Analysis

  • max time kernel
    141s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    04-07-2023 04:16

General

  • Target

    download/webfonts/fa-brands-401.html

  • Size

    104KB

  • MD5

    f4bdd85a576812f553ec3cfea8b1a2b5

  • SHA1

    380bea4e9eb484d835d89cc608f2af7c3179e8a4

  • SHA256

    3fe890d088ecf0cc9bc1b9069201e52972dbad6237865524090e15982d0de718

  • SHA512

    bee31cd02a25885c9bb0e8eab268a836aa80efbfd82f724652dae32a68c56078e5d069b7fb447e30432fee5f94564f6e07685b568496ffcadb07ed0c51f305ce

  • SSDEEP

    3072:Q5M7ZAZsXQhcMCxRuc+6q/SNY4GvEjLs8:GM7+ZGQhrCm/6qKHjLd

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download\webfonts\fa-brands-401.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:296
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:296 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1359639167aeef9df6590ac181e2df32

    SHA1

    44836484da0f14663bd36ffeed8f28d87bf0f56a

    SHA256

    13767b44d881e0152b94f9bb276cd45bc05f25ea27f19e12ccd2165b5540a7fc

    SHA512

    128312a028fba901c7b0ffa82328a207e4af6ef8eefedb7bae97a401668488d2962ca8b759c573942a4b4c6e74e508cf54f4cbcbf264ad006edabf4573bd877f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1cef16e8b0ed60985ff5aef4574b9030

    SHA1

    c71d6e1486c3869130854212cc5a82f1d7eebb26

    SHA256

    622c21b3b49692c817d856efea625c201896c265b560c7caf567fc8d4ef1bb9c

    SHA512

    62c0e76836c16f978e1e953bcdfde607b6093f24a751e15434a63c8cca161381a8b2b5018656a84e18a50456c067febd8b0b8b60c11fd023c47ef5fb7430dea8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    10fa5e5ff3a197b8ee1b48514b2eed8b

    SHA1

    137087d48f6b537a4904470cb1d5c800b4d4d860

    SHA256

    b7c8d51cda5cb47ca49b633d08d59eea78589ec69ab5ef323c7d7d15eca5dbef

    SHA512

    cdae8d8ec143cab96b580d627f56a3d634b4e9066eb304a83202eb8fea312e5c2cd123ab7c5a0423b60cd1c4f23b26706d4d16a78bb0736f3ca74403fc56482b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    292807b75c6085a7bb4ece1bfcab3dfe

    SHA1

    76f70e0f3d997458fe6365b9ce727eb8568c1c56

    SHA256

    a35cb5997ce7ebda5cbd28728596c5a325a04c93b40ee6fdb4a7d12c114192cb

    SHA512

    9dc23f3f11d45f428d9867aac59701b9719165abf95bcd4fd590fa98faa251358c24a821576a583fca28a8b09ecd2cc2990a18e875abf749edbc9249f7a9aae4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d19ca363dcfa839137b8453cc9c9e91c

    SHA1

    86d0dcf03a1872cfcf20c8817eaf245ed1b386fc

    SHA256

    30fc2f3020f00861f7fc4b668f9f6bf28996e92347a330f50b83dcbf936ca1e9

    SHA512

    90af6f8d8eee97bf9b3a64e9920046ceef169e9e677e1080056b0c76f7d7b99c8857b7f3b8217053f091d433fbfa1d82c4664109e797fe2e7c30db60f7533ebe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4d1b534b95df2af866b419e24836d15a

    SHA1

    d963a39b0b4ac282029b9643c65700b914a062c6

    SHA256

    85ad85b74358c0d878dcabab5516d4192afb723ee618914f5c985e4691405b30

    SHA512

    573c2983273a1f812b091f7467bc74168bd31dbe49b164918b2000670079686e716ed2f70721b958ed2f0980394f005d2d369c531fc862c023fb7a437786175b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3c911276afd7f9bdeab94651a1671051

    SHA1

    bc95977d1732e3f8c1c2377b21b7aea11145da8a

    SHA256

    2b50ae1656d0bf40b8cf82d5a28e6b5e46ba6d51fd254ff385d530b80c5b2cc0

    SHA512

    c9b203f383928190043db6c518456e17e95ee6cb440d61462156f6ab9c9d60a48499fb420c54971e4c446d8f770a1ce0f85992cf5fe00bde32591f5d8c9c3802

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab8691.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar86E3.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K2A46T6T.txt

    Filesize

    601B

    MD5

    697c366988de9e7c0b62927f56595ac6

    SHA1

    8eb7509e37babc1e1cee8bb654dc2ea8f819b6d8

    SHA256

    3f7fa60ed0052f50b372608439e5a5f9bebb374e3319d23ee884c7ccf6f832cf

    SHA512

    05fe8981a50cb298dd602c42e20934fcb4585b4741700aa5f102dbfccbbf4355d450f5ae384bb105137fbc567105d1bcd1c26bcba336c8f2fb08dbca804c89ee