Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2023, 22:18

General

  • Target

    print.html

  • Size

    656KB

  • MD5

    1bb62d6ab729a6efe49fdbdbd4a68a04

  • SHA1

    9397ad830dc1513732124135c10462e6828af823

  • SHA256

    192bd0a72aa1cab448d6e5906c771e019ceb44f60fe78e3164a7889b8efc0e8d

  • SHA512

    a365284077df824ab3b4108e38fb2b768223394d720a2ceaec3a497fa95b2f3e0d2e4cbdbfebeb3d58e40b6c2173a5e9993e91d62679dab2ca11427c8367cf70

  • SSDEEP

    6144:LyQS2iCbkFV+BwpTZTRUlhWWjYTBxP/PpdX/Rbb5HxwrQljV0MNE/i6Oiv7ZvDpE:q2GFV+BvWDX/JrlBREv7ZvD1qEV8RBx

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\print.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e509e84688c8e215a8b32667e688f95d

      SHA1

      5878208cce2de764133fc71a64af15ca6c20e05e

      SHA256

      b285ffa30097b737c59b33016b0b46a9463343ad21eae2287f2c2e88dc970402

      SHA512

      9c82cd2494735274284f1f820432b067c390e1dfa064e5e3bb251ae209adbb8b0690f75364dea9e55996eeee14fd33c84755bfc37058223ef5b61d2b8c3ed05a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d3c529eb376e29c98340608da405585f

      SHA1

      948c30c43171d2e0e0f95b1aa3866081faa8c276

      SHA256

      ae5557bda8ef3da2447ae11fb5da122f78b85ffa4451d086edf3448653a4b591

      SHA512

      ce17896dcc47fe2fd8392ba4ce23309ed768f326804825243ce692377bb0b4d6bcc7b26ddd60575b2786289851a835b3019440fd9667cf7ec66271afef634ea4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      86a3779b98538b9286cc579f6c02c75c

      SHA1

      2fc4be418dba082239e941333ee99ab0eb36f1bf

      SHA256

      7d0e26871cf1584107b36af1dc901f3640253f78ac6d0884e83cb6dac7517814

      SHA512

      ebd028bf876675733249b7c180d09d0eae629de9c2faa149026264542f8d98b433a4c05e20041e75dae460e7438251538da4e8a0eae4af1775933544f04824f7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      21a5d4751dd205d2ae419ce01891d9e3

      SHA1

      2e691264e5d208e80e84c4d40428550787a73b35

      SHA256

      ba00523c0b481f0bcb3fb3bd78c98b85661c44e07eabcf510bdb9f091f5d821d

      SHA512

      eb48743f86c8126d94de73f396f498f11e3c7dbcb000f5694ac2d70ca4234d3b0b98806844d3ad8b284379f55278da0ef9400b6201882eefa70d06f9ca19c273

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      db388ee5ccd967d8baa53f425221b62b

      SHA1

      d4ae5fdfde9b6b6a3e37bf3b8334b39503a29616

      SHA256

      05e4077c62c7199de7210f041e7f085a8ade82f0ff85a8595ecc24577ce31591

      SHA512

      900da67482049cc38d409fe1547a39d8c25b1cf4bc0b46de82e1ca34f2ee34cbc39700647e4d6eb739e11e57a69797d46c2c9cc75d1a549d7a1bb5e29e019877

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9adae766a60e09f935a8b00774cfa027

      SHA1

      efa1af4d4ecffc1dd9c68f4416200080e925dc40

      SHA256

      092a28bf70f11ae460e3513bd5823efcb0212d7b7ff98f18ae0688f57a63f449

      SHA512

      eb8d99e3de0185bef938415cee1a561e181f420b51dc94c8e0b7a9d91a754a7a62d2cf21dad16fd41fafbb94ecaa124562a1d17943de84b02fe0147c7a96052e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2d9b57c57be74ef601867f2242e28353

      SHA1

      0e6be286f764543bfbce5724b72fdaa2f24aee19

      SHA256

      e7b478b821d465c9980e48bcf9e85cf3e75f095659bfc14cc1af2c48ea802e88

      SHA512

      ff0dc37426e6d72e1841a670f23472dbca3c4c371e5f723dce56011bac2d3ec694ade7b66e06c296e3dc8c3e7f4b1c0fb84185a00e3555c9e9cbbdf3446e7791

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      75b6677940313d6f074da9de57b8acb2

      SHA1

      89d25804b87711caf2aa327535e83664a86be34c

      SHA256

      c49107b38d5187c3c996797a3d27b06fb78d7465dfbe5936e7fe9755880afa78

      SHA512

      09cbf1c7efe42023e3012c243e0085da25772a188e025f9c146739c6ad084cbbc6800819a56880262f6dbe34541e3ab7b10e969c2a608a7028c18bc394f17bac

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      df664908e2418f219abe2851e3c647a3

      SHA1

      50326bba81785dd088717c0a2151c3205baee620

      SHA256

      c2b95e089fd3fc1ead173de9d6fa275e2eea1c025b6610b0020265733519cced

      SHA512

      aeb1a870a58e8f211bee084b644e9cb4f326e2d612e79d5e9b17345e0288005ce6fdc08063d7b3378e2a6d66c245e051c52cb21c7a2cd6160accbdc4a399bbb3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      79f2f802218cb4a85d1913975e69eb56

      SHA1

      0b5142db17400bba7be070d47554ccf6089f440d

      SHA256

      317eb6606737d241630adce60cff86f69c4724c851c14a46fc0ff8538d604b58

      SHA512

      886651a1dfe6a1040e1a0819aabe7d8ce6f7612c42a24c87a4bcdf5f5b0d4c91001f790cf0961a90e1777e40e7f129a9ad00236ed94f892ef87e3c56f3ede18b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      92b2f600bc7f6040871c82d3280cae2b

      SHA1

      a287ed8c1c33d2c98f2f2c239a3f1464a57fb450

      SHA256

      72704adf04693814203d938265c72740a58c5fe7a6b1de3e429bbe7ac01381c4

      SHA512

      955b26bc16986e1d1b3907ddfa792ddd5713711306649676dab85807e87f5db5f36ed1b820e7f0bb487c58abba3173adcbe4149393b9c55d4ade3f56c98ddf9d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      57329ce715303dce4711a3af00df8dc6

      SHA1

      cd63a500aaca59c6cf51cbb6309c3ddeb97e3f75

      SHA256

      54252c2e605d23a3893442c19c47a9054861957248c97809f8c084e990e92404

      SHA512

      98e0991565786fae851d0a893173df9dc0353739047241f5e070c6dbc21db23dc7f4c6b262a5b235033de6181906235baa5f2c068021f9b1eec3fa04229aca01

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      40bf5b06072bc6d3535bec1093b1f633

      SHA1

      a0b7dced6618e6f54c68b3430e578cd3fcc25913

      SHA256

      de5ef6e21a4a73b0c5d2e3cd07242a89640ce9212189abef553203c17845cc69

      SHA512

      dba8ecd545185db92196601c5aef035217f690ad0ccff61f033dff24e13f95b9f07d08059d4efa44cfe685fcba8065e60425ca98feb79e9690f1fa8a3bd4e6e9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7edb8537d1f891ac48da92f769ea655d

      SHA1

      4b76333004c6049cef66cf921bbf38956bb41c78

      SHA256

      c0b60ed4b1a97fc02869ee9417547d9471bd23092932ee756fce0cc34f7cfa6c

      SHA512

      2685125b38033964a1c8d7e9c5e47517b66adf227d287ac234de0e389af551f7211a05fbdf8ca5abff217ec04250196850c6c1347d532bbd92f3f42371f53ddb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8fc24422a363f1a9529e111d1be3b419

      SHA1

      9ce9ff43b1278bf993268c94acc11c8e32ae694a

      SHA256

      36bab3c17bbf35519881e5ddb44ac4cef105d8d3b5896d647953a49996bf8ccc

      SHA512

      541c7b6e2fff72a37cacd241995d028fcb5457836a158087632fa964f0c3a648175d94ef3fa788af17049ec9c9409a3037e9ab7f39560fa395d098c3c7215ee9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8a85fed83d4cc4a42bca7cf93375098a

      SHA1

      396a6062b4a2a504a9d907b1b862bacd13f10b83

      SHA256

      66f309c0a5adbae94161a2ee24c309012e35a4c85c8497fe1085f84f23155d0f

      SHA512

      4188e6af53f36ea3f45421fe3507c7a695a7f69629b185cb94fc2e9d92665ea0bb66a2151062608e26c923b7baf15c08a9925f316f6f55a23a6d3ca9268dddb8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5fcdd3bec0d12106c2b7959b6dbc75ad

