Analysis

  • max time kernel
    138s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    10/10/2023, 20:23

General

  • Target

    tooslowcutscene1.html

  • Size

    62KB

  • MD5

    3cc473b2376b95be62bba049963a7ec5

  • SHA1

    1dcddf3e99ae9e72bce00879ea85f2e0d1c9ae13

  • SHA256

    88128c5a887ec29da44506a6960164d7d4cdf9bdbde8af0ac19995e0456eb08a

  • SHA512

    e5b9feb979ac4d14156a923b714daca8dd920377fc2b735da1223d976593f78ff733406930494c5e95ab79a2527cd07fe3438af690a45d597e060b3fc6d8f96e

  • SSDEEP

    1536:OueXjVYyE/YqVWmQtu/NwRd86gbcgP2k7jEXm7ZwNm8QF6mYzSsKFgANXjaJA++2:Lt/fVWmQtu/NqUbcgP2k7gXm7ZwNm8QI

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tooslowcutscene1.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    59a66400873526b448163c72f0ad4e71

    SHA1

    ff35e3a57c20260af94ae888f22e89385f57871e

    SHA256

    3c36bc6fd88b46178bf3830e38ab6a88ddcbffe008cb105fb1da67edec576696

    SHA512

    b34be21b3c064ce0175d007e163ebbee5e27e6c226e5ae06299335c54fc0c165e08cdcb351e9dcb86915c9c25cc89f876f2b97739cdf809eae351e8fc4858576

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7bd3cfcca9f885004d39bbf5569b1a67

    SHA1

    409142ac4434bc399e2c7a1bcd08f7b7356bbf58

    SHA256

    8d283d04230f84387b27c7729a595d6c76b80930c4720f40a9bd4b6978544197

    SHA512

    e8c35b3d92af9dd763e955a876c1e14f96d0bf77b6b55ce7d49156b31f519d13a04cac01fe11b60582864ac2b80008e505c05629b14ac1c9318a1c28e751c39f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2fd7c37372fe29e6b9c1094131c861e3

    SHA1

    8c49e5571ad6fbeb7c7a02c04e4f769455ef9102

    SHA256

    a50d3f056f56f0de92e4751a0e695f250fb5fb1bee3bcf3a40cce18d2b2769d7

    SHA512

    13da5edf3b952b0938acb321b63e426b893df8b0c25371e93abba42ae4631b999b28950d56d3ae36d99af0c6ea4e13cfd2a6a3302dc5cee57814d04a35dcf33a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    360a0faf74b1d19271286a70703529ad

    SHA1

    0e837e6abddc5d158ac8e53f558ce5031edff25a

    SHA256

    70d0182e98cfb1e20e00c075964b570ff2fdc546684cc3f8b8d8afbf84ce3d0f

    SHA512

    d9e5fd8a1d8a75ec120b44b51cee46fbe2d94ac2dd73e0c64df95af9742fc2530f2185d1a7475d7715a4f3930a604b06eeb28619f12e693f03ca3005d01a513e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4477e09fc8b7b6f8cb8ee1d28b3229a2

    SHA1

    dcb4fa05405747d39c35f7d78f309bc6f0da1604

    SHA256

    b50b692ec05105d1f1db061d28f2f17715cfdc0b65ea4dc72f7c1764b079cd49

    SHA512

    1043ab75c04fabbfa97aa7d1f654c65d71fa67e2e990ec9c8d0caa8523330876795be81f46014b7bd37d2fb297dd0e2d43d58d1d284431d1621c56a809e53ef3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bda4edd73ec0eb7f64e89519946f0a19

    SHA1

    5a9f0e7d315d662ae038878c62843e468d5305d9

    SHA256

    f554f059ce6fd40809603fb1c623515ea57c7e7f15d0c3a2545413ad216150cb

    SHA512

    56d784a82638007c20642a1627856e8d9bf07f25416aa3f7d51585543aa99c5e393a18dcce0b7d0aae4354325be116fd3d0c783ba782d3f141cb79d24888b98a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4e68b7c63b00e2843feb2c6c91df2424

    SHA1

    a17de2a3b90ac348ecc75e06eb4eb4052a2bffab

    SHA256

    8823ec026284568bb8c6fe9610ad04d2ac59c7bb47ea1a2de8afc0feecb063fb

    SHA512

    613c20cbee274424a15994d3b357bea4f9f306d5b53f03988a32003e8cca838427d64129d8750437b269645ff1104e0754facc1e333ed15f120fb4242752c6a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b2e206d0847c53ef91eb8a9403f16054

    SHA1

    960317bb355e35da2b2e6c9187febf9ebf8ab68f

    SHA256

    d3a178e2e06aafa1c70d19cb9bedceb2cd1755b0536ee33a3ed68f7816deb88b

    SHA512

    3acd4f8471794486bd9365f5064071d6f64987ff67a4ad4fb87612a2cb5bedf9e07228fb3548311c31c00d106e860c6fae7e484faa1df53883297652ef14c16d

  • C:\Users\Admin\AppData\Local\Temp\Cab8E10.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar8EAF.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf