SHA256

    3b7d2b4c5417a697678081ed3b344955f0b25e694171178b0c01e029b4a18e8b

    SHA512

    280f17fbefa9682ceccdaaeb9d4cb5b283f22f3b403fc03420ff3bb51084f8820ae726dd6d3f3308d0eb2939e1a067c28f6f466ad5e7c736a79fec85aadd2e31

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\SFProIcons_semibold[1].woff
    Filesize

    8KB

    MD5

    55350be83fe4b0cdeec6e88ad7a66f03

    SHA1

    a78fe67acc4cfc8adf1b5150683841015150c60b

    SHA256

    41daac81421329b7091d3ea33d91959ee08135224c28f3dcb523341fa2e90393

    SHA512

    fffd17078729b685810896d3b81925ec770caa160b3d37a3b50851966020114230be85dd462da58240d49b9cd676ec9bc301d9b0cc874473febd190f4f8f5922

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\activation_ds[1].htm
    Filesize

    3KB

    MD5

    cc98488d03b164543ee273fed31eaaad

    SHA1

    0c7b59038f99c14502f9bfbcee18cb1352404e19

    SHA256

    698cbdba070a380d0f12658778c51bc0a9d900004e413d7bab8111b64fe5af32

    SHA512

    926733624c6c26b3900111c457ecd2f06377767160c1d1d632b14d877c38dde492827b78796792b96150c290c083a14cb1b533ad64684fe824c5141db0951870

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\SFProIcons_light[1].woff
    Filesize

    10KB

    MD5

    1252981c527c50fc1ac0e981ff12396b

    SHA1

    dc498de0b9262294692061885abb047ccbf41c39

    SHA256

    628a01bebd49a4858dbe4b7e9224d754682a6a72102303c999122f9a265cb1f9

    SHA512

    e317b06900b64931eba79eadcee3d829ad655792f7f4b2c54176a54ceeff1b631a009f38a42ed772d758503385c47b43360839cf904d5c502008443d898c0d5f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\SFProIcons_medium[1].woff
    Filesize

    10KB

    MD5

    ca928b2e864932590b44dd08aef96383

    SHA1

    ab1ae35755a5335398e82404ff8a110f9f3d7840

    SHA256

    6de9b14e38b2b9bafc567929424bcc27f9e2b8f1c60e8e6a6059c160d2461f08

    SHA512

    15675570492794908dfad8a3f92a2c5571b8b56989eb443584d67e9883d9e1e561be29ff652cc944f3760c0b6df83baa7d6ed181860eeb9d8db9b3626988e7c1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_black-italic[1].woff
    Filesize

    156KB

    MD5

    5e2f9b0710cdf770f4ef6b5d163d70c2

    SHA1

    7a35b621607bbc9fb6c87703c917beeb8777d5b1

    SHA256

    40b70fde2c57b0dd918f805a66a89238fd75d607c8cdfd4936ab910a0e22e9f0

    SHA512

    981a62861ad4c01b51e64b6fba253a6f1509bd236119a03aa83a9ce618e12223c4a481ce0443c8006c3399214aad611de8a18083678191ba5c3eb9ee253113c1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_black[1].woff
    Filesize

    233KB

    MD5

    7c004f67ff5451fb667477d51daf5874

    SHA1

    610fbdcd9c2d612491adc3444b32867dbb2c1c8a

    SHA256

    67c3495c2f71ecf32a1c9aa7cf3fe9930fcf2185a10eb6ae854b0a6fc127ab1c

    SHA512

    d6961db930db39c5774a2b7c3ef6c6f8bb48a3b505d1aa8af7054f910a3640b7aeb07dbc620706ba0d928df230ca686c2134046ed776eab2b453a9dd193f374c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_bold-italic[1].woff
    Filesize

    166KB

    MD5

    d7679c95a481b1e61fcbe1f6aec495bd

    SHA1

    866c12a10cf58a334df826459e2618cf9b5a67a9

    SHA256

    8def7bb2084a12ee3e8a341dbc9b788bd4a04a06b399c567d6f7218c108035c3

    SHA512

    af4471d3093d1311a76f90d6fe49dfe6d5bf0d572b5cf29b19fb0721f7fb67656d4b7de3777a29efc15a2aff7430155f8676273a72ae41d1a05a6fdb67089ecb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_bold[1].woff
    Filesize

    240KB

    MD5

    2253dca585c3a1c27cdefdc91610c1e2

    SHA1

    e464eb270978c087239cf39a3580dd938b460550

    SHA256

    381a14d04a0337e8f70d673f9fddb4bf79203b2d96a7808cf106eb8dc3ae4468

    SHA512

    4832ecd065dbcfcfe5859355aa2472646a0c348365365f661600573618bb34b440b652c9b246d94fde14ff9105676a24ced876dc72dd95486a84225ed4e70e34

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_heavy-italic[1].woff
    Filesize

    168KB

    MD5

    62bb92e42ca79c6acf4a5b77577ed6a5

    SHA1

    3bf98df20f7432c1e363352588f8b0690720b11c

    SHA256

    85d754b45e9bc430613dbcded8977537d3d19077e40e3e1c4ad23a52822b1dbb

    SHA512

    3e99b1a963e5e07cd46ef3cd4e39f84ff93b500811c0be6106c11f6b928022c102e9771ca2de47b0d3430c85e2784b90f85d348e2be598a27cf29ee49ea1c7c0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_heavy[1].woff
    Filesize

    251KB

    MD5

    751bbcba6c055664cf27a0e28ed75905

    SHA1

    d38ef03e8d810ac0a3299475bd9fd1c52ee0fb2b

    SHA256

    b15ce2fc81cbbd8669294125e3878d93eedd5baca6b985b13959941ed04a5c04

    SHA512

    efd93c59646e8231d594314beb83622212818c6b8d6e06a47b09aea80cd3a70217f6bb814619a045075171609b731adee41d0b052fed0da9fe235d3673851cfe

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_light-italic[1].woff
    Filesize

    149KB

    MD5

    0a4b1dc06979780cd34014f61bd4f61e

    SHA1

    450572bce55d1d6f6d695d8c23248c878eb7ef2b

    SHA256

    6d23fdb985e5cc163ae80e2a610237208fa9e330fd3aba9f8d379ad94d4edf51

    SHA512

    c7bbcfc1cd9ff688b28c38c53298a05442677415202a7c7265d0b0ea0290119205d2f0b3a21d3ee4c7ea0d96b9a43256930e213376ef18ef3c4471d2dec511ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_light[1].woff
    Filesize

    221KB

    MD5

    86035d80a23d89d0187b19b5ae6eafd1

    SHA1

    933a9fb0c20605ea04219b2164863d845bfb6ce9

    SHA256

    7a3cae97c52dda472c7b8c351f6f3e7e7742ecc85a641fbd93d2784e738bb841

    SHA512

    3d831996e5e4c4c6d24066ce8d13640b0150be7c23b5704d5ecdbf902078cc8fc95acfbb633acc7016dcf1d01d3d071b26c29b0352b9f644eceaaaadf3cb71cb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_medium-italic[1].woff
    Filesize

    164KB

    MD5

    1e92efa0d9675a01fd0293b2c9e9c3cc

    SHA1

    84f2be77b70983296301e4310e3b03e89a539e4c

    SHA256

    c91631d85b8be23592ecdfb8d9b1d3cc484585d37720ad0cd9463867d66cacf0

    SHA512

    abd5ffd317009c9b4c87c152e05fab23f933caa97e4bfece9beed5b3c36180e4a2a64d366c0ac12a0e01b06b9cf6261f51beb96358cb721aac5c72f6defa75cb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_medium[1].woff
    Filesize

    238KB

    MD5

    3c681eeacfc6c34e148a24b419b42baa

    SHA1

    2391068fa486f14b8503eb18d60ef5e6acf683f8

    SHA256

    470ed7956751f8d11903403943f2d9ad41c9993f805000effabcc16e9ba91a18

    SHA512

    adf9cba049a441c72489920bb9a17c8e705cf0258dedfecb27eb12b814ca85584f5a78fb532eda88aaea0c0b93dfc3fc5b03a4d2b32b63c265c6ad33e781b384

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_regular-italic[1].woff
    Filesize

    150KB

    MD5

    eb57a0dda4b8c5def1521cde5f089a46

    SHA1

    9cf5b3f996b35a893bdc4f777fe4d60d890f6ff2

    SHA256

    30a3922f6c984ed2c4039d3b4c8ac2de83a720532cb2695f4d51ff83e27bdadc

    SHA512

    841452236feecb16731d6b20124dd76536d5334c4ee1d2000a0b167dc1bed5268e10e4bd4dc5bb2e0d513f6fd4c919d9d929867242f6a7225de33e336e288ee4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_regular[1].woff
    Filesize

