Malware Analysis Report

2024-11-30 05:42

Sample ID 240619-llwhfaxhpc
Target ba53e28462f5be2540824ccde6aeb615c2f3d161.eml.tar.gz
SHA256 373038f90abd4f4195e51d793f26e657c876997a0591ff4309f74aeaef701a7a
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

373038f90abd4f4195e51d793f26e657c876997a0591ff4309f74aeaef701a7a

Threat Level: No (potentially) malicious behavior was detected

The file ba53e28462f5be2540824ccde6aeb615c2f3d161.eml.tar.gz was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-19 09:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 09:37

Reported

2024-06-19 09:40

Platform

win7-20231129-en

Max time kernel

121s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b680c0140377d419b25a2af00a00fac00000000020000000000106600000001000020000000304794baef73a3cdf6482247de3eb8bd8f97fe81e94f8eb922f79ed06ac2e058000000000e8000000002000020000000d0cade1c1f36233119a01cee11e2621ce4a5ed5980b17ac965a35f3d41adc1bd2000000049557d8a2784eba9e587da1ee46abe1a073734462a9ef87495e259e6e5849196400000001ca41f1ecddb31d5e285b308555c0bc6e0d2fdc091a66c8a142d7b973a448b7915bf4fd1511b22d9414a5c79e2e8a33846dd0937637891bda6627ffa3bdcb3b0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424951750" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bcd0732cc2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F4667B1-2E1F-11EF-882F-5E44E0CFDD1C} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005b680c0140377d419b25a2af00a00fac000000000200000000001066000000010000200000009e7d327ca662409d0e9ee7f60e53fcf1f281a7919870ecf0917301dc9168ba3d000000000e800000000200002000000005a19ad2f7390afd43c148c9c70be5b4908e31eab3795fdf633c137fb3a036dc90000000411718f7f269ca86f2af0c244e639d3a6360454d7b9e0fbe645e60706445ff13f7da7d1e42b631bed85b863403cf7ac74433b847fd231cd9b86e92cacd5b1c9f6d96d975efe60e963d147ce4d7930d166de8f8a7ae317932fa4e3e107402500584ee7fbd6e66a16872af5edbd781c39f9707e46e2253e86aff0e6252e76f0b3ff89aaca64a4ec4d0203eea9f61cc6b6e40000000632843d92715941a695767f49688b7987ff2304b3edc95a0ee9249b0a9ad4388253cc9504ede5bf5ab24e348fd4ef6e93976286438ba453329b01669996c22f0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-2.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 2.17.107.114:80 www.bing.com tcp
BE 2.17.107.114:80 www.bing.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1FB7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4a36db577d6879188b50e5b1fafd8cc
SHA1 3d3424a0c9d6817948ee9c02a3730ee6796f5210
SHA256 57a6bbb3e8b0cbf9a35fc9c15132ccaef097eecc25b569c28ebdd91f4db78828
SHA512 fe10b3b3c6ea9636617be3c0d477fc9e62a94ea5da6c7c05ea84cdf524676fa3c20d96da670a368bc5508a577dc15694084c68175db28c032c45f8a1c89461c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f7f51d0760f6c92d1d551c3aad720314
SHA1 c374f5d5f7a861b809b8813596db8b1a7166296d
SHA256 5d765799679e7a2783614fec0c4875d554121220cd944f415e64ea5d33d27c6c
SHA512 a40c573316f4e39619a945d195fb6292de8f0cce98aa25824472646a054ded7f84c8668b487f9ae6d564fd3ec7f6f23ff5dd6f2fd2667205190d4b6d447456a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 c9817f46a61d924cfc4d06dbd6a73da8
SHA1 c3c4a9ad304f219cd3938dba91c8d1114a36005a
SHA256 db8e4d404984d8ffd03f7b23a32357aa2f0accf1f28d732a5b3e743a253eab43
SHA512 c4830050b03801f6820e6c62a8df71c58727a8ec86e4d98bcf710cc95a0adc5d2ebb8a0242d49c035b8d9a6b69d547fcaee414f9b1aa392524bc6538d62032b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 28efc11f0af4e91d4972d37bfe687c96
SHA1 55a28dcdadb8c968a46cf7fb9768e3bb1be204e1
SHA256 695b866f8f52575954014c7f506e7cc08ecd11871991b96dc72b2c377759f697
SHA512 ffca9ed3b0f2472a47e3fa8adad0dc5f3df5cb872ec3f3c1ab723f0c082e53cf57c948fa935e9b8e6e758ec4ef0da66479eb54bd5e27fe7944bfa8fd0cc9d9b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2da8e8bbbc3d19c452ac583118dbff9d
SHA1 1274a37766f589859c40c339c03f21f335506494
SHA256 351405cf3e10b396d582fcc8081b9dd447a4cc73f3a8245e25658ec48be7fb21
SHA512 0ddfcfb00114fd0d0fb9d77811a6ec133b89ca320a58a69dc1f5b6d71e215aae41851c80dbe185909dbd4976854a4d017400c6ff14c97dd46499e8fd0ff4f680

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 9330bc6e6cee50a9eb083a5f746f49b0
SHA1 14deff15657d9bdde4035a39943df00da40cae62
SHA256 f9fb9470fa7c3bc75386dbbc180584237c9ad482f6373b5e4736ca328362480e
SHA512 0bc510a12f14a985ace7c9a25d04ce77e9de56d5913cb98a27c0687c437332a1547972f24188051477e7ed2273b8e0b894bcb3a61fac9e059d09b7c44b638384

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ddc1ac7b859906be25f57c99c75afb6
SHA1 e719b968ec8ce6ab1074d238d7b7b5260366aa73
SHA256 95552bac3fd033d409e55c2dfca2bae0f8a48af5747fe04d75b6c656dc7deaee
SHA512 f7b9e7cc1de594a5fc4fa9745703f00d54825c1e5cfd95742f9d50d971c5f2a2beb92cbbe7000fcb24f1cfea7c6334f35aaafbf39f6f44ebeb95d318e3bfa069

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f2fe63c9467e0eaf70dc9c2c98f058c
SHA1 3a97c154e12388397d8e0de82dbad8921b9929dd
SHA256 0b28d153a5fb3643bab1e38102f5164b2cb6f443b0cdc9a5a967518e445199ca
SHA512 fbdbcce05bf7b0b38aa6e632e5a591f70f85b7b61115dee80941da4fcb9624c99c70f03f0f7be7fa03455f3b90653da6853bef933106b19f3af8e5509d65dd2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 647a1a8c3b357fd56fbef19ad0a0c4c6
SHA1 7a5a1891f54ebc2a74f991f63fce2fe60196ec43
SHA256 19ccd27adbde7beb16f335e5c428e3ad84e8526621ac1bff156cfa1f84d4f22e
SHA512 6a68f00c54d65c28ad9341ba1e89fcd4924728f928eeebaf5cae8d27a50163142b43d7511b27c55aa189534df0e484520e959eb7a7b213b2785c183eff27aae8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 81fd562f5d15d6d90705b304244c5cb3
SHA1 af0081abecdfc5b796a34ce2274da8ddac6e8eff
SHA256 b6e044563c7b25b8011abbbd8cff05b0a129eff036667c2f6da3e299b52c1575
SHA512 d11aa97f3087a746231b8aa3a7fee32c821d62cc65b4df8cf4f45595c9896b13ae93a7bc4c93b271599400dd168c567719f811af3006c14acc0ce4bc779bd965

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc79fdf637ebbe381ccaf5a1d366f84f
SHA1 a4a104cc340b8e0406c78249f27def8a2f1b8168
SHA256 213d7542a1b65bd49bc5c405e5eb1892b6a28e4e7b9e9277d9151508a7c2160b
SHA512 6ae194d1c7fbbda8958243abb0ad5efb3a75e6c11b0c731987df71b59c83572bb7e2c9386e9a590fe1b07b018e1d2f5dd11b7c759125b407c99e0b306bd4ac7f

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2ba44052e88eff7e715f30c876581b8
SHA1 a555f22bdc02ebe8a88d4d5d7e3f533f6e08baf2
SHA256 229ac22be78a3949b87a6e42d73470babec42c04bd8a16df7c50dbd82fd220cd
SHA512 84be0bb219c4bd744084df1b82b694455cbeb9bf7794b294ab8caa4288abaad4d774ca4b9efce50805f78e64d1fb24277d64520e33ea304a079ffe2263811526

