Analysis

  • max time kernel
    135s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2023 13:11

General

  • Target

    logo.xml

  • Size

    67KB

  • MD5

    0ee91724102f72b4bed483ab7cf173e6

  • SHA1

    be34f1efe8eb2847a2e62003a56f68824f68b814

  • SHA256

    7df6bd8eb075dfaa07dd149bc93c3d15b885e01707ee87e79235c834714ab583

  • SHA512

    25696ade2fc91059b58ea737ae68f4b96f1bb678d0e806f6cef35229405875846ff166034c0e4f189daeca2ef56b733b00ff296944f76663e0fc8f3cbc2255d1

  • SSDEEP

    1536:zLxvsEbRJ4zAv4mWxJTkHK976GabBxrFXdee2Mk1FhQbZBfVFrra:zLq6RXDWxb9W9Fj2HFhQBfVE

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\logo.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\logo.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1848
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2900

Network

  • flag-us
    DNS
    123.108.74.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    123.108.74.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.13.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.13.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 52.242.101.226:443
    260 B
    5
  • 20.189.173.2:443
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 52.242.101.226:443
    260 B
    5
  • 13.107.4.50:80
    322 B
    7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
    8.1kB
    15
    14
  • 52.242.101.226:443
    260 B
    5
  • 52.242.101.226:443
    260 B
    5
  • 52.242.101.226:443
    260 B
    5
  • 52.242.101.226:443
    208 B
    4
  • 8.8.8.8:53
    123.108.74.40.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    123.108.74.40.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    22.160.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    22.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    200.232.18.117.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    200.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    64.13.109.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    64.13.109.52.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
    106 B
    1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    6bab4c9ad3e95e1fd0029f08eac5ce30

    SHA1

    9a5cc9aa49546e7bb43ac7329a5f7cead8a10543

    SHA256

    c93bdb32f59f9234c077ece327924f7acbabe226f66a54f2e6e258bebfa16dff

    SHA512

    a74b5f18969189869f96b830cb85313031fe147d8df67a637a407a4573e06a40bcd44ab8bc9228daf2ab301d88943bcfa41c7924d8c4d0ce94ac9b24f6e877e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    f31a8cd398677fd27485b8ea6ce93c09

    SHA1

    451993dadbb079def0d5440636acd00d77533766

    SHA256

    e99382b5057bd6bf72d15f23780e7948be1309acc2d95ff21bb64c7c284b70da

    SHA512

    e0a430f68e0528464118dfb8d64be22dfb81ee1265510b425a6a689614b55461d12e6e905fdf6138bcbcdf2ee4d4dce936235379a5417b014b106be2ce971928

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/4464-136-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-137-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-138-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-139-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-140-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-142-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-141-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-144-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

  • memory/4464-143-0x00007FFEBB5F0000-0x00007FFEBB600000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.