Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 03:07

General

  • Target

    PS22PS4-GUI.exe

  • Size

    340KB

  • MD5

    91013483c99543a0aeec408933159f9f

  • SHA1

    0db890c886f58fa1d61f643a7866460900f1de35

  • SHA256

    0d79fa3f02b7bfc5950c6b0a210746fa2d5fd5e51fc7ee7e08851a0fce1a6df1

  • SHA512

    5ff774054856900084b6bd40e4839fdbd6a64ac9db7a73b155757668347c2f55282738cb639e7ed5b2856b2c4a5f9c86906c1b314cecad2138a44f10defc498c

  • SSDEEP

    6144:5EOSd8ybz1qMF1tdF/G4F1tdF/GA28Fs2k7TbqEANd0IF1tdF/G/:5EO7+hNd04Nd04s2kGEAgINd0/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PS22PS4-GUI.exe
    "C:\Users\Admin\AppData\Local\Temp\PS22PS4-GUI.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.8&processName=PS22PS4-GUI.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2556
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      53b2a3d4938cb88e9a7e5843d85b97d0

      SHA1

      1ede9638529dcd2007650092e55c3152449aa875

      SHA256

      795aef9f6c4b1fea217c86d53e2eaf3416d4eab87aff9afa250f9e4069d1ee75

      SHA512

      87d1b8b0fc7e86a82fd650e441e1b71c687bb3a82c11284b9c7860f986fffcc03151fa3c238471869746a812865c73803cd76dbec09c9cf0187abc763c832f24

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      9a079122b054f3d740c79801dbaccd1b

      SHA1

      3a7572f94396fdda2826b8ab4c2c23f444df02c4

      SHA256

      7c945e4d0f26f9683dacd0ef4710bf68ccc2c5e99e6fb6f068f58e25a0026684

      SHA512

      6f06c474047d0b48c770adbf63bddecc61cd9b2324746ca7fe0c6e55e6e1eedb7735a693d98f2e0ae818549bffe47cd30060e9a54b37cfe460f5d91aeb5c2108

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4b5126e86628aefdd794caa5a9cc9b14

      SHA1

      1a50a47b0b93bfab9ddb72d6f9b55bd4c4e51780

      SHA256

      f3f6aabb355c0e151595bb99be11a3db02584360655fd6443a9c18e9cebeb211

      SHA512

      6f931dc4a236418d3d24e495593b2d86c917c6295357a0761634d5d4bf3ee8c905c95256040571ab82def89f782ecc8c2d52f31e8847fc495cc0e2133072bd4b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      86383064a64416763eaf538bb4f41b8c

      SHA1

      6740aaf2fd4840618bd4344e09ab4682a6d9a717

      SHA256

      a397df86f4b6c20e98a47506e1c5d19df340077d974795f03330e82578c074fa

      SHA512

      7a2b36c0b5206f34ca9250e04c65b6daf9ff7bbc4b00cc08cf681078446fab63dbc548933f54f7d63eabd7b6f536270619b28121ec87074e5f0f6959cf9fd55f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      fa093683dbff2c40c70d6ad47cca6f02

      SHA1

      b319792acdbd7767743709f78dcd368ad1f3313b

      SHA256

      9eed54f24eb15308fd301df36ee7a814cfe639d62b485ee40730bed9c118ec1a

      SHA512

      222249c2190714f28aeb2d7fe54ba147cfacea6ac79b3c32ebe7790c0a22bac6fdda32f8750b0a34ecb7201bd8fd67b8e224952a63a3664a7c7320220d550e7e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e0128553b04340a76aca9883b18d2394

      SHA1

      5f710a7787b66787720b0984fdfe8f2765de3996

      SHA256

      bff51b5c468da50ee816feb80096c8ed8f2ac3a1dbf137d565c40a4d763b5acf

      SHA512

      7e2a586b8c62e142c361e2bba30800df0ff840b8019833d2d4c31855029c573264f7e0dad043a0fa7871b9af057fc42f909e551566a38253c08f400361b42a25

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      e0786878ec464f2b28f2318eb8d2ec8c

      SHA1

      d6c4e74176afd39b1fc09ee64b14f7850301b95b

      SHA256

      6a039170db506a2e96a5f8d503db0120d99a57f09f78e0c27c4b988a63d77e5a

      SHA512

      8bdcafca82bd79d2193ab9858b14853305d158b60d4a7c96072ef0462784fdae1e0dc40e979cf8d699153052bf48d7ac9c7f353616d9dd566c9638b568b06228

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a2fb71ffd0e54e2f37e48f3c37466adb

      SHA1

      253a1dda64c8f3bdd2cf31f7cb8f1602658d7aed

      SHA256

      c19dcf50ff961239d35508ff10fb80415c292bcccfca9a0cfaff2ca059f274ce

      SHA512

      bdb3b0bb6438ebbd111aa40971a55d3b2b360803807467a46ca3ed00f325cbd0a643dcaab70fe66c6b3a643f1687786b417c124a0816f425fc116ec7545e4ade

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      24c95f5ad956fe9fb9dbdf8aec8060ae

      SHA1

      762ce5b3a1bbc33afc4bef8b123b0757c1f8d0d6

      SHA256

      3775fd5e32c95392d2919b5b51cbba8b2504d6d37efc686025ab77db86a793bd

      SHA512

      e4a38803d1c7f2c6f6ba4731a8a6797d3dfab592f8cc3a173e1c25ccba2de708cc42a6ecbd8aac425af9e7cead2ef47c8cc16e7c4ad9a78ba7d821069f5270a2

    • C:\Users\Admin\AppData\Local\Temp\Tar40BF.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b