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7569054f704c1e34698529021a3b2823
SHA1 b1a9ac5b79cc52d4cf06d8fcf4894f191940fd08
SHA256 04178091128a223cffe7c66dd46387b4f7583095e89331ca9fbf60e2942842a8
SHA512 6e4eb38020e49a41449b2baf985710f1809c03b50aaa201ab2f02bb45d5a8d93207940c119f7a112a28ca892237426f8f92d7d9c41e82566eee25f16e15164a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a76a9ea0b00cb6fde4457de25c5503a
SHA1 22a7df5d9690869728d015a3d32fcd5067ee3a17
SHA256 a516e4792739061b0280252d75e69ca3489d022e2b9ad683cccdc902d64a6895
SHA512 1d0090ee438969ab0a240a8698554208b02d66f7596cfdfe919d448fb8c2974084e889940f416147ba016fdcc7f129973b5f999e444d2e76282a584b8c8d8f4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2960d6277d4bf4fab85d027821e6c8f3
SHA1 0e90e6a73a29e06efd87da79e261d2d5ca6f572e
SHA256 7d98194a9373400a6e38ae4124072cd802337d82f7e7f7b40cfc4b60e57cf202
SHA512 4765bb5d794598a37ae60e8791b0dd3c0519dce06cb01d6b00e53093671fcf67338421e463a70b93e6dfc834ca6cb502b5351c09cdb9c71f7192b963e00c7d3b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6400f8c2bb632ac85d41ee99afadbae0
SHA1 6a31ab3cc5b1e58837625d57ecad929411af3a99
SHA256 2bf906a9f753f4710ed2f269e8887854173c17b18c7f6c2959e22cf1602cba5a
SHA512 dc54a766e5f1ae497b486d435f396ce54e29a8d243cfbe79552fd83d48fc3e463c754790488c22c3b584ff7e0c7308ba2c57d517f35d445c522377c321cc5385

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9f9ce6271b77d09a1e384defb214409
SHA1 ca74152243b8e8918dd81da30890d1b398855bb1
SHA256 c4b3c0fa211b2a7683f05fd6efefade11169e79fdf231a7a4ecee53f0ff45b33
SHA512 c35307222401c443c6f0a03c8ab810b5f89120d2a1f47bbea58f648469a4698365eb4c4e922be22162e7f12d2350a304a25e2d7cb6b3f1724929cb4cbc5cd825

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cc468f7d8671db9bdbce396f5ee8c4b7
SHA1 9312018d427d75e1982615cce3ef6483e8d8ca2e
SHA256 a9fbee80c9201864c7348267de8c2741f5594b25f98e18a2ff5b585b67d74cc6
SHA512 9815859ffd5bdcd1494a6a192e75ac19aae112b2ab07cbcacf48644e70fa6261f9429bfd578448d5368b2ef252667270319c267d09b114fc79db45d3777efadc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 855b50827b678c98ee4ce4f6b8c19246
SHA1 2f65ac82b25a65fa67ac8ac3552e65de5dc8c119
SHA256 95d83e149117d7df9f68b0a739c2a5e344980d6662874c4cebdc014708b56c1c
SHA512 d62321905cdb4b6abbf27a861f4f27d4f305fb05b431e6fbd632ff2656713f1180c628ad43f22d41a133168a2a7c29957a96857910c36d09f76a2f18924fdc19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c56f4d069226f6bc112052d631c6e99
SHA1 086143dd81e23f23cd04223e8b6156780797755c
SHA256 e927f4425f7e1041c61a3d4a4c496b8d80fc8788dd01811f6fd2dda6e34c64a4
SHA512 6baf8366097f3dde48995c7a5dbf922c6f442f7da80dfd343188565d8a1aee5e9be2673e35844370e2c5b89d18ea9cd660cc82a2d4f9b0f334a5317f1d993d47

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 676da269b71fec2cb76f27353c6c02c1
SHA1 c0af91d86770f6d9f333f555a73f4354c5f797df
SHA256 635c25e9fdf3971866aec3d76a3ab2dc6b00e49a3bb249400d2d9d9183dd6f01
SHA512 8786279a506821ff633ad73154d1bc526411ce9063ca13682d8ff86f29dd742150fba74b1dface2b101a52a1717a6f432cdc9fc4c95f195616910483e366bb0f

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 09:37

Reported

2024-06-19 09:38

Platform

win10v2004-20240226-en

Max time kernel

14s

Max time network

17s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5432 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4644 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5612 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=3752 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
GB 23.73.139.27:443 bzib.nelreports.net tcp
GB 2.21.189.233:443 www.microsoft.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 27.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 233.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 142.250.200.42:443 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp

Files

N/A