Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-04-2023 07:39

General

  • Target

    edit.html

  • Size

    74KB

  • MD5

    f6d8d59dec3b8f0dc74d040d242c5fdf

  • SHA1

    3ed22f5b782ce8e8ed1bbee37453c7460fde13ce

  • SHA256

    427eff6bb26be6b05211c9bff7cc934f6d0b13f78dbe9de69cc8367b7d7afc56

  • SHA512

    eeb2f7ef4344f99180bb7fee1dae4b10a499554d4ca4c3766f9bc4e270d510315152f26647ac2c021a1ea139bb3795b8f2d5ae7daade6929d2ca04c4c7f8a64e

  • SSDEEP

    768:e/lZm7jGQ7cw0Wvn6SnOmqtioC5T/H1Yavbr9r8RbXsfjFfXecYBHnRly8Gvp3yf:BGA0GJbZesBfEnAvMz/C0dhkoI7W3ds2

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\edit.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3232 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    c21af60a56cabee014f0bddf486296d4

    SHA1

    3b143b356aed0ab3e9a73843ea221e1cab819310

    SHA256

    3b8e9be80c68a0e4dda4cf30205638b58d2f055700e2cb131351ff9663cfa787

    SHA512

    9546c265eb771109b5fc39fd85da02be4b653180c2a1a7b43428fbaead7a8286ecfbe801dbffc8fd3fe58193803699128efcc3da633614396e6da85f1fee61e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    6a64ccb19a2ba5fcf8aac76b985f01ca

    SHA1

    1d701c38639c87d17156d0fe528e8a5e39c4ede5

    SHA256

    f957d69eacad2ee653529dfac79566542b0431ee76db8df0d2f1b8201067a5c5

    SHA512

    233124067b51a270a97b44c58f2fb4e45e55afe66f134e575c49da2fa897386ccef4ec31d44bae6872a6c377a2e10dc0e477a8431c47f03823d6679294b7283f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\cb=gapi[1].js

    Filesize

    71KB

    MD5

    532655ad32d7392fbd756a13971eaca5

    SHA1

    3762be5ac389483aa259560db54064a0e65b6dbd

    SHA256

    211e59d3d3dd0a6e43a866197a6214e70da275b60eecc85cd5a8b6a7e9b46d9e

    SHA512

    30153f19ccede229a0a682b35c45eaa762457dc3b862ffde85a84128bc3b849c3bf3f4d41b0ff78b6dc24490d387051f8029e2a34fe0cff55d45370c71b5807e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee