Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 01:05

General

  • Target

    d-capturepreferences.html

  • Size

    2KB

  • MD5

    ac5f7bc9e2ab829f10d1efe3179455a1

  • SHA1

    914b137f702858370ef88029220bd12d7b9d2069

  • SHA256

    4366e01d0aa05652006b2837cff5d0dda46098eadfa23527cf2b7a5c9ee1c0c1

  • SHA512

    74ce9907ec98e9ec0d877ba9908b3d0c50df05da92ca6aeb254a862c844ec981c4b8a544697869f23f8f2b3dc05ee81e33bef37cfc4583c3d50793efbeff1ac9

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d-capturepreferences.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2836

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          0e2577213c3385ae3356bd121c683be9

          SHA1

          285b674de669a47464027256d5958c79f3169ec5

          SHA256

          c521a4167aaa68fe435f63c6a8bf076ef41c074af8e6ab36ffe84a14a556df31

          SHA512

          d47beee8d4f4d7b6cca9f5dd70ba947d715599db6657ad02c7936bf5fbd91abf0bb8c9785287f44aac84bd84df8f6082200583be23108b0871d7979d17164c4e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          32e759ce0a85fa5feaf462e435720cd9

          SHA1

          638f07a7a7f5160806b79505a2c1d915ad0378d6

          SHA256

          b8d23dd6fe3225b972486bc468ffc01c85bb4c1dccf7e4f99bac2fcdc96860a2

          SHA512

          4156c541f40a152e6bdcd8628e49f5564e52b10c8b9d0e64ba68d494cac2b38d234152a72ae586d8c6a9b638ff0ac34b7863fed91b55513a56a154eac6ffb260

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          c78d47cf0e5bb11378a403c451bcbd29

          SHA1

          c159eb663948de8400b2a33ce48a3bbd8161aca9

          SHA256

          61bb768c670ebae104af210ad06f5fea29f050a8d7d1aa36934232fb8cccb704

          SHA512

          27b0473055097235f4baa9a01d99c584450f5aae676cfe36f7e783a2b37c2350e484cd025e8ef9b5a4d80efbdd7b01b957a49e979f0e571326f291377c974bac

        • C:\Users\Admin\AppData\Local\Temp\Cab280D.tmp

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Local\Temp\Tar28B0.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b