Analysis

  • max time kernel
    69s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2024 14:11

General

  • Target

    CR9CK/progress.exe.xml

  • Size

    161B

  • MD5

    c16b0746faa39818049fe38709a82c62

  • SHA1

    3fa322fe6ed724b1bc4fd52795428a36b7b8c131

  • SHA256

    d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

  • SHA512

    cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\CR9CK\progress.exe.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2300
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3e843b59d0711821b47c35f0ec4fee43

    SHA1

    95abc32ebcfc127f0318ed6e88ad693c84e1695e

    SHA256

    0da4702605bd68837d6cd95b24dcb71c776f18e187b5c922071a7a4952e73292

    SHA512

    ca062d57d1c945ad5e0b1985df3bc8421601afe7835b8c076b9f8fac2892f6d7f6020d8daa9bee4214ccf0f4f41bccb9fcf8707098e41069b9a8f572ed90a8d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c42b43f5e766fad879a96d8c98e83a7

    SHA1

    6b368c5d923c7706e215607c99ef6f5066fcbd91

    SHA256

    157558a40e589b47c6561a7673d7443bec76a9e252cca1ecfa61f59308fdf4bf

    SHA512

    a412aaee3ac26d3662d72e8e8ce4a396115a307f3e4486677e500adf2fc394e3e4d28aab82f55faee5320b40a7c1830b62dc72e309c022017a26a90bef1265ba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    864c56c14bf293c59ef8831d57c1c344

    SHA1

    f4d8856f3e0e324ed69567c79a80ea0906fab839

    SHA256

    824a80576628bbcbc6b5fdcb7efaff2a787188284abccd47c83a8835f7f2f994

    SHA512

    b1fd7369429c8077b0d56a52a774945051290dc56745063cfe902cbe24016727cc669a0705f709a05d037cc005f179ad6176bbde43942c17a4e174b403b67fd3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f9fac987f02c661c058e5b305a25be89

    SHA1

    8a8538795f77c4026f1bafdc10c0e233f981605f

    SHA256

    e71d79afa89c3092ab7eb4974f39c3343df540bc1d84ab200b29ceecb0ae11c1

    SHA512

    a64f56ae1714b58b36c6d8d6abf31f09903bc337304f7ca3c728c3f646042e4b99b054014e724be3b50ddfa81134c945