Analysis

  • max time kernel
    134s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    26-08-2023 22:04

General

  • Target

    callout_11_shadow.xml

  • Size

    2KB

  • MD5

    a43eaf2037b2a882b41912e5bf68e3f4

  • SHA1

    b1b73e482269c1c5370f7a6e4ab5a3b47d2c6373

  • SHA256

    354cbc8433a0fb42c500fa7039f4c7254db20eb9f589f8866846f142c45d94c2

  • SHA512

    5aa4640b5cc83376ae6f61c80bfe6e1aedd2e6eec2337f9478f4a5544cba6b1a09fd46cb4c93a8313d4843a7c42b498f610bf51ca90d476819088e8fd52b2c69

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\callout_11_shadow.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7722736d2ca91dbc62968a4bee428f13

    SHA1

    eca856ee4165ed04ebf488409dbe5a0fad00af23

    SHA256

    afab9e5c42a0f98e7a41a1684ace5b8c8542fb0ae9ccccf4396e6c4e176cab94

    SHA512

    4aaac4c0008802b6d416166acf9619b7ff3e2b38f5fdf5d4d39e628278aeab1c567c957b9541c534b11311c566ec1ca73c6e65ffa48ef05499243872ece515d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    aa7d32deeda250bf32b190368e7b544d

    SHA1

    45a4add66e751398bf3252fba3b6edf3e3edca50

    SHA256

    7c25962418da10eff248c87d0e2ec78ba7cab2797ba90823856d6f9be874f31f

    SHA512

    0c9540a788abc67ed82581df1ff0f77f22dbae1a0076aa38952e2ea9a8a26c211683a030d8284947f5a6155b237af77036b381a9efe4e5d58f29073a8784587d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f7d2b8550cbe6d10cef2ddd38702b522

    SHA1

    98863e632121c2621c85e0fb2c808672c840a19c

    SHA256

    6280e8b64fff0290baa8c60daf3a58b064f0d2b9e8d069689e8a9449e9b4507c

    SHA512

    16f4e7245c0aeebe778d369d184dc8b04e7d6a07368776174b3f1fb33dccce6f19c8018b85f7e2fa1d14c3bf8aec5d06abce817c2c3e771bdbf75091a316d617

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    672b2473247a35fb6e4de69d3a11f53a

    SHA1

    8847a38dd53149ece751b1777faa60cc079fa080

    SHA256

    7fe6347fa2498c8f40bf62b4ff7d9c3bb35643c7b99e2f247652503b7f958ff5

    SHA512

    91433fc035c326bc2a0b6926efbe6cd446b2a3be9efdba4d1d2b09df67ccb8f78a50abb704448f09717b000754bfaf8f3118249ccb3fe74efc42d98693b90461

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    454280e69ecb999204c34c934b3c40ae

    SHA1

    fc387f34a7716462824ad863a0a35708ce18fbf6

    SHA256

    7b54351c9578ec7132203fd4f9c22a990b560cac69ef3568c8488286185d1c2b

    SHA512

    f1096b0ef8b0db546ee25585d1f01e7e9bec0f2249334f17130f82ef55051a3a9fac13aa122cd771bc4a3dec79d03b6f1177a932195a32ad0cfa40cd865ea1e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    69d63a1f3b71ebe828f586389fc03364

    SHA1

    cf00fe5270a0a56f6bbc557656b6a12db15aabfe

    SHA256

    f88ea97d71b93357b750cb7743c880c88a8cfb203823e2a7ec6f0bd230e07687

    SHA512

    3d56fe36f178b9bd62b32f5bb962705ce0c7cdad706a1ba2e0cd40d4d86528d0b42f2b770ef11d47d14e422a4460370d4085f306b4ca1fa5ffe3826aaaa351b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    de7f971a9b62f9da210eb1038377c27f

    SHA1

    2ebe1afdbd3396c1dc6390086a31632e92327ef0

    SHA256

    16d9f36116d47f307a534263f4cb0383f4fd1eb9f25fb131840a9209e5da0cfb

    SHA512

    c3ee0a683da11427b8aae56eec5e42af17b5317ef517da26df4d9488ac9c67f4448b8aad4c622d66aec461aa2c03f12e152c5a6febf6769ac47453a738f5e069

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    af7bcec1bb8f1798cdd8dbd24486a50d

    SHA1

    f170e3daa17ff31b2b5d2216af775de0692fd358

    SHA256

    1831b06eabda1a7a8de6c775a0a54d9c25c9831f7e030db141ce923a192e76a2

    SHA512

    265029e9bb721149a1ec888fa18038a4aff20247b65fad2cfab84c986c1d19ea0bd628bb206ee42d09130065903a9be6594ba13ecb34c547484e44821e3cc30d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7617104999bcacf9196b0bc89b3abda6

    SHA1

    f132c70f249f744ba55ba9875112ee55e5ac2c06

    SHA256

    f4fc7c6c3f05c9e660f5df280ca6d6d233b6354632c86f491eb79acf02075d65

    SHA512

    f4435a5ea0df8bee263954163db79c28374e8baabdb8d210820827ab496067f3cd63841b06936ecf9a36862c470f4fd41e59102a9154aeb7a6361e6b56687a1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d5a9bc3575c10d582c7d03caa78a38e8

    SHA1

    e1a14173f072761915d7dafc6ce55ef41a642e44

    SHA256

    03fa7d378f7601d624b5584756820413c477df8f2590252d7bb3188c3bc88992

    SHA512

    2b58991c00ce971158edb2e1bcb36f4f786d902142a28214c0ce9ef9e934ef7d9d4088e747ced2a7bc8596b3048f3d76535673b0474c5419028838dbce531a7d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    50925bed76f64dc4f1a84ea7668568fc

