Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 20:23

General

  • Target

    can-can.html

  • Size

    62KB

  • MD5

    bfcef5edc42aa6b1564f2d6ab1e0488e

  • SHA1

    d1234272436fca051504cd1bc7cc19ed5b2eec4f

  • SHA256

    b2b35721a6aa99dbf5afaa1948cc27170efd6c700f235d1c864f5ba421c900fb

  • SHA512

    7c4b26dd388ad764661ecb1fd3df31a3a863dd9c09b97bb14bd75feae0b9da834881eeab9043ed73d05d417d1d1420d21ac39c0912e869115836a07bf1aaa2c7

  • SSDEEP

    1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++1:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QL

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\can-can.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a000b007099719011fa323fa13514c3f

    SHA1

    4ccdb4cc08f7c4c4b525cb66ba38e22a32ce31d3

    SHA256

    eb94ec6eccd42d4562eb154776babdb7c38dfce16484c98d75394d381f50f389

    SHA512

    b20f04adc5646d35ccb1b08dff8f4c6563b306cf642109e70f576b83a89f5678b43fa59a4905d5dcc1c631afe2c488f102a2d7676a96044c35267df34e1bba89

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e9638176cfe3e471e1cb60c97fb2b7be

    SHA1

    46c0af9b9d8b12b4ddc4364eac7059dc7f89b8df

    SHA256

    0607f043c2a692135b2202e9e631c894cc3808065be7100c5bc8fb7ed3c1b036

    SHA512

    d59e5e7105cfa2d414a89f16aa6dbb71493c456feb87d043c56041df61e815694d743f9c232d3bdcc86c2a5ab7608e32d7aea6a45111fe91079cff17f280baf5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cd951eeea66aee34486e81ca0422aaea

    SHA1

    782569dab328574eccda457f2410c5962836769d

    SHA256

    d3f06d7b14883e39ffbad9acf2123560f7fc02d72ac026028c90b9feefbe5bca

    SHA512

    5ac6972e7f885cc62bf4c371c7e34e6bc95afc82fbb495a7a7838cf7a3424706627c39b3147c212d6bf30ca4fdce94bf7891389d5bed046cca6d87910bcd3478

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d16eb465fe604c89fd27516477ee4ac7

    SHA1

    8c05e70ca2a79358c0b0e2cf3c1061720d827c70

    SHA256

    2c04f27a97b2d08bb7f4be4669e1be6314ca8a615acf2ebb4197779ccf369ac1

    SHA512

    c7505546e690632ca25dc6c26e67390e0ff560408db23dfad6f318d95be24c56a95d810325e27b6698449c3e9b951ff60212f46319f6ee2fd8b2efc21429959e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5098f9af2b56228776101d10af2e239d

    SHA1

    18dd9e41f44bcf71098915ed70559e1d0b651285

    SHA256

    33cac8d439447de885155bd39e0cb1ff31b07a013e0557393e1cc68111337509

    SHA512

    1753aadde37d76e3f7768a8747e591e0b41db416f63f3fa10a98cf9317da59a84f001b2c45c72cab2a0cce5453e62943523ac1616ff0a89f8b2e2a44153cadf0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a768b01a1cb0ad3316c710be42db76b6

    SHA1

    57f9c73410a5d9a59cfd1f767b37cb8e0c683a3f

    SHA256

    3d638026c36d0c97d688b31d1d46f21517e4b97e822b953be5fceb260726da8b

    SHA512

    5d63332f1153db68143ba6e23e7baa4486de7544959a0ae1337ce990b2db84dcbcc332c375bd222efa2032f15643b9f837799894e82601c6f9b9dd37660e6d60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    840b5c797251484b7a5492a9b790586e

    SHA1

    5b141de00bf01c5d47c0c8b747aa499205ade100

    SHA256

    9a713c8001af35f67f0bc49930f8398f553943f9b6a32f5627298ef44aa83b3f

    SHA512

    bad72623cf8e35d0ed7794cdb1ef1da7bfbe5395e5d0769b72db71dff83ee37258903becf91cd5193c89fa1c565aab862939bd08c7e5e6642fe8225571ff4069

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f8db71946a435047b32790b2010b8343

    SHA1

    a52cf368881d2ae0ac4c18485096f2800645eea1

    SHA256

    3e8d0b55c1c353de86eae6ef9adbcb7371d8579b9178bcc9c7098ca74dc0f821

    SHA512

    72935388b74488df7366c09eb4fb0aeda2e71a9592f08add69a1eb9e2c036cf2abe1b40a9d559896aa3cb7a1fe4a01701a781b3b0dd833d2c19a6cbac5ae7f40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    286b54258cbd8570921303dbbd9fd11f

    SHA1

    85cc0a4683a6d89ebacd88bc6ba66113b3918c5f

    SHA256

    710e88f102b405a8e91fb88ea407a0278cb01b10d27f1120d461525a6a28cdd1

    SHA512

    e7459f19ac881896eeec856a67c878fc4a00fd2969af9509b0f969592a99624f7961ca476f255903d499be4b11b330c50a44393ad94fe380d986591abd33a60f

  • C:\Users\Admin\AppData\Local\Temp\Cab8643.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar8655.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf