Analysis

  • max time kernel
    67s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/03/2023, 11:17

General

  • Target

    https://us06web.zoom.us/j/89958686824?pwd=TmYyT3h6T1RNS2ZTS3YvdEd3RkR3UT09

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://us06web.zoom.us/j/89958686824?pwd=TmYyT3h6T1RNS2ZTS3YvdEd3RkR3UT09
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3240 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3736

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          27eeb470ea47791b773b0c543d47d7c0

          SHA1

          cf692b6241651b506a7639c0c02f4ab582b728bb

          SHA256

          887291e1eaf9e037071221908bc110ee40235c5d9c6dd4001699cdbfd55c9cd4

          SHA512

          23f1b1f25ca82aa1b9a235921ba87b86f61e58a1d19b031547144a6035144b14c0ca1f7a9391c00eca50c0be4f35a161d0b4402cdff37f1c9350a368ce3f1321

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          96de0f5659e7525f402865205d32fa05

          SHA1

          f887e1a5b27eed42bfcda949b5294ab06339d9f5

          SHA256

          a888e08c06f3c64b9d2a544bcfcb507e4767e871aa98f5f74fe57b07a95605a3

          SHA512

          0e31e7b1875ea02c186361e46eeb374db17a3bcd990eaf807c3597b417d99f2e9ed52b785844b9d5f80cc2d82612ec8038e5f03df03fd5c34557f486802ff588

        • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

          Filesize

          4KB

          MD5

          da597791be3b6e732f0bc8b20e38ee62

          SHA1

          1125c45d285c360542027d7554a5c442288974de

          SHA256

          5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

          SHA512

          d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\QNH5G1N7.cookie

          Filesize

          242B

          MD5

          74b7754f70826c9fa501f2c1f36c8635

          SHA1

          0d436397bc869c2991247a8e668dda4d58c777fa

          SHA256

          4f42cacfc3f3fd5b31c68a083b2e88024258bea944aee7b8aea4e3a2d7a1d75b

          SHA512

          41339e34dcf5c2f90d2b7914e6a1d78f907f804be8e61fe8747f9ca270a49657a105f0cb97199eed32bd2f84757a3a4b1181015d83bd09977798de65145c236e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SEDSGFSD.cookie

          Filesize

          609B

          MD5

          2050a055ff0b64013fae1dee380dcc0f

          SHA1

          1d4087ce88b09f90aad94065c763fb8f4002b65e

          SHA256

          3c6fa0634b2bcde8a8b013a3a267ffa2cdce80c7563388cf1b6abab6b4ac9687

          SHA512

          59d073b2120a26cb686086ac65d8987b522ebf601c0197050224b4602e08707be288324aea7d4d7be4d76315475b847521f46eefd685a516af1cce5e2355f13c

        • C:\Users\Admin\AppData\Local\Temp\Kno6D65.tmp

          Filesize

          88KB

          MD5

          002d5646771d31d1e7c57990cc020150

          SHA1

          a28ec731f9106c252f313cca349a68ef94ee3de9

          SHA256

          1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

          SHA512

          689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6