Analysis

  • max time kernel
    134s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2023, 14:41 UTC

General

  • Target

    http://yns1.yahoo.com.ilwulocal142.org

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://yns1.yahoo.com.ilwulocal142.org
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4964 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4896

Network

  • flag-us
    DNS
    14.110.152.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.110.152.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yns1.yahoo.com.ilwulocal142.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yns1.yahoo.com.ilwulocal142.org
    IN A
    Response
  • flag-us
    DNS
    yns1.yahoo.com.ilwulocal142.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yns1.yahoo.com.ilwulocal142.org
    IN A
    Response
  • flag-us
    DNS
    yns1.yahoo.com.ilwulocal142.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yns1.yahoo.com.ilwulocal142.org
    IN A
    Response
  • flag-us
    DNS
    yns1.yahoo.com.ilwulocal142.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yns1.yahoo.com.ilwulocal142.org
    IN A
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    yns1.yahoo.com.ilwulocal142.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yns1.yahoo.com.ilwulocal142.org
    IN A
    Response
  • flag-us
    DNS
    42.220.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    42.220.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.141.123.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.141.123.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.178.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.178.238.8.in-addr.arpa
    IN PTR
    Response
  • 20.42.72.131:443
    322 B
    7
  • 8.238.22.254:80
    322 B
    7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
    8.1kB
    15
    14
  • 93.184.220.29:80
    322 B
    7
  • 8.238.22.254:80
    322 B
    7
  • 8.8.8.8:53
    14.110.152.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    14.110.152.52.in-addr.arpa

  • 8.8.8.8:53
    yns1.yahoo.com.ilwulocal142.org
    dns
    IEXPLORE.EXE
    308 B
    308 B
    4
    4

    DNS Request

    yns1.yahoo.com.ilwulocal142.org

    DNS Request

    yns1.yahoo.com.ilwulocal142.org

    DNS Request

    yns1.yahoo.com.ilwulocal142.org

    DNS Request

    yns1.yahoo.com.ilwulocal142.org

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    yns1.yahoo.com.ilwulocal142.org
    dns
    IEXPLORE.EXE
    77 B
    77 B
    1
    1

    DNS Request

    yns1.yahoo.com.ilwulocal142.org

  • 8.8.8.8:53
    42.220.44.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    42.220.44.20.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    233.141.123.20.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    233.141.123.20.in-addr.arpa

  • 8.8.8.8:53
    254.178.238.8.in-addr.arpa
    dns
    72 B
    126 B
    1
    1

    DNS Request

    254.178.238.8.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    3fbb8ee33354096d9f116c557a402d14

    SHA1

    f75756c42d45d1047eb04fa54bd7702f5560df4b

    SHA256

    13e2696561dd0955e1d61f7e18166c8bd7a02faf1dbfe04e738b5d68cc2ca57e

    SHA512

    cc21e56f9278282b3c15964b5618d42bdfda83b245d7bf01d12550aabd69a9747d1deaa5a9a9830e6d6a47465f580e21e0a7621cf992b56244ad4bee8779c338

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    9845cb2076b3bdc0cbd67530c6376984

    SHA1

    aed38e7cdd4d4fb01bd5b4ff25fe08d235b41505

    SHA256

    3a34cf110d881a0deaabe7666c3020fd25b2e5fe5df69423cd8abbde063de063

    SHA512

    95288b805a2c19266d2aafbab306a7669ab8d25ab85241cc36f36ab3e69fa3c8b02c5b12f6238e37b05acc7c41c7828ba739db46c2311a7eb594e3fc4a2126f0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1B83N948\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.