Analysis

  • max time kernel
    89s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    24-05-2024 19:57

General

  • Target

    SafeExamBrowser-3.3.2/Safe Exam Browser.app/Contents/Info.xml

  • Size

    4KB

  • MD5

    450b225b3bf44ad35a449702c68476a1

  • SHA1

    841d4377310bfc4e5309cba9784eb4197d151f34

  • SHA256

    640fb495ba065bcd8f0d91de6b1cd285e761d242046b5b844d5dcf6fc00ed9eb

  • SHA512

    e61947565c69a43d015c40ea22f5b2f6a8639f7fa77987642656665670f03356b7d7654efce57b54a42fe3059c12d048587128dd16122e3886be044db2e648c0

  • SSDEEP

    96:CyKQxBYGAIDj27cH130gIdxi+WjkS1/O7STOApZTQpXSQfdtjX:XEGAyB8xi5CPX

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\SafeExamBrowser-3.3.2\Safe Exam Browser.app\Contents\Info.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SafeExamBrowser-3.3.2\Safe Exam Browser.app\Contents\Info.xml
      2⤵
      • Modifies Internet Explorer settings
      PID:404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3096-0-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-1-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-2-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-4-0x00007FFC1A203000-0x00007FFC1A204000-memory.dmp

    Filesize

    4KB

  • memory/3096-3-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-5-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-6-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-8-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-7-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-9-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-10-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-11-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-12-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-13-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-14-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-18-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-17-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-19-0x00007FFC1A160000-0x00007FFC1A369000-memory.dmp

    Filesize

    2.0MB

  • memory/3096-16-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB

  • memory/3096-15-0x00007FFBDA1F0000-0x00007FFBDA200000-memory.dmp

    Filesize

    64KB