Resubmissions

06/07/2023, 18:35 UTC

230706-w8fqlsdg43 7

06/07/2023, 18:32 UTC

230706-w6mfdadg35 7

06/07/2023, 18:27 UTC

230706-w34kgsdg32 7

05/07/2023, 09:21 UTC

230705-lbqjfabd66 7

05/07/2023, 08:59 UTC

230705-kxxdfach7v 7

05/07/2023, 08:41 UTC

230705-klwmrscg9y 7

05/07/2023, 07:15 UTC

230705-h3aqhscf6z 7

05/07/2023, 07:13 UTC

230705-h2e9lsba95 7

05/07/2023, 06:50 UTC

230705-hl6fvscf2t 7

Analysis

  • max time kernel
    135s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 06:50 UTC

General

  • Target

    clockDarkTheme.xml

  • Size

    1KB

  • MD5

    663e33bfbbb0d14830694114d49c457d

  • SHA1

    3231baf54a3c1f336f1b11d9a7011bc5502a9d4a

  • SHA256

    43b0cd84c7344f57b2656d66d5bf215a4f1d1713a8117e0ecf92226b8ce1a200

  • SHA512

    c116ffaf6c1f8ad9bd6a1d85de318c9ca2c3b6d4931a1aa165dc7ef7351c80fbddc7ca1371c81dee35b3e12720fee2d3146d7a510b54026c3aba9202dee5f1b8

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\clockDarkTheme.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\clockDarkTheme.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4288 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4464

Network

  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
    8.1kB
    15
    14
  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
    106 B
    1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\34SFYBWV\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/3696-133-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-134-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-135-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-136-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-137-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-139-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-138-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-140-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

  • memory/3696-141-0x00007FFEF4790000-0x00007FFEF47A0000-memory.dmp

    Filesize

    64KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.