Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    16/11/2023, 09:02

General

  • Target

    Settings.xml

  • Size

    201B

  • MD5

    e10c48bdc89fd8ac2b005662f1aa19ca

  • SHA1

    d544034e40c1c5f9d034fa5f84612f59f02a1b07

  • SHA256

    a1194bfa9ff50242761b6eaea94c5ee283b64bf27c2ffe58497e8ec0fc03ea0a

  • SHA512

    0ecc31bb48d03b2740b25488a4caa7740b72b059768659cf45cedabb925fc6665d284a5e900856bf3569ca24c4f432d417ed154c30289ef87f01b1a931dc5f08

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Settings.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    59672819aa5bacace463f2b8da9ba0fa

    SHA1

    e4974f1663fa5917bb5db7bd4ea3d5ba3808ddfb

    SHA256

    6ae956ec29bbcdc84968d932ce86150e26b0e81ad0180ac426ab8a0d0c41b43b

    SHA512

    c074fd659eb7cbc0b72484a36ad6083ed65548e3116fcedb5d8ffdd930cf6a5f15129c1bb0d3567929665ed686fd26ebc80c2296138afe9cd09b62c91c07ad7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a3e7729cdc3ed91175a43dfb121e417a

    SHA1

    8d9ec72333b80dcd0b51ebe79b568cd9c1599cfb

    SHA256

    f53ccbce005d6b3bee09b8b454daa58b8ac23c305ece66782f6af90b7d7aa3d1

    SHA512

    0f39e1165f4bd2b2c67af3cce87fe3f6f513af4e7238931fcbd55ba11906a2eb7015277d7cb18f90894daa5424c5ad134459914c6fffae65063934431395dfb8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    84880b52aa7cc0f579d0ed352c110c1b

    SHA1

    35beb601758cc8c0211d88bf754feb51eac66a95

    SHA256

    49d130e8ddaaab65981669f230e1ad41b5b762232a521010e8f836431342342c

    SHA512

    e3e15a397c1b3be1d5488f11956e326d35362644deab0ed05eede0ebf7833ecb28fd64ce78db94026881ebe0615b0bf5f1993fbf263c8ef87fced0ba9f517dbb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5862cfb8bf115b26d9c1c60cd8560dd6

    SHA1

    190706fccbc5b6bb427dd8a0804a11864a105c6b

    SHA256

    fa222d48b09a6a626a54287b6559cf20b3241559c7470da843ec11d7e1497bec

    SHA512

    2ee30ddc4a710644297e8a164a0d7305b63c08436f2a370e92803fd6013bb9cc94b3b64f629397ded50a23c46c7d49fa5974b8967be9e72874455ccb5a06a72b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5862cfb8bf115b26d9c1c60cd8560dd6

    SHA1

    190706fccbc5b6bb427dd8a0804a11864a105c6b

    SHA256

    fa222d48b09a6a626a54287b6559cf20b3241559c7470da843ec11d7e1497bec

    SHA512

    2ee30ddc4a710644297e8a164a0d7305b63c08436f2a370e92803fd6013bb9cc94b3b64f629397ded50a23c46c7d49fa5974b8967be9e72874455ccb5a06a72b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    462b562532165cde8627142190553939

    SHA1

    9cc156d8bde7e9285adb8565de344682b07adeeb

    SHA256

    65ba676b9c5f8f44d37d10d347d9b63c3fd971b08429908f70b7734eddaba84b

    SHA512

    81d8812c4157c21f83a2adc0f034f901ceaec9296a7d00d224db75332d272c2b5a7b2c0e9bd7af09a81cfae13b9eec7bfdda38849da5149f99fe00368af4cdad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b3104cd2df1d67245e79459e0187993a

    SHA1

    90fc73db9e96f75a5aa86664acaba79484b66f87

    SHA256

    5aa129bfca1a10562714fd1a1ab2d617ec2ef87e44be6a076bbdeb98f4774b45

    SHA512

    45e75a2086e23a80024f2dd80fbf422833910201ca6984ab13baf6a978e25104a0f7d71be0c9ff657aff7bea8cc30f81761292fc1253866e898e7ea918e850b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3641044a9f56ed577e1a34d2bd888ebe

    SHA1

    ba4f471297d2c6bab46d3769fc78787a549fd2e7

    SHA256

    60e76ab3c7ec309b347867c5b17e6f4cae70e36b6fe1762c34b5d208f3ace84c

    SHA512

    8e3f97ed070c4db7f800db1c0fe9e0f139fec36f67bc00c920007f697e033ff1edabdd83cd8e78ca722560374d811f44adace2a28ea0ef272cec480a021c0d34

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3fd46ba28996110adfd915bd9e037cfe

    SHA1

    974ccd6771a52cc04f4d14d9fb8138ae3c0459b9

    SHA256

    b58c81da2e414c3355239e2fd59d90d3c6a51b9a6f307fe8ff25795c64f64eda

    SHA512

    5c1024b6340a344383db1bdac47d5ded83de519fd0b3e78c46b44064cfdd28a4e36ec87460d55d7b41aadf60075b13fdc07c0db220b7c2a138b98d976e271c2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5acb9a812caf875a98e74182d71f2aae

    SHA1

    8809b23ff222278db75fc83e357dd446195fe64d

    SHA256

    299e50967813fbbc4b7c36bed1d71ca629bf676ace012ba134bd1b41f4cfcbbc

    SHA512

    6808340442d6bde5e6b0b23be3f2171de070f7b93a85ef8cd9ca017b06eeb4396ed2d2a42e017f7a6047e16a38fa1451d6b5d042f0c623f27a372f375f94b097

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a984cee451754a8509de0b4d15105a8b

    SHA1

    6dca7a0eb2dab5c68f79e7e113ce4fe45921d529

    SHA256

    eaa6243fd607af1dbdba2ccf65c60534bf21c5936f15b8834227796d81c4a272

    SHA512

    16a405a538a983c023520cba48f473abc29acfa00717d222643df0818229e3ec0765c671e9c5c281b44021e34aedb120e39e4c27c22685d803ae7a3815747605

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    653c261d75d4546cafc52148ee5fba43

    SHA1

    90950d7cf3906ed9e422a983b7d5af841bb299a0

    SHA256

    cd0959e383ef6639214b6bd797999dc0cb95008bc22f3a598799ec9815fde6b6

    SHA512

    b5a26d06ac57477046f14735b77e80a2fe567397b1b6498937ad6b8afda0c70037b17db321b1c2b643c6fbe0acfbcf3e3be3df698cdf1be9ff85853d09f21d59

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    052109fabd33ab980db7ef3f1fce18ab

    SHA1

    75ee17c9154e00dc45fe32e2825e9b956e8918a3

    SHA256

    c276ea003c154e0cdb433dada2db6bef200fbefeb3d75438a1bc4a2e48fc2316

    SHA512

    9d9ac5f13120ce1782951b32e54f8430f9b68f101b962787a56e29ec09242351896dd0063b351f8fb5c0fa65aaf30e310a8369403afdd1e1a7f4d8a3cf0430c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ef6377bfdad4d494f5059f8ce7a2d173

    SHA1

    aebc7b7344d11e6b04007e8b79d546a63fd98d0d

    SHA256

    37d21cd34baf6bf2e28f5b682b5febde5597372276448bf2eea97bb86636aaeb

    SHA512

    97a5756d535269fee03cc97c7c2b73a55bf3eaed6e4bb5fbb6de08cc7f580b5785999f77634ed50ea5b660dff8e5b06e53bb2fc3c5c2a43269fddf333eae7183

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51022f95a7864bbb283d2735b391a4f9

    SHA1

    9828b51137ccdf7bbebd64624af6955d872d114f

    SHA256

    cf897cedb5ada2d7b1e1a52a6abbf04702b1b4edf9bc52c3bab512fc28df94d9

    SHA512

    ad099e53bd65b0b2be63f5c80fd55e2bc9dd026732238d3d6443267c1e09d4e55a0bf30e5186c6a26dde74c915f713367de3163bc8d022468b4487d21231e04a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dcf8c374d7d61cf1d576d04fd7a39abc

    SHA1

    dfcc676d4842d23cfbe7056ff58cfc146c3c842c

    SHA256

    7c3129aacb0469761c62b91ac9281f61dd624189f35278cf2568c41adcf45438

    SHA512

    2b3a0e132c9d0f083cf307e1c4b4e9fc838db0c566d7939c05f9361a67b4e85e146dd51e220f6dfed622acb884c3a4d6cae3220b9143ec8e6ee580a80b6bd3cb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    95d3783972fd339f04812594d38d2803

    SHA1

    4bbe57cde451758fe0c9eadff93ed8d034df5eac

    SHA256

    5043f28b8d53adef4e8bf6118ceecdb4e62ca7cd9e8e1f006b20816969c73a3f

    SHA512

    355c6d15efea8ab0dcd68583fbaf843e85cb66023b56802d959786bb5c9d5adf5791eb98ebc9b159822236873e098fb990e1324d5bc2f6ab38f33fbf2c69eff7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5226a74ea52a03ba4a81be2821f480f8

    SHA1

    3640cd7eecebf29ebdfc28892eff115bfc82ec61

    SHA256

    54df0e17f1e92fb798a150163c35fc36890246d80a370c7c1059f446ed6ba75f

    SHA512

    bcb5a37245647e9dc6e2aaa5f03f8b36ba57139763d1e4acd5e11df341774543ac2ea7a42c58be85b27cf17108ca70df1ee8bb85c8d2fc954c4a3e4bd0f82c61

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5226a74ea52a03ba4a81be2821f480f8

    SHA1

    3640cd7eecebf29ebdfc28892eff115bfc82ec61

    SHA256

    54df0e17f1e92fb798a150163c35fc36890246d80a370c7c1059f446ed6ba75f

    SHA512

    bcb5a37245647e9dc6e2aaa5f03f8b36ba57139763d1e4acd5e11df341774543ac2ea7a42c58be85b27cf17108ca70df1ee8bb85c8d2fc954c4a3e4bd0f82c61

  • C:\Users\Admin\AppData\Local\Temp\Cab19E9.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar1A79.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf