Analysis

  • max time kernel
    83s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:28

General

  • Target

    75180d8a4ebd1ee0c420f98ce51fbb66.html

  • Size

    57KB

  • MD5

    75180d8a4ebd1ee0c420f98ce51fbb66

  • SHA1

    12a8695510541924f58f9bbe535bdcf16021810b

  • SHA256

    dcb7c2babf04ccfd767278fb6dd64958093c6660b0a288397a01a14b4ab46550

  • SHA512

    ee08fd4f5e83d3c725c05887a888b10af1b92b0aa10d41e1dd390de0bce8d10436cf0bcfe40324c563309e93aeca5ec38c90a9a780c12e4e88a2141f86f994dd

  • SSDEEP

    1536:gQZBCCOdm0IxCKfoXfLfc8fqfufhfsf58f7f+fQfHfjfff/fMfwfZfcflf2fDfmJ:gk2k0IxUjbymJESTmo/7nHkYhkd+rejF

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75180d8a4ebd1ee0c420f98ce51fbb66.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3428 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    1d7f25dc2d6699e79619c31ff8908f6c

    SHA1

    de3c1be6c3f3e7f6eadbe715ae575794e5bf1221

    SHA256

    845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e

    SHA512

    7a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    bb42b4fdd6bc56ed5892f05932e967fe

    SHA1

    1f9ea19acb1b9962f661d0baae5d47d3a6bf2ba9

    SHA256

    6b9ba5e0964f1c3590c1ec23c83fb998e3353869c133a6a00af791a094b0f2ee

    SHA512

    efdf262dc49136df50d9b5fe1aef1989bd72ea791ea67d8dea18f5e968c6957e7a90addf2750f69ad1e8d27c637048ff33c1dd0babd38fe7871b3ba907022b28

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\wx7tnv0\imagestore.dat
    Filesize

    1KB

    MD5

    85484d5a627dc06c903c48f9e7e3a2e5

    SHA1

    b0e56c6bf88c3dc157b5e9d160e572c05638adf1

    SHA256

    0bcefe1a3db75e64eb52a632e5c4aa8bf7109f7acf6984eefe52db2a7071470d

    SHA512

    862bbb077090974ad0046f59a3f66e5d049494327302002151622bd5540acbb46b7299eba91cd419994c3b9f06c8b5cf5b4ab5c4f6af0967e4389f466c098d66

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L3T8W3B4\favicon[1].ico
    Filesize

    2KB

    MD5

    cb546f0ce2ca2505cbc9088d8a4592e5

    SHA1

    d87b70b1a34f4313d085de80da3aa4e8845af904

    SHA256

    0c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb

    SHA512

    b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L3T8W3B4\jquery.emojipicker[1].css
    Filesize

    18KB

    MD5

    13df51261863c362f5069d24f9d3cbab

    SHA1

    3a6a8948514aac9ae6528e22955ec047d9c2eb32

    SHA256

    fd7e31503e9caff128415b2745022938ba6ccb929e1f494fd1b8d7777793cb7e

    SHA512

    d48f2f33e6ac4801614049f7d9009ad18d58134b3fb8974c4cf6fe109ea82949407e2b0a4ed488426aa117a501f71ac1c6ed19941e5cc098a9058fe2e965c267

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8F18HYR\js-loader[1].js
    Filesize

    650B

    MD5

    ea5a5798612df63ab0532174aaf62634

    SHA1

    0f4713eef39ab07510d3703ef201885475ef0b42

    SHA256

    ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31

    SHA512

    8cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M8F18HYR\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\layout[1].css
    Filesize

    42KB

    MD5

    e57c81f3a17073a78a7c3c865f74f89a

    SHA1

    587d7c955432f1e5a87460ecbf9086ae2589346f

    SHA256

    e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda

    SHA512

    630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\recaptcha__en[1].js
    Filesize

    481KB

    MD5

    2b4a2c0d107bc671d4b39568a47aad66

    SHA1

    779b0775413e557f972fb43d07c4e1a09d2dbf01

    SHA256

    cccbd316b2e050d41ebf62c8c613d5bfae33cd43104ac3b772c9e10950a3dbd2

    SHA512

    26d41601eabd090a6f6fb2e99d270f1631e2a4ecbade927705cc1ade3495757b097f0832a8a1f915688fb6072322b10071c93bf81d4304863ed53ec41c71fbd6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\Rockwell_400.font[1].js
    Filesize

    17KB

    MD5

    55a0d8277a94894a8b40f72717adf869

    SHA1

    84ec2afd66e38aeaab8988fb18787e32ac6e3bb0

    SHA256

    f8bf624dd3d3247c58ddf95b43c5bbce5c12404158d466ff8235af41e595f29c

    SHA512

    152d99198ebf5e5ab18de1bd1ffb804912934a8fede44826a08c4b7b30e17be222acdb406e8e005819f1e40a4e2d63c91a01a19e672c309c74f2ce19b09efb3c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\cufon-yui[1].js
    Filesize

    17KB

    MD5

    461958e1e515e8e0f372e73b4c819d53

    SHA1

    3745471542e7992dd2f5d85b2948da66845ade37

    SHA256

    186707c7ae0d45cba1490a5556f59fc371f6ab88cc16c452fef8b70072cb5e54

    SHA512

    734f8cde6780c2deeb1f23b21097fc381193ef0c3492d16b411984bacaf807b2799e340d254e8371ecbb73b104d29ee8a46448e26e0ef14b26460ebdde100d50

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\emoji[1].css
    Filesize

    841B

    MD5

    e7afdc59ac3db2e735bca0105b3fcd6d

    SHA1

    15b9055b555854c519549aa4c01dca887191d945

    SHA256

    8376faa9ea3b31a84f476ab14bdcd9110051f2e74f99d8a5459658d48a5e8cda

    SHA512

    6f4dfbec2348bf4bfcce6f9282b227d92d905448aacfdce547a8bcd952eae2de820ce61a0b4fef85f8590512d455cfc20e315bb88b6528f28d618b9558643405

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\jquery-3.5.0.min[1].js
    Filesize

    87KB

    MD5

    12108007906290015100837a6a61e9f4

    SHA1

    1d6ae46f2ffa213dede37a521b011ec1cd8d1ad3

    SHA256

    c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4

    SHA512

    93658f3eb4a044523a7136871e125d73c9005da44ce09045103a35a4f18695888ecafe2f9c0d0fa741b95cc618c6000f9ad9affc821a400ea7e5f2c0c8968530

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\jquery-migrate-3.0.0[1].js
    Filesize

    16KB

    MD5

    7bc46cd787fd2b6d3336e056301d4b84

    SHA1

    60062992ac61926ac3e1604b7f89cc373639c66a

    SHA256

    7fe32e1f272b3c300aca9d573ab228d87c605b4a705369d3c459523c52c9428d

    SHA512

    37ae02c8da88d3ff585d85035162f4e927cf1ed4d77d6b83264abc12a94af5b484095f2f46e9f3a6ef80436593ab482646b80479bebb8e782667eb86e98d3397

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\roboto.cufonfonts[1].js
    Filesize

    20KB

    MD5

    301d51da906e6cd41dea529d764dc504

    SHA1

    15dc16d366325aea102fa46c11edf04ea83a0283

    SHA256

    d49065ed2e4f7cb5eafab0fb03611563146102e514a5946bfcf08de6db58b85b

    SHA512

    6d50fea1d52b5bf19d1c758465d054dd3b0f03dbd754c29177e7f7248c275dfea2f61368857b54da914187966539f2eb5dead4308dcc331980fc26ca42255ca1