Analysis

  • max time kernel
    134s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 15:18

General

  • Target

    Thief Simulator 2 v1.2_Table v1.1_ColonelRVH.xml

  • Size

    42KB

  • MD5

    c6d7bf19f5c216a47beb26be2c3730b7

  • SHA1

    22a83b4dee0bd4b63d9b8e60a9d1d6326b313620

  • SHA256

    3a7da7559435335a57eae81bbc5cc6e08e2927953984c72046b6e494e84e7c0c

  • SHA512

    e10667c841f4d48ed965157dfb3333cd94b90b6f77a85e786979d0e7769dcf0012bc8af28a42e7f5c4229c0661c081b9788bd5d0b11ae95e9e0e17543d4aa2af

  • SSDEEP

    384:HjIatuzuhuluwuQuOaBfRUDVXMuUutveDGMuUuysMRQ0MuUu/temcMuUuUBNrMun:DIq0DGoCQOI6DkWYm

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Thief Simulator 2 v1.2_Table v1.1_ColonelRVH.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6f33e4dd1b99d3abf88d76d0b54dcbd3

    SHA1

    0a3c2d70588dff971f778e927d99ea2ca1244ebc

    SHA256

    a114058cb692bc17f3b1e50f0366e949c26eee38a365aa226686a856cf404165

    SHA512

    6138583ae0a0bccebdc5310e0777cc7ea92ed76847d056548039df4914a7c4386007358b8dc0997cace6a6a2bdfa111fa067d495d5ff030230da7d297f9b303d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    134b07fa7a368e2707870f0afe13c5c5

    SHA1

    575f9efd1c8be7331154757abd067a70226303f9

    SHA256

    c43a4a03711027c36f11a9d9115d04a4bf52bc1257932ee642a16ac3c1b2e79c

    SHA512

    fed720a20a2e63478ec6b8e28fbbdd8ae7a7fd0d758751a7ec1773ac4856fdf6bcc43b558c247d143b4835fe3bf0b26a9177053eae51818c360ea9e5a294aa6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b4c6b233e21ae11333d0685ac668c53f

    SHA1

    f8d18a4ad5c9d4b07a4de090fec6595341d28060

    SHA256

    dbeb3f4ba543f2be4e3c66bec9659907a4f9524dc70f3ae93618dfd2fc80459a

    SHA512

    173c6d575b180c815d9bb31c00c41d8845f8c412809dff4fb085a9b8f9b423dd8d53e4e0096c3b1faf6003814cd5dc19cf87e9858d45c92e64db7960ae573363

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a34c409344ecf909da6564f64199c4d3

    SHA1

    1cc216ffa2aa3a9836fd47664854cb0cc6eb9ed9

    SHA256

    2d0f1ea7051919026b4feae0c45bfc5e3bffe274fe82f1c4d3c6556237a804e9

    SHA512

    f7bb7f5ce06f9f1349a5c48879893acacada5221c7c20377a978532f080646abc454ec39383f24072171ad6ac0f171cc6c5f97241880f4c03f3a623bbc6cca9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e67be420edf3dc02eba2179689fe3485

    SHA1

    c81a0ae91caaa10c61e0473cf60c7cb4a227b0a4

    SHA256

    01ee3e7d634e17a0603c23dfc5372177e4a515861040a81bd34a5756f72bace2

    SHA512

    0e50dafca0df294762f1a798902b827f81a3c40d4c4829c61787f09b1af1d5005aabd4ef723a46e45525b2dcc0b33e95ed548347ec2cb1111e50f99181e67bc9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    496b38413721fd4888ed970b7d2dc970

    SHA1

    90240a7bf4e92322ab5d0a67a36080a124eb4629

    SHA256

    e8e3e6521ad4689f6d07e9236cddf2b783986391c36ada0c7bbf3d0a45de5ee5

    SHA512

    dc74872d7869298e8130e4da18a90373320bc45013bd9f340609a4fb637f899d3442eca4866e3354cb968c5e802a04e1331e1f2e96af1a9f2e880edb59b72252

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9b41052b3d9d03665f1c28f7ed807b7c

    SHA1

    803da8bf9453401280c7e9337568de17956ab973

    SHA256

    e2c2f849ea83f6363714df016ee10988d17e4ebe095c2cf1641c060c7c4a2f85

    SHA512

    13efef7d514ec344c02893b2f1b90c68bb158cf2aaf78110fb8d2ac9d1ca9df923d27d78d880d186e96499e231fadebf13643da31171d1eb3a2baf904a033cbe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ac827c326e4651d8b094ed56cb360d6b

    SHA1

    210cfb6e26b60d5175e01c8beb0532b815af8b1b

    SHA256

    4bc87904e903887c8d21369660749c91824dc2f7bbe84b913c2ff0792b276e3e

    SHA512

    b572be6744e2141e5e1e6f2c78541dd9bd720e2e109fcce67a912f83ab05e62b0bcc7d4695b09a4515b161d6eda5bd18c94daecb324e046b77f31ee2ff3cf760

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    13d010a4ce9ab0ce94b8bacf3bb92ef7

    SHA1

    4f1fec1ff9cd37d648869ac070c06f18d95b8309

    SHA256

    a15cf2639a139c940b51cb937eafbfa7b30043fc5ea833dba81f918a4bb56589

    SHA512

    58ebba8fe0fe065239e3f84026c49859e1ed3dfa8d33ec04e4c45e1672b5fc2a8067d95f9444ba3d27b3518164a84f14a1afd3fea909df9ede0b1fea1bf6e1ac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    943e89716d752e3459493835eb3c0b19