      SHA1

      924bb45f595f943d141422ae708c24d224ae1321

      SHA256

      7f213719f957102e740a214b5292e5ea4621adef0ef588ad316fed31f90a10fd

      SHA512

      c83ff787b3938c9a523b0da39d73da5aa1180b0e62637091b2c5028d4eef53025d4753d5c357048e197c1212e5e74ccb3dd461b7a9147183306660e5bec94642

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d7b9f50b24733fd322af5c8a9f598c38

      SHA1

      cbefbe0cad110f1e7c241cfd2b2737d6d1564785

      SHA256

      7c26d72daa3b62012178a3fcd09def1556ad703f8f455497cd06e552ab078dfc

      SHA512

      15a390919607f80955ae2ed75d755a05705aa0a3a97859a8520d30563141e2b339dfc14a78a72973ec8b4f3b2220ac08d33d549e629037c4e091553a09318904

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f73374ed6d62eec4df0ad9f9989be236

      SHA1

      090433d0ada853675d8d70cddc95ac274b98b605

      SHA256

      1c4763248a99530b0689455653c66cc6fe9dc663696b6918f198727b980a0b49

      SHA512

      73daf7e3c5b7710e0196ae74b7e40d3500d7f972823bb4a30dd046547dcea99aa172b6b1e0e148b7c2cc7712af8d57c80d8c430ca91b82f430fcfc623ea8a7b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      373ad253dea3e5fb1959a77d08fd94f2

      SHA1

      500a43cf32db5e9cea9f0dc57fec710a218a94de

      SHA256

      ae2b3b6d54e502cd919c650075847a6d04850ba0d23ced3fecf66b3faccd6ebb

      SHA512

      7810cc013ff5387211d4205ae827526e9454867596ea01d7f24516c910416502f5ede07bd12f49f8ca55bb5fc9bedf87b769b3db712ef64a12025db05a026353

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      457ac7eec9eeb0ce6dcf80ffcf62c3e9

      SHA1

      4f97aee384f48483676e70dec2627d3431d8a4e4

      SHA256

      e5b03de2538739e7e21110c79440452f804d38c4e1fb387699b7e6c9830304bc

      SHA512

      a79234ab8bc95f20cbbb72657d9694080dbdc80f638bee5c753ebac574d60e016b39c5bdd787cbd5d29c20c09f0754d3fde290c2439def7822ea4f96cc88d3b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      24019e0bc9e1e3ecde7aed58a42036d8

      SHA1

      f6b2baf2dec1f626e71a2f8d689d3e41876738fb

      SHA256

      d37cd409cc5da674a6f52a31498237d3d773437abc82ae118288bf0195232e64

      SHA512

      8b7a89ec6769208116b1363ea310a318111ff42461413277638d41ad3fff537b89723839c5818c334f5d59756a8aed92bd9d545b92c74b6877df8031af8609e6

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MQDFJ88W\MathJax[1].js

      Filesize

      61KB

      MD5

      49565b9ce89c64da075a5a39969b366e

      SHA1

      30fedc6c732ef68bff3ef42016c7610d70a00289

      SHA256

      48344fd55558bbeb600062a175d052979f9ece87c7299788f8ecf16a46c87bf6

      SHA512

      b4e6afe70d4e8efb1227378f46db76b903c5c01a07b75559714abc97c9e6e76f382c4284f45489050af2ccc0731f16393f4cd174da847292c8455605360bb58f

    • C:\Users\Admin\AppData\Local\Temp\C3ZWWCRM.htm

      Filesize

      681KB

      MD5

      6a1a388107dc730e8aa6145b8f630aba

      SHA1

      b4f59fc489812e1bd2ebd199c29e72b696db188b

      SHA256

      280dfb292648f2540b949bb568a128350a12d4ded8875e6a0d78eb855f038adc

      SHA512

      d4e2576247294375e5ca320c9b6d01c217ba8bff45fbc9f4e566d8c278e3991342d7de671099c4f190e539283f0430349efbd8f3a3882a15820e814184dbac30

    • C:\Users\Admin\AppData\Local\Temp\Cab8882.tmp

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Users\Admin\AppData\Local\Temp\Tar89CE.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf