Resubmissions

06/07/2023, 18:35

230706-w8fqlsdg43 7

06/07/2023, 18:32

230706-w6mfdadg35 7

06/07/2023, 18:27

230706-w34kgsdg32 7

05/07/2023, 09:21

230705-lbqjfabd66 7

05/07/2023, 08:59

230705-kxxdfach7v 7

05/07/2023, 08:41

230705-klwmrscg9y 7

05/07/2023, 07:15

230705-h3aqhscf6z 7

05/07/2023, 07:13

230705-h2e9lsba95 7

05/07/2023, 06:50

230705-hl6fvscf2t 7

Analysis

  • max time kernel
    100s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2023, 08:59

General

  • Target

    ic_content_sticker_location_60_percent_black.xml

  • Size

    1KB

  • MD5

    a3c9e4e574c26a244e4660e3412d803c

  • SHA1

    98c4d769e0efa91892b72887ff5075944b3547a6

  • SHA256

    1b6c02ff1e1e60d73f6b31c1c53faebe6d1f57782e3caf3c4328a65b4929648e

  • SHA512

    f0660665f035131c70589a70955b2bfa8c7c8b9c45053f914bad335be06a2f8c23246c24348e3e469a03ae4449811796e39843a07a275cca1806dfed10df1610

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ic_content_sticker_location_60_percent_black.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1660
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:3012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7f7570fa19e0bafee589c524810354d2

    SHA1

    16f040f963125f13438b40c8116417e25f629d0a

    SHA256

    a93c9461cfceec5b954f9b736e6c79ae82b1953b89f4cf6dc56a2ab91d8aae0b

    SHA512

    9b1909f3f9e304f0ba8bff6a743c2740ac4ceea6e7aba4678b6158820f22fba7afb5e31e7078a0d66d7497d3489af602a3ea9a064a7c806cf056631fcaec9682

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d16c60fa8e6c0fe8726c117e1650dea1

    SHA1

    3d173307755c6128c5ef73381ce64a4cf18cd0e7

    SHA256

    375060eb41684f976e1ccc35e0b60d2810fd15cceab4fecdef98d851a0ad7ef2

    SHA512

    7c1893032420537560323f3d5264afe292dd05a377684d6bab66765e6fee05b74696a9f1664d3d7e3442687faed7e27928904554064e0ffa3c87d698d0043994

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a866b512be32128282e7c851665902de

    SHA1

    516f47128c7db69adf885b1e80049480d786f2a7

    SHA256

    74e1473484879d1cc4e0afaa3d59fea60c66266533f033ad6368ac7c614c8b9b

    SHA512

    523090937577984060448ea4e3956272eb4b9cecf183b7795d3df326e070854b9c2a79b77840732ac578f575791fc0554862a3c12745516cc45a3f824faf9a0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fff8f1943ce41dd4ad50bb3a03fc1d82

    SHA1

    c128ea6ffde912a21f990dd373d9fb55b3aa231b

    SHA256

    718efbd3d97f50021d5e7566e10412a4ba272c1d8d09f53778ff011a995503aa

    SHA512

    d76d7a61bacd39010a121f754a00656e9a359c70fb6681dad060b3ec9364d0b78ce19b3232d121159e443defe7361a012a36a6d9bbfdb30f69ec341e63e41fd8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    14d20c7eee174a16d625c03a7419df66

    SHA1

    0089b44721c6d454d40c880bee0eeeab2b452dde

    SHA256

    229674e0c54f1043f7f964699b5763e10e65d17d087e946a940fb75644c605d7

    SHA512

    7321d330c568f3902b6ff55c473462aff9679aa098d903300bd32dd5e9d599dabcbd54e3dc3a79945abd80914cc88e0dfedb894116bf8fb699985ed005407a1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    491aaf45223881807680f0e45f0ef57c

    SHA1

    f09a2cd4121ba8b4bc53bebba4b4ee662bfe31c2

    SHA256

    3896f945fdcdb5406d680c2ba6d17b277abf5642c23f6a0fccceefcc80ed5cf5

    SHA512

    d9594b841f7666c1beae6db5157aafdb10e6513232b0ebf240946ed4de87c0fbe189a8176d12ac13cb8ba444a7f2de3ae61ce5abb118d9da3dc645dd30d68f1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    beed0b05cd8ca1542e707c6403d5a86a

    SHA1

    e7c9fd1796eaecbf486137e70c1dbb32e19cc2e7

    SHA256

    56f323acd7d536a14b00794a8cfb34d946c47f1241acd5ead5890396670c3dfa

    SHA512

    c2833fa032cfcc0435b95f736c23ce14e49371bc228fc2378e388581eb64a7af9c0a664c30abfc599c5061d5be9992a8ec7db7983dbe3abb370f288e105eed0f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7d3016df2e86258352cac15d38b9035f

    SHA1

    06d81f1ad75d616c56b7a68d60fc7696eed0ea8c

    SHA256

    a0df0789ad4313cb406faa5c1980072f4a70f53448d8e0cc2939ebec62dbf1c6

    SHA512

    a5efaad7a9cdd1f95085fcf869376c66562889c48438c1dca74b8c8a659f7978f80beb45d5d03583c60f04c9a9eca95f914051b2caed946be5941766834af614

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    86ed61adb3547e719dae74592bdd8575

    SHA1

    c1d673603dd9285a0ac10aff697ce9df989d0755

    SHA256

    c465001386f834cfcb3f12f31bb714e1f469c3289ddb34cb51d9b2302264df49

    SHA512

    3ac45e409889e41105266bc64e54e2e2464372c79fb9c61a781c9a7203e8afde042429be96f409fa59a064fcfb1c41fd0aa0f86a2b1df3bc8d52790ed85bcbd9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    115b459c61a9601d7f6a8d773b0772b5

    SHA1

    8bdb6f659f5c56519ac77ca2bd30c91e7bb31fae

    SHA256

    7c6f7ffd0412a9a9729c484ee7406191d6ab5e7f14ee27be6a4e3310b55910ca

    SHA512

    8623023292a22a18995e4945c7b88e588e42ab7e5a9837c2d902620ed8f236b80b5b8da94c36c9d91257575a837a5d5b368eee778d35b00b99d9ec84ae9d81b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4c4b07cad73ebc9f2cdca15132cb06ce

    SHA1

    f956f70e8460e6c4589e37f20edb9b30d6e82d1b

    SHA256

    a6e61759d1a1572801b2cede92f4a76d9700d3bf26f148eb5bd85b7f5e9e4f1d

    SHA512

    a0bb4a0a8457944cf056c1ca941dc6f5d21936424bc841d096490839305fc25a2bd7ffe52179a14cd4d73cf4de5ee87ca9ac8ad57c37a0d3f94018c27626ee39

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    810a0a47f23f153503af08b50d9d37b0

    SHA1

    3e03b6b3364fdff9916cd4ca9e4e60fc923bc9b5

    SHA256

    7c6548dc5bba46c57b685a34d5fb8af474f26224a0a8f212685ba6ceec5e72bc

    SHA512

    e708480ff213a880569211674fd6d3272a7dabb1414acaf0db82e4e6eebed2eb1193f83d1f8ba9592cdeba0efc8766bc4e788a90e0c742a632739f5d58024d04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2d432e425cb07c4ac3886ab75f0b4f84

    SHA1

    1bff43e6d71fbc4a0c4da725c1487c19abe20885

    SHA256

    0851959b1f68aac165496d33829d4ad2abeb11cf5d80df9a119d99d38cf69c1f

    SHA512

    5aa6f083ac0c02f61eca534452df3f9890af8414ad74298b49c0505150611f2e362d0752b0d060bb8e61a92d6d8f56a6d676bb94907f653c42560a1a4992e6b1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CM3TD3CI\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab5C46.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar611B.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AEBHV3H5.txt

    Filesize

    608B

    MD5

    29e78334ef083991c104e4bab6e48023

    SHA1

    550057de01dfca0c4bf00fb66a61c083c9ef6bb7

    SHA256

    48ca7b9cd85b97aca6a9c126a1e73fb2024456596c923eeb58220b3267c40f7f

    SHA512

    239e734b0efaffc11d4c5682637c212744af6c2f4a625bfbabec11cc3ee86d7ced7791b3b4cdfb6964a28e2c93610d473d368e0db64c79182e8edf5287830bad