    SHA1

    cccc675865691db2420eb754ab2162bea6f93694

    SHA256

    44816b89e12a6da5b400eef15d371bdf3b229a77e46a7687c2e82c8b00a3094a

    SHA512

    00e375cee1f6213e2ab12791c9003ed879018760a536010303aae4046deea8e30eb820b078534cbfeb09cf073af04c4870ec592aa8dc72875a30f43cf97ffea4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3ec44520513ca3a1fda07fc3a42c7206

    SHA1

    04bf1b0a254b6d19584b2a94dd87d187ed7513ea

    SHA256

    c3e0fe073cc964a428a729c1f29213fa78cc7a8d6747e156085470003a0fceaf

    SHA512

    2961966cca52138faa7707f903ae62efa8c6a1fa049f697b10f4e9d772ee1ba3bba13dd2cadd069c2f14d82aadf2faae307a3ec0c05e526d4d849a06cde3aa96

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c0317283a5e989f7aef4c1f36bf7bf1c

    SHA1

    ac85224149ba86df9e42dbd3dbe87f74680c6a4d

    SHA256

    91c20be7a81aef2fd54d9cbbe55dc890177c46a7662077ff8b5a07ef0889d1c8

    SHA512

    9ae80af155bd86e480d0d328e5647adfd3aac4871dd777fd2947577e942f9b9ac6bfe5bfbf5e5d1b9d35c07f32f40deb0d30a24022485e63a0dedde99b13257b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd01d3ec28d52b323e1e978985417565

    SHA1

    7029fe5e1e045dfef8ab817d198888db9be9a55b

    SHA256

    ffc896b5a2b047a842619b59fc56201c7576855779a8d444a006d0ba291b0e46

    SHA512

    e9137f3fc017a0c7ec781e97b47b3b07e329d817d2a72aacc1a7eca56e19498b41461a3f8fb7e31fb65b3ffd50e0c7a7ed2fed6ff66eb2a5edc789df214221a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    67546f9fd7cc3704ff7eee9616d9fd3d

    SHA1

    0ed5db9d41e4d2674c2dfac449d1a555d2b66dcd

    SHA256

    98e0e354ac236992404f506e9bd88bfd449db2fcd1da0ea0c059bc893bece1ee

    SHA512

    e7039ba3956b1c96838de086fc84755858ceec3455ddca8f7decbb2713c63de735b8c7cf85b9f89ffe9767d11c9a3edf8d4332502cbaff1472fdeb8fa8822ff5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a1cd7f6394df861e0efa7ae60640b55

    SHA1

    eb5e61f2947c64ce17bbaf8fd88eac9bd5bb29da

    SHA256

    e93e7b4a7e72c47a3890ad143583826534ff4490a9a899a5d5e158454b10699b

    SHA512

    1f15a96f2a2043f13af38a6736a63866ea22f52e28b8c88ae7e530213038196c43446a9c36e3d7cfc850ec4baf65dd854cb42cf73f2b7a5a44c0fd3d29bfa4fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eaad78f376e135698690237e483de1ed

    SHA1

    06aebba707757763be569220acebe303333f6f1c

    SHA256

    3978e09939bb29cf2e723c7c5e3c1c64b908bfa3fc396cabfe4d38ccc764b6b3

    SHA512

    e5f68f1f05fa5ad40d417ae54bd9477a21083e8d7c320c824cc85cd8c54e46e782d9fd3bd9315f10e9e2a29e3f5bd3831bb90d3fe084079b9bb932d91b332414

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ce05f44b85cc7d2101a8c17fe5b84417

    SHA1

    8ca5170c32e6bdbff8e93805217b018a4da9fc45

    SHA256

    61e482cb8f81c66d8f998e216348d72fd332ebe6daa41e18cea9d98648d8fafb

    SHA512

    d804ba0b60e6a48f7da5e9f25a64784d2750baae0797c8cf6bf7020728176d13802aac340ecc57b1ea5c7b58570f333ed4644520befb416f1f16b1e9d60dfe66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    42b01ac17fdb208cbb4752088c28a9bf

    SHA1

    dd1c516719a5df990fbe1af4e39c18548cc60fb9

    SHA256

    49ba54b972375f05a314b7e90df963bdc074ba1c499028b6f6306bc4a86cba71

    SHA512

    8eb2395bd165f65ffe61e301e3dafd6f0f107afcabd3b80e4af87fcd73055c3745a72ed64914a9048b922d303b84d5369485cb96bedad2fcfab66f0c8a8b3085

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b15c8f2fbb151b76a0e7d61f22c4f335

    SHA1

    76a38ec290ecbd0bfbfab7f4586bce5201fbf63f

    SHA256

    11df5aefc31bffd4ebe4eb1f52c7eab4c6b0b8879e74c9c8889057e09a7cf635

    SHA512

    40193dfd14cb034260e44d9a47ca77f9e9cbead90c39bb2ba97df8e922f0137680a23fa9e2769875a210359edf81090ff68dde9864a59fe1231686c6a89c3eea

  • C:\Users\Admin\AppData\Local\Temp\Cab3085.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar3119.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b