Overview

overview

1

Static

static

1

URLScan

urlscan

1

https://deref-mail.c...

windows10-2004-x64

1

Analysis

  • max time kernel
    74s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 06:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://deref-mail.com/mail/client/gOh8WN2snEk/dereferrer/?redirectUrl=https%3A%2F%2Fwetransfer.com%2F%3Ftrk%3DTRN_TDL_05%26utm_campaign%3DTRN_TDL_05%26utm_medium%3Demail%26utm_source%3Dsendgrid

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://deref-mail.com/mail/client/gOh8WN2snEk/dereferrer/?redirectUrl=https%3A%2F%2Fwetransfer.com%2F%3Ftrk%3DTRN_TDL_05%26utm_campaign%3DTRN_TDL_05%26utm_medium%3Demail%26utm_source%3Dsendgrid
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4244 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\qwzqiba\imagestore.dat
    Filesize

    1KB

    MD5

    369ff89285a40f5edcdc81264d5464b4

    SHA1

    511d2e83dd9a64af221583302ef18b8af7edcc9d

    SHA256

    52789aef81c901e75a003fd848f0ddae4a467374501ffbd4e33f53a0250632b3

    SHA512

    be0104f739c94c339ac1214ae066960de9c42f79f221320f23790a9ce0e8e97073eb74269fc0dce29c8217f5e7d33fd3ae528d1d66a087ccd05403dc30c51cc7

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GVVED0TI\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SUUB7YB2\favicon_mailcom[1].ico
    Filesize

    1KB

    MD5

    77a9e5007815d923a4964a507953bd2c

    SHA1

    356a6a4942caeac5195d852ddeff558525074446

    SHA256

    33ca72f1eac56793d1fd811189cedef98004a067c85b1143083b564814a4b0db

    SHA512

    1a7dcf9abc95bd21dcfc78110ddde628b71263779c4f24361e55a7d18773d1b748cab978e19fdef34ad6dbc84d5f8a648a3af7fe192a8925b254a0ad086c33cd

    Download Submit