    SHA1

    b06f3ddbd4cbb8bbd3d363ad635ca627d9b2b3a5

    SHA256

    fc15cbc3ebeb285d7c234e55e0339a25a3059a43a531efcf1e075be553d94266

    SHA512

    28194e7f8f6ab8fa4d033bedda250064095607ca8fd772129161d499210165dc6ca543630d1c0da46437734459adaf0565a350472b09bbba89da78cc1fe7c41c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    85f681efaed8533981a80b02bbcd562d

    SHA1

    f2a95f1db2205d065b0a2e4d9935fd229e99995d

    SHA256

    a8c67837fdcc50d145634c8895740dd2d561429a5fb96b32584e6ccf49ba08d9

    SHA512

    183ea1f72b835bc1728399f168a857a56b2721ac32a0f0045d1bdc7c12325f9a530bc3f7025440f2e7c9e6e76092291a90c95ae2841b2628e0781af6f7360c78

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f610d1a1f55e4d5cb665aed959af1963

    SHA1

    e7fb213e46d0deac289fcbd1137ace1c958e284e

    SHA256

    bfb50ef33513f4bf7bef37d290d5c2b724b5c76a9c5b33869ea975b9b70e93b2

    SHA512

    2c36f4acd3e013e558c16817394175f40fd32b1ca2606dc210f7113baa67e71475be6f67ea7302218ee3bdb81efc810481507de1371c7adee9aaf4895b0e98e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9b8fafa5b2c1dca58d6891fc798f1891

    SHA1

    ebce016d07d2b673ab9334c5da5387d799616fee

    SHA256

    0ab0160329af9a72b53d5427a51b9fcf5d6eeb8c06388276263fe154033b48ce

    SHA512

    ef2f1b70c31556bb0b136a64c86498122ab81679222c565057f5f2fddf76806a6baee4caab9c38cb28b32ea26e1d805e7b48dec8ff9257055051a70f96e1a6cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c2ef8ac6cb7218e87276b3e846137126

    SHA1

    2f0ad116f7f5a6012289c3bc3d12981357c1acca

    SHA256

    70dfc29f843075e9045fb53ad973ce1f04645b1192f3a542b1b99affd2b70631

    SHA512

    2db0f07de490474f551f589aeb9a5828143eec369f0b7c1aa326dc9f5ae62d24b2d76589b38a65650af0862981feed1334520ffe56bbf3f14ae5d3fbb61430a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f678873258e2b04730a9dcb55517319b

    SHA1

    7108e461e96d16e886e92f659b9cb27a5919979b

    SHA256

    f9479bcf58bd8f34209fb5ca65b4ba5f2df12e7a27673ea526c7d5775c7c9b50

    SHA512

    2bf5bb182b4fa222349e44d2087514e11c574155b22a16c6953a5c4db33a78db4bd6ff447c09a7b82823880a70affba4e1a4fdd1d04aea34982ee549d55b5caf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ece109838cabcd2a719aa19c4bf47b3b

    SHA1

    5d748b11e3543b151c4a65f7a5e25586e3f4d47d

    SHA256

    6a4cf8ec2e68c601039ca58799801ebe54f41d44b7053e27abd039a1fb969335

    SHA512

    31753166f8a3c82bba0ba5e2f633e3618a4a9af6db52eecb4926982dafb39023d0245f0858d775e36af55b97eac06930aa53f033ab83e82dc0078c6202bb4a20

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9a4f0d341a1a632ab47acf1548854abc

    SHA1

    d77b009801a3a3a0f015c86c1e6a29e034929712

    SHA256

    6586a21dc27a666e64043608f517cac76b1de299c85205bcf0ae7e0c73f3e975

    SHA512

    bd300f1b65f926e3bc76f87bf73fe7b415a95567e25011dba08c4aabeba8d96842b751fd3ea6fbd579d222773edcd86f9e99dd8a6716193ec95135af3eb93916

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ec685d97dced45315aa0faa7e98582ba

    SHA1

    c804102459b7afc7c0849bac30c710d311f8c2ac

    SHA256

    c8c8ab446ecd83e77fa6bea7005c79b4dd6a53fb8976740550bcc45c869f2e26

    SHA512

    a17d25451461c6c17e2d6567bed623a67b98768e4900021081ce1b8b5d36f673826f5a7ae6a9b3d54d308b2ce0ee5448ca3ec965e3da7f630866b96e89855eac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    135e98bb4846ba14b1e851875027d217

    SHA1

    ed1ae9fda25b75ff34bb92ae4e3d5565719823f5

    SHA256

    00816d126da8a2ecbfea8f9a5bc987adb6465491879844c327d6b02c8b5869b6

    SHA512

    a1b9253780ccb862e5a16fb57e050b5b76271ff67193199e6a06ea7d520708c85dd77a29a21ac3e76d382a25555036ad13b31552bfb6cbdd20f31129952b0fe2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    66e7e6d40676e960f4c361e232af2ea3

    SHA1

    b0a17f65a9d4cefdd9f66be7b22546e0a519a6b6

    SHA256

    30c9e066c95a0e98e75811c7f3523d334b0d2bb9c5253a28000b14ee949c16fc

    SHA512

    a2c873f4dba161b396c919d77477ef699300c9bd39e2fc6e678cae3c457430b01658b19bf2befc2575fda764a5126acfffaf41c4ced1453bf537c939a9c0b07e

  • C:\Users\Admin\AppData\Local\Temp\Cab9697.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar97B7.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf