Resubmissions

02/03/2024, 23:48

240302-3txh5sae4y 10

02/03/2024, 23:48

240302-3tqetsah94 1

Analysis

  • max time kernel
    315s
  • max time network
    1607s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/03/2024, 23:48

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/archive/refs/heads/master.zip

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/archive/refs/heads/master.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3584 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          5e11824bd7a3dfddbc0567b5b77e215b

          SHA1

          819909a8eaeea86f59a54c62d83c76401e6434fb

          SHA256

          99be2fa2a63149235ad5076d3b89d75c105bed55f54f53aa9df13f0c534290a3

          SHA512

          a5cf732d2c00243d80a307f4de7c8e893065898049707f760df8495cf6bea9070fbed6b4c250960da3588af0c0e8e1be062076cc7a5d6d24230c939ba9765337

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          ef88f7c2e7ceceb85b2372607650abd6

          SHA1

          63f6b50419220a38da67f46bd91966cd5a2f0d87

          SHA256

          cd1eef0c50d433568961bf02b03e683645dadfb1faa332f4138beb1efeac1799

          SHA512

          36cf1b2e9457cda8c86e6fcfda9eab39c6f67776de2397010579f6428270870c062b409e350853eca6a80738e9d6e760c920e1f9d8c2807efa9168ac4d490788

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5791.tmp

          Filesize

          15KB

          MD5

          1a545d0052b581fbb2ab4c52133846bc

          SHA1

          62f3266a9b9925cd6d98658b92adec673cbe3dd3

          SHA256

          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

          SHA512

          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\FI2XRULK.cookie

          Filesize

          543B

          MD5

          a540c6cce02ba231b1d77413324eb8c0

          SHA1

          45030938e0e6d1e77d854e89f36bbfa447a6023b

          SHA256

          613eb7e99d8ce634a0d29509476ea803177362f94d371320e868172d1885282f

          SHA512

          d15b3b9603400d2df7d9db4d53650588aa681d3190683a41b6773aab168ec5f5417def1120f6b4b71557b58e96c470ffb922dfd5facfa55f10e565c037d6b924