Analysis

  • max time kernel
    299s
  • max time network
    288s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/03/2024, 01:09

General

  • Target

    881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html

  • Size

    84KB

  • MD5

    3d118265fd47d5dda48a76f47cb7b474

  • SHA1

    1b61de1f384c8cf4e4acb1f8de6a490933e05cc4

  • SHA256

    881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36

  • SHA512

    46849ae0692bcd1524b6a2f7b1d115a9a0bf29f74f3b682346ff3cadb43332b0edac453c0a73eee39cd9427ff640c89f378e43686d8ca8fd65fee288b05be79c

  • SSDEEP

    768:Z/lZmDlYp0dBzJLVcUDII4FUr9DmOOdxeoT63KBsrudDDO30WQmIr2EIQYTq7dDy:gd/DI+3Y/dD6EWfAiO9DwC09MmWJ+12S

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html"
    1⤵
      PID:2256
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5112
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4136
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2880
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3396
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:368
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:336
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

      Filesize

      4KB

      MD5

      1bfe591a4fe3d91b03cdf26eaacd8f89

      SHA1

      719c37c320f518ac168c86723724891950911cea

      SHA256

      9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

      SHA512

      02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U2DI4E2V\edgecompatviewlist[1].xml

      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!121\MicrosoftEdge\Cache\IF7D6AGN\cb=gapi[1].js

      Filesize

      77KB

      MD5

      f4ac8ebcddf99f97b1f255e008368d12

      SHA1

      f49430105d72515c98afe87a26e66a5249a9a83b

      SHA256

      326a0170c1d2759827150de6606cf8a5a4423c9b01748de34e01cee23e523f5d

      SHA512

      564b6762d839946687e118a36289328deaf966261e744ed4c08001ca3601b26688ba0d1ef4b260c055e00d3f33df1653d2b51d565d367ee4a384ce9fba45aac5

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!121\MicrosoftEdge\Cache\IF7D6AGN\cleardot[1].gif

      Filesize

      43B

      MD5

      fc94fb0c3ed8a8f909dbc7630a0987ff

      SHA1

      56d45f8a17f5078a20af9962c992ca4678450765

      SHA256

      2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

      SHA512

      c87bf81fd70cf6434ca3a6c05ad6e9bd3f1d96f77dddad8d45ee043b126b2cb07a5cf23b4137b9d8462cd8a9adf2b463ab6de2b38c93db72d2d511ca60e3b57e

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\IUJ66FIA\suggestions[1].en-US

      Filesize

      17KB

      MD5

      5a34cb996293fde2cb7a4ac89587393a

      SHA1

      3c96c993500690d1a77873cd62bc639b3a10653f

      SHA256

      c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

      SHA512

      e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    • memory/368-271-0x000002E271290000-0x000002E271292000-memory.dmp

      Filesize

      8KB

    • memory/368-284-0x000002E271A60000-0x000002E271A62000-memory.dmp

      Filesize

      8KB

    • memory/368-97-0x000002E26E270000-0x000002E26E272000-memory.dmp

      Filesize

      8KB

    • memory/368-104-0x000002E2785A0000-0x000002E2785C0000-memory.dmp

      Filesize

      128KB

    • memory/368-134-0x000002E271D00000-0x000002E271E00000-memory.dmp

      Filesize

      1024KB

    • memory/368-140-0x000002E270570000-0x000002E270572000-memory.dmp

      Filesize

      8KB

    • memory/368-230-0x000002E270D10000-0x000002E270D12000-memory.dmp

      Filesize

      8KB

    • memory/368-234-0x000002E270D40000-0x000002E270D42000-memory.dmp

      Filesize

      8KB

    • memory/368-240-0x000002E270EE0000-0x000002E270EE2000-memory.dmp

      Filesize

      8KB

    • memory/368-247-0x000002E270EF0000-0x000002E270EF2000-memory.dmp

      Filesize

      8KB

    • memory/368-252-0x000002E25D860000-0x000002E25D862000-memory.dmp

      Filesize

      8KB

    • memory/368-255-0x000002E271040000-0x000002E271042000-memory.dmp

      Filesize

      8KB

    • memory/368-267-0x000002E2710D0000-0x000002E2710D2000-memory.dmp

      Filesize

      8KB

    • memory/368-84-0x000002E26E000000-0x000002E26E020000-memory.dmp

      Filesize

      128KB

    • memory/368-279-0x000002E271A40000-0x000002E271A42000-memory.dmp

      Filesize

      8KB

    • memory/368-95-0x000002E2708E0000-0x000002E2709E0000-memory.dmp

      Filesize

      1024KB

    • memory/368-287-0x000002E271AF0000-0x000002E271AF2000-memory.dmp

      Filesize

      8KB

    • memory/368-290-0x000002E271E10000-0x000002E271E12000-memory.dmp

      Filesize

      8KB

    • memory/368-294-0x000002E271E30000-0x000002E271E32000-memory.dmp

      Filesize

      8KB

    • memory/368-298-0x000002E26E310000-0x000002E26E312000-memory.dmp

      Filesize

      8KB

    • memory/368-304-0x000002E271E70000-0x000002E271E72000-memory.dmp

      Filesize

      8KB

    • memory/368-307-0x000002E2720B0000-0x000002E2720B2000-memory.dmp

      Filesize

      8KB

    • memory/368-312-0x000002E2720D0000-0x000002E2720D2000-memory.dmp

      Filesize

      8KB

    • memory/368-316-0x000002E272110000-0x000002E272113000-memory.dmp

      Filesize

      12KB

    • memory/368-321-0x000002E272BC0000-0x000002E272BC2000-memory.dmp

      Filesize

      8KB

    • memory/368-93-0x000002E26E560000-0x000002E26E562000-memory.dmp

      Filesize

      8KB

    • memory/368-325-0x000002E272BE0000-0x000002E272BE2000-memory.dmp

      Filesize

      8KB

    • memory/368-90-0x000002E26E0E0000-0x000002E26E0E2000-memory.dmp

      Filesize

      8KB

    • memory/5112-0-0x000002B0F8F20000-0x000002B0F8F30000-memory.dmp

      Filesize

      64KB

    • memory/5112-35-0x000002B0F81B0000-0x000002B0F81B2000-memory.dmp

      Filesize

      8KB

    • memory/5112-16-0x000002B0F9900000-0x000002B0F9910000-memory.dmp

      Filesize

      64KB