Resubmissions

31-05-2024 01:50

240531-b9qa8aah2t 1

31-05-2024 01:46

240531-b64pfaaf6x 7

31-05-2024 01:40

240531-b3k3xsad6v 1

31-05-2024 01:38

240531-b2xqbsbe54 4

30-05-2024 22:19

240530-18xfksbe5y 4

30-05-2024 22:11

240530-14e1qsbc8x 1

30-05-2024 21:34

240530-1e6gdsac3y 4

30-05-2024 21:31

240530-1dfvcabe33 7

30-05-2024 20:56

240530-zq3zzahg2s 7

Analysis

  • max time kernel
    38s
  • max time network
    37s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-05-2024 01:38

General

  • Target

    https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnTztl0qK8tjedG5spADp9S8s46J_2BQUlokjVRnQ3_2BxA9RYERIXPceFygvo72KmUAGOx_2B_2F_2B4hOB1YeXxOD3dpQt_2BoFl63vUL3yGQdJEKeXQNYyYZMBmxw48t2_2BesDsizChsedfW60dYYTzQTyLsXglfyC_2BaXQNEjHkLHsOMhZhjq5a0

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://www.surveymonkey.com/tr/v1/te/akU_2BQc2vAhAsa_2B264x1g6_2FpF_2Fhy3EhxbpxJDHYpYZT3PErDK_2Bf6OjNYOPsqZdKwg_2FdGRiGnm_2F0m8noAHL9RnTztl0qK8tjedG5spADp9S8s46J_2BQUlokjVRnQ3_2BxA9RYERIXPceFygvo72KmUAGOx_2B_2F_2B4hOB1YeXxOD3dpQt_2BoFl63vUL3yGQdJEKeXQNYyYZMBmxw48t2_2BesDsizChsedfW60dYYTzQTyLsXglfyC_2BaXQNEjHkLHsOMhZhjq5a0"
    1⤵
      PID:2752
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5100
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3680
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:704
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2180
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4904
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4964

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

      Filesize

      4KB

      MD5

      1bfe591a4fe3d91b03cdf26eaacd8f89

      SHA1

      719c37c320f518ac168c86723724891950911cea

      SHA256

      9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

      SHA512

      02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V28C7N3J\edgecompatviewlist[1].xml

      Filesize

      74KB

      MD5

      d4fc49dc14f63895d997fa4940f24378

      SHA1

      3efb1437a7c5e46034147cbbc8db017c69d02c31

      SHA256

      853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

      SHA512

      cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\4OJHHE9F\National2Web-Light[1].woff2

      Filesize

      35KB

      MD5

      e55198d6fcd57630f0617639e2f6da90

      SHA1

      1d1910f8a407a0b33892ee14ea451943cc7c9c9f

      SHA256

      8924a5e7cde8b8cfd7fb9b9540e794993ba9dcbbc371ce9ca7c91924ef2d73b1

      SHA512

      0be109f6ec3996fa7514b3dee5c87a7c0cfafcd4ce9162b1a3919ba2e8cb8299d8e4b255e4bad86c7c6150c3f3a1afa608fb39ce04a7ae2441e17ecda15b7d0e

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D6T1LJPV\National2Web-Medium[1].woff2

      Filesize

      36KB

      MD5

      1ebab08781dd6eebbe312e6f97f6e26a

      SHA1

      e70a14ebabe5d90f7c1f06fb6a91e787575a6268

      SHA256

      9d1ac6865e4ba78d64acb5316f123a17a0840cbd8439415a8a66440697524e99

      SHA512

      229429cf523862e6c2a4ce2635580e03adc37161f4af6cf24d2f8746310da0e9d23ed407ca9e9c67e8b9c7a383690162f61052671b98a601f7ba4c2d329a01a9

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D6T1LJPV\National2Web-Regular[1].woff2

      Filesize

      33KB

      MD5

      13244bd99451605c61b32c9617162c1f

      SHA1

      0e76a3a33245d9276580c0b4d8ecac07d9936e66

      SHA256

      c7e022d03458278aabb7ce6892ddeef5736041de037d0d64adedc2eb1d82850b

      SHA512

      ddf74fcb1a02f0f90b658a25bf5d7ca4a1478acaaa3f72208bbd7e33a9d56dd04834a2b229fc2303abcc63270d28d7b3df2c26084df3e5f981d54bac56bdd442

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DP7TYXVV\favicon[1].ico

      Filesize

      14KB

      MD5

      a6067504c77a4b664f99053cc97b2d61

      SHA1

      172d55c94e6034b72b1928ccd4af7e2a2ee37ad7

      SHA256

      5966dc861723432715747cca5f811f4ddb7ca67314a76f447bb553973f10dcf8

      SHA512

      822b08837b38fe78733c6661d57a3ad1276318085ae53a4ba02887dd5300edd424dde4046b97c4eb5951baeecc58f5fb5cf4332439cc91c2b8569742c7deb15b

    • memory/2180-45-0x0000021B09700000-0x0000021B09800000-memory.dmp

      Filesize

      1024KB

    • memory/4904-161-0x000001D9BE7A0000-0x000001D9BE7C0000-memory.dmp

      Filesize

      128KB

    • memory/4904-146-0x000001D9BEF20000-0x000001D9BF020000-memory.dmp

      Filesize

      1024KB

    • memory/4904-152-0x000001D9BE680000-0x000001D9BE6A0000-memory.dmp

      Filesize

      128KB

    • memory/4904-210-0x000001D9B9830000-0x000001D9B9832000-memory.dmp

      Filesize

      8KB

    • memory/4904-71-0x000001D9A8200000-0x000001D9A8300000-memory.dmp

      Filesize

      1024KB

    • memory/4904-62-0x000001D9A7D30000-0x000001D9A7D32000-memory.dmp

      Filesize

      8KB

    • memory/4904-65-0x000001D9A7D60000-0x000001D9A7D62000-memory.dmp

      Filesize

      8KB

    • memory/4904-67-0x000001D9A7D80000-0x000001D9A7D82000-memory.dmp

      Filesize

      8KB

    • memory/5100-0-0x0000016EF9620000-0x0000016EF9630000-memory.dmp

      Filesize

      64KB

    • memory/5100-302-0x0000016E813C0000-0x0000016E813C1000-memory.dmp

      Filesize

      4KB

    • memory/5100-301-0x0000016E813B0000-0x0000016E813B1000-memory.dmp

      Filesize

      4KB

    • memory/5100-35-0x0000016EF8820000-0x0000016EF8822000-memory.dmp

      Filesize

      8KB

    • memory/5100-16-0x0000016EF9720000-0x0000016EF9730000-memory.dmp

      Filesize

      64KB