Analysis

  • max time kernel
    99s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2023, 01:17

General

  • Target

    Kirsty/lib/Bunifu.UI.WinForms.BunifuShapes.xml

  • Size

    5KB

  • MD5

    55bc7bd2c8819da2f38928d9b14b52c7

  • SHA1

    98874739bbc022ae1be7a6f2952b1413d9d506cd

  • SHA256

    5df97b22f4b1c15c3ce0436f3d9cba6f096441ead70b786f134903ca4d885a7c

  • SHA512

    c9e65c118c4726b6a552aabcba35603977e5ea75144749e8075f2bd2e701f2b377990ebecb052da91de779d4ea90b4568e0ae363877b7bf9a1e29b76dfd74178

  • SSDEEP

    48:3afgLGg2WFXW6xbYJTtOSvTWA3ug9+BoUMZUzrv2yn2U4LyipQKE+r0Nuu:zV2WtRVY3Hbs+TUMZUzb2U2UhipQ5SQ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Kirsty\lib\Bunifu.UI.WinForms.BunifuShapes.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Kirsty\lib\Bunifu.UI.WinForms.BunifuShapes.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3376 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1472

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          42b28ee2017bd7c4d7a394ddfd2d2bd9

          SHA1

          c7818f9f00bd728729fd0b6214469e0682103d18

          SHA256

          b25e5ebac7e3a33c0d22fca2bf341f619823c15e630d57794fa92ffc9aecaa86

          SHA512

          36b38aeba5406d73b550fb9e0d6860969dfeba29016bb0f76323c503dbd7fea5208ec679f39a27e7c3dc71268c45624b64ff698055a95dde0a5a64838ca0e70b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          29e0d3e898b291b1a274deb7ddf8f9c1

          SHA1

          f4c68b0df436de660bf04bfc992c8343598742ec

          SHA256

          3d13f1d76c4cb6c1fc1d23d7fbab5a949c477296ba2ef2a552187ab2a65ffaa1

          SHA512

          94aea1e3a18827b2977f8f85b0f821d0d4c62e84a4f376dc52d8cb0df8ac65898cd2c1937b07ef99e161e8fd6eaddd76c7c5375ec7c465569b95e91d2f3eca1d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\X8M28FTI\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • memory/4252-133-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-134-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-135-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-136-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-137-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-138-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-139-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-140-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB

        • memory/4252-141-0x00007FF836150000-0x00007FF836160000-memory.dmp

          Filesize

          64KB