Overview

overview

4

Static

static

1

close.html

windows10-1703-x64

4

Resubmissions

27/06/2024, 11:15

240627-ncvkwsyblh 4

Analysis

  • max time kernel
    17s
  • max time network
    21s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/06/2024, 11:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    close.html

  • Size

    89B

  • MD5

    196cfacaffb725c92c6d5d4f16289e92

  • SHA1

    b6306fe94c164053882259f3d3105e6c4519bf81

  • SHA256

    3cd343b356e21807ba2d17e5de1fe01756ec53bcc76699572e78b0befbe5ac6f

  • SHA512

    9319817e1964ecb66fa16fc2ce02c8d140a5936a10174d7723906fc0ec99f07f88fc1b87319c345b21c36ef0243c80757eccd4ded89767fd1466b0687722aaab

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\close.html"
    1⤵
      PID:2736
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4192
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:1368
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3572
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1824
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1552
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2216
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4444
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:2400
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:1252

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\MGU8QM6B\www.bing[1].xml
            Filesize

            1KB

            MD5

            7d906b6b61797d99aab347dfaf27c8a0

            SHA1

            4b7570b6b4879831821063cf96ef6e1dbd978689

            SHA256

            511bf4b59555739388de5fa8d5c45683c350a375428b6e5928bf078e98b939d9

            SHA512

            a9512c3c4591b4378b93478e641ac794ca433c72acab6d0fc64961b8e34ec4403bd757f78e471beaf77b7f5427c0842be358ac4a61132339c4da0d7ba24af53b

            Download Submit

          • memory/1552-56-0x000001A09FE80000-0x000001A09FE82000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1552-51-0x000001A08FC00000-0x000001A08FD00000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1552-50-0x000001A08FC00000-0x000001A08FD00000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1552-52-0x000001A08FC00000-0x000001A08FD00000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1552-60-0x000001A09FF60000-0x000001A09FF62000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1552-58-0x000001A09FEA0000-0x000001A09FEA2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1824-44-0x0000019114000000-0x0000019114100000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/2216-83-0x00000245F3F00000-0x00000245F4000000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/2216-136-0x00000245F45F0000-0x00000245F4610000-memory.dmp

            Filesize

            128KB

            Download

          • memory/2216-131-0x00000245F4300000-0x00000245F4320000-memory.dmp

            Filesize

            128KB

            Download

          • memory/4192-35-0x0000022186280000-0x0000022186282000-memory.dmp

            Filesize

            8KB

            Download

          • memory/4192-0-0x0000022181F20000-0x0000022181F30000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4192-16-0x0000022182020000-0x0000022182030000-memory.dmp

            Filesize

            64KB

            Download