Resubmissions

15-06-2023 09:53

230615-lw5tvsfg54 10

25-05-2023 01:24

230525-bsr4gsff42 10

Analysis

  • max time kernel
    100s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2023 01:24

General

  • Target

    shape_01.xml

  • Size

    691B

  • MD5

    d20372ff49cbc552ba46c3d0e75d7bcc

  • SHA1

    7e3fd9c5b99a7857fa4d8cd2447f405d2054d6cb

  • SHA256

    e1dc2b963cac22f2b7d91148108b89131cacab682c7887665303c5bdb66a3ad5

  • SHA512

    d4864d4f9086ef5ecfe4fd3819983d41500fe9f7e64d787130699b5bcaf09e501a2b3143ebbd3398062446cea650898f9f9ddcd9792ed41a10275a93323254dd

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\shape_01.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5edc785a5cc012cb1014f4e188a5974b

    SHA1

    4702fda1eb3f63296bdc1da476f97891a93f92cd

    SHA256

    1fd4e12ac2ae63701a4a779b890f3555dcdc139e7ad459279b4ce71b350ce2e2

    SHA512

    fe114af259d4822bd1daa72095886b21305d807ed54ce74ee358a5d6fb45627f2f5184486e2c9a3b1b40e7656388fb13ac8b61ba8ac0136c9596cbfcceb65175

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    160df7eacea49e5aba537feb46e569bb

    SHA1

    e0417ee8681b3dbe74135a6a45519bb9d9f67daa

    SHA256

    af6b038de30f4accb14623b439ae27a96c3602f576ab813fb5a6d32744b248d2

    SHA512

    0f5bfb025818b468a1a618f8ff5c906e558c080a24c5bba53e872997c469acedc9c456984aa8f212893c7c90f3b561025cc9c2cfcfb14358455e7d0f04cce902

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    abdb7508dd22fc5ff37d8035e7f761aa

    SHA1

    b1b91d19b0cf56aa0a0bc0d8a1248d273531ec4d

    SHA256

    2b8fa44dfdbb9640cfb53889b174f53a85332f183e556c9e563971c79e2bd219

    SHA512

    22e5912a5fd8afb2719f99d5bec7452038478bfd30f7700033dc59e61b03c0ca06fdd1ffc64366513279bf294326b51bb1009f225bbb3c1d114135c22b8a8470

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    736ce10f31d3f132158162085dd56c9b

    SHA1

    1eaf409cbfd556a1dc1d7f9b65a1b7b91c87a05f

    SHA256

    4a43ebfb94aded19277cde7d1d69128851add4797ec24a8faabbc16bfc69ec96

    SHA512

    0d6f898f5e84213d2d481293addfdfeb17ef85391988fcad49837c391569c4477fa04a320ee23f9b8b0278dbc01439c5cfcb46637702e36a97d3806b3207d693

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    90fc5147d21cf723b06a4ca4e172b6a7

    SHA1

    fd1ceda3dd137fd4edd12c01be02c099786a6cec

    SHA256

    8900003f65c833484376d3cc4e06da114ec72fad76dfa7ee6a325798a9fc3bcd

    SHA512

    9ca78c285d168c9eed7c93d45aa64456d60b32b306ec0b334bbb5781f460ebf11bbbbb55f740cd17d6b2bee1143bed3e92a022b2380fdbf9e95c8250e70c86bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f934b31562f4a61d9b4313cb9cbb6bd1

    SHA1

    2c4fa9e1a72d6d9280b5831c812ca2c285079aa6

    SHA256

    626838b7ad7f0bb17985aefca3b65b23b35da6cb3ec48bb8cf7896fca5fda768

    SHA512

    f1cb666000a831e14041b0054987566a999646db2202376b15b2a7a53171410b28fd75ca68dad3f6a39e689c9b699912900909655cb8794fe063c32d62dacfb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9d9fbd9f2c9a130eacf1b720a965e8b2

    SHA1

    83f51c2431a0492e36753e7606ec3af87d51f668

    SHA256

    010ffc0708fa7a3fcae7de034259e05b287428501f2e75e4722f4473967becd9

    SHA512

    efac853c8c28c39c42fa785e38edc0fcad6947662551ca43fbf91e00229f2545e9da5fee7a5a6b5a369ec3baca5a7f2facc5b2722c34513e1072e011c21c8293

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    ff8fee2dca52cf08588ec230ba8a3b3c

    SHA1

    70d3f71ef338a47d6bc1ed1d91b016bda8bea017

    SHA256

    10f7a9b372e54c90dd8051fcb6ed3d4a3cdc0ed01b4696e3f84b2566a8c19de8

    SHA512

    ccd4e0171a6132b3abbdda591a009e51aa3adf0da9d2d0c195a015bcea79fe27dbe095dad860c8e8a444c4415342545f2cc785a692653ebf35b34edeb5287cbe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9e6fd294e9766c5a1874ec190fbaaf8a

    SHA1

    e91bc32c7e306c021c0128427cb7e6cdae7915b0

    SHA256

    2124da3ce57bd1484cc31b7f8d29aae002101cb77b296294ad5ce2f00860b3ec

    SHA512

    adf6c62d51c5ba36d01906917f6758b92feb0247598b39fadd7e85b96581489bf8e9bba1b4a476171814b4944cecc050999c7717fcdfb501fb797723edac7875

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9bca6bdcc86b22fe3a30bae08dc301f5

    SHA1

    83b448e853aaa560ab81e2c7a5ec39b9bfb657a8

    SHA256

    b88089a5b0ce5f3ccdc8c34bd2d69e1e7afd885482152cc189c0f162440c555d

    SHA512

    9da8dc82e8651650dd8d6fda652d2a40018c99c601ff4c8d9b160124e4db2fec6dd851bdc40f11f6477ebe3a10ae7ec57f9cd9345035d512d494ce6bc29419f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7710243c1762bcd94f0e3b3ec128b200

    SHA1

    54501bee06897a353b6dd56032868ade983e910f

    SHA256

    c9c5ea90aa8e14f0a702c86b8c07289dc30c52f1de6d4fa613408a2b5a88b5ba

    SHA512

    7ef5a08ae985ab4f9fde9577e027b248c74d56b9c07ce285999816244513f37607e01efcad2bdcbcb2459f7f1707a87c0e14f099326a73835e74ce912291e68b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab9975.tmp

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\Local\Temp\Tar9A76.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TXORKDRZ.txt

    Filesize

    608B

    MD5

    dffc11b37bee0b8aa8f9ef4f4cb9849d

    SHA1

    a676d88797be74db11c81579e6d1e932f6e7ded3

    SHA256

    63821886c638f87f1b51d483efbe336b1bb8fac98b2f529e07dffa172ed56fd7

    SHA512

    83f57718ba44e81c84ec4d64fda817a0d4a3913135bc84513c96d5769152edbb18480ea16ad2188148a59599be310998291d88f91e27af4024997b0b97908e6d