Analysis

  • max time kernel
    133s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2023, 01:17

General

  • Target

    Kirsty/lib/Bunifu.UI.WinForms.BunifuSeparator.xml

  • Size

    6KB

  • MD5

    db694790168f48647a559de34f6fde34

  • SHA1

    ecfdc2886beb9b0cbb53d0799274ad0541aa8ff4

  • SHA256

    47dd33c9a48d4abdeae2678b64ac0332e029250b3cd254eab002e5fd47096f87

  • SHA512

    0ada9f273524732f893ad4f06589eb7b6bc6b9f4fbcfce412b4f952ca772fa4c5eef3e3ba78b23a6e393497502ed193b78ef12f28f841f4c4cc3e9a2574dbaac

  • SSDEEP

    48:L53YlOgLGf2QLBl2uaK2Mc8QJtJSoaOYTolXdgLGIO3RQKEdEZSu:L5yM2GBl2G2H8y7HXYOXWniRQ5Wf

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Kirsty\lib\Bunifu.UI.WinForms.BunifuSeparator.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3396
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Kirsty\lib\Bunifu.UI.WinForms.BunifuSeparator.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2244

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          42b28ee2017bd7c4d7a394ddfd2d2bd9

          SHA1

          c7818f9f00bd728729fd0b6214469e0682103d18

          SHA256

          b25e5ebac7e3a33c0d22fca2bf341f619823c15e630d57794fa92ffc9aecaa86

          SHA512

          36b38aeba5406d73b550fb9e0d6860969dfeba29016bb0f76323c503dbd7fea5208ec679f39a27e7c3dc71268c45624b64ff698055a95dde0a5a64838ca0e70b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          d087f8a07ec1c4027df92e4da60873bd

          SHA1

          bb4a0a6a796a3d5f2ef0f8e3334752fc246abbbf

          SHA256

          a23f0784bf71ce195424e723d8f123b8932c178d53fbcd4ea42fe49e17c5dd7b

          SHA512

          898676e7e3814ccfb77fac75998611cb61178171257eaac388a172957e803932319a5aa81b2b193cb42152c666f70ca786376f55103c0e771a6f8f0409d5c23c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X8M28FTI\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • memory/3396-133-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-134-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-135-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-136-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-137-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-138-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-139-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-140-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB

        • memory/3396-141-0x00007FFDCB330000-0x00007FFDCB340000-memory.dmp

          Filesize

          64KB