    222KB

    MD5

    bb45100751a5119aa7ab4a73c3bf0222

    SHA1

    4db28c1c2ad88aa62afd0c2e70091ed7293eb740

    SHA256

    36628897cb10f593b00ddd4ab8fddfe0e98995ecbc414822c252f041450d9623

    SHA512

    81a1f383c621163c5dc2d5343e1d4503e9bbf8d73792b01a54c24c37dc5a801b8e7a70c6858492a6bdc0551760a64b7992e547111776e16643fe8bc9de87af50

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_semibold-italic[1].woff
    Filesize

    165KB

    MD5

    e728bc970a164292d2e405c8248fd2d7

    SHA1

    0de9131d420152c4bb673f8f349dad0d3e78d771

    SHA256

    05a8f8cea54105d71685704520afef90c4612762d5acc00a8efc77e869a9372d

    SHA512

    f151dc5643cab17a1c3c7d08bf5a10fe03344ca57282e2e0611668f796d53687c1f8e46d3b7dcff33825ba919051fd6193fd4eb0afd47554ca5333c3b055de71

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_semibold[1].woff
    Filesize

    240KB

    MD5

    9452f717c927512d84cc2d0af79f2bf4

    SHA1

    5cb91a52b0031ca147e8df1e7efa2baa91c14d8b

    SHA256

    558465ba767be86d1ed4ada6c683b68bed2fae010fd9fd734afba0c3c0ee878c

    SHA512

    8bfc30792580e599641ba9c7bbe42ae2d60aa7fae013ce0913578b6e1471b59584c80ddbcf57c88b8e548d02313e89596991f159acdc2d2bf4106395453577f6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_thin-italic[1].woff
    Filesize

    148KB

    MD5

    eb1630e2db95703fe5d49ff39c82e548

    SHA1

    f47946403e028f2b71bff2385e8b0e61b8820619

    SHA256

    9f9e6b8690e2262387d5a85b4f12bdd1bdbe2bec7cbec81336cf65bd33a02d9a

    SHA512

    1e960547dc2e96a84a403ee3e818e464d998c7e499f4fa4464d0d785bde269a4f291784c1bca5a4706f9a2fa96892a1f5581b529d79fd78eb8e510fc66c94eac

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_thin[1].woff
    Filesize

    222KB

    MD5

    4c80ddc0551974dd7fe7ff278afcd2c3

    SHA1

    c3dbffebb59c37fa56581f701373b26bbce6a7ef

    SHA256

    2e11d3a679634806624e79d741994b5014012a9a450609163baf37db8e1bd916

    SHA512

    191895930a9872b4b7fb0ccc8d2b5c21ae3bbc98913665ee095ddfc3c8079ec9329a5b1a325e3c252b67b90dc05d07b5362935b63ac7815b2ce291f35abe618c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_ultralight-italic[1].woff
    Filesize

    144KB

    MD5

    fc301860a8561986efc9fc756f04f45d

    SHA1

    1ac5b7ef399bb0cf9dba404dfa980947a9801e19

    SHA256

    4ed876990c445b77a03382cdcce28054e6732a27f8de6ceb75c1d2d0372971a7

    SHA512

    ec04903026b1454f05810fc85005f9d15bd7fcf646bde272ed89619c44f3403a858a321be18e5484baf952dbf8c76d0ab96c2017f544e60f666e07f423fb6598

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\sf-pro-text_ultralight[1].woff
    Filesize

    220KB

    MD5

    5a75d837417a01da165d4180bf8e5d0e

    SHA1

    d516948644da07cf9cd4231f7850f20968dcf938

    SHA256

    a0dc9264140dd87e476c589f6c379139769ff317a488cd1ecd554d6fbf67582e

    SHA512

    700f2b94274c698271b5c81e2679d2e3078fe7e66ea305b44cffb978719048a879a3787f36ff2a420fcd2d9b7aa857cbb3acbab842f757532e3dd331e8d0d5d6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\itunesconnect.1673312324162[1].css
    Filesize

    267KB

    MD5

    1e117f192916dd49d54f381697593f6c

    SHA1

    2f7cc23457b04163feeceddefb535404b5166bbf

    SHA256

    454351f298d657debeb7b1e1bf57ba0e0e3149e1be7f151ec3d9fc2ee2634c03

    SHA512

    e0b378fab97dbd23cdb8864f648f817321c9fb9fc807368ea9a3988130fda3c2945fb655503a7e0d027ae82f7d49fa0ef2d6aeb01fca662f0cd0761fd5bd83b3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\itunesconnect.1673312324162[1].js
    Filesize

    103KB

    MD5

    b263cf8d071ecfdc6da54fbf4f65f618

    SHA1

    8cc77de7553f1613da23fa13f5514f59e9f3638b

    SHA256

    1d014a9f5039df8348189e22b1286d75dc4a6b3ba1e295cba79af30ffa1d53c4

    SHA512

    b1e2cc93b32b1bee432bb30c07e85a4b80b3faf329001dc6b8141687724f9465e4b29726b3eb56deb31bea069a0d4ce6d913027ce4eaf94f365cfef06383d184

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\vendors.1673312324162[1].js
    Filesize

    814KB

    MD5

    33d20ef71ad0ca80eb6892fe930bf22e

    SHA1

    4febda1c0d9a1b12980f448a2067fb3a33136051

    SHA256

    7b4fd456f5d41b018166755c3da92750d59d6c7416ed57765b1394d9b136e65c

    SHA512

    d37b825eb94e96d65803db63af3792361af3b5bc107676dde17fe8bf4a16bac82af6bd0158c645d954a2a54ea06dabdf14f241ae545483cf46f5f3a28727f31c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\favicon[1].ico
    Filesize

    8KB

    MD5

    28ec4eaba5ae210b98a11257caf5bade

    SHA1

    6164148a39d6a27286641896fce3b76f439aeab1

    SHA256

    3f5086612aae9363c9fb02949219cef19854c18fe5ad4eda78aa1aefcc79cc71

    SHA512

    4efb48689296863d6e05b3cf32f8f98ac57a2bdeae09209735170dd7f1c70e22a9bd2fbe93fccb7181b8c1b6dfe555af548129ef7b8705ed50486a972815868e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\favicon[1].ico
    Filesize

    8KB

    MD5

    28ec4eaba5ae210b98a11257caf5bade

    SHA1

    6164148a39d6a27286641896fce3b76f439aeab1

    SHA256

    3f5086612aae9363c9fb02949219cef19854c18fe5ad4eda78aa1aefcc79cc71

    SHA512

    4efb48689296863d6e05b3cf32f8f98ac57a2bdeae09209735170dd7f1c70e22a9bd2fbe93fccb7181b8c1b6dfe555af548129ef7b8705ed50486a972815868e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\fonts[1].css
    Filesize

    8KB

    MD5

    696b26c2ebbb2d680c1fa3e77cc7e866

    SHA1

    2cab45cdc0b9e62ce67066338463e30c5869671f

    SHA256

    46eeeff3d1cc3d719f1be5bd33001751cddb3adb683c30e0bf8710d834490469

    SHA512

    8b4a4c74993c783c4f6834192df405498b58086632550e7118778a6065e95103f487e74222439c930416dfca318da1dd8b52d0780e994414a505b476b9ef33f4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\itc-header-angular.all.min[1].css
    Filesize

    241KB

    MD5

    42342be4eb26440f8fe244471ffe3fe2

    SHA1

    412b213fad6f0b236b9ac78b61397ad74275b5e9

    SHA256

    42688fe3aef09f3625594faeca7d575da8c2ab077d042dbd9b70d167b70e63d2

    SHA512

    3e6880b799becc1c52dc6afeaf23c14caeae7aeeafae57a42e3228467eeee7aef30c59e6bcd4073c4f3ea5b13665bbf28c46c9c2330b3b6579d6b31ba8baf59b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\vendors.1673312324162[1].css
    Filesize

    1KB

    MD5

    9746301dfb8f95b775d84d65c13c4362

    SHA1

    e2841472b02030b3928c28b8c6d58a3e3142bf1f

    SHA256

    1f8c4fe0c0c312656051b2d70f757879d5e681085d25fc6b3186e61b9641c47a

    SHA512

    a0c5545711ea65ead20f44ee14d3d4b9e661092c682b6fb1d021791511fb508d71cdf31846ca3ae0f3e898ed24b2d1bc267d983e73ce6ecbf725fadfc44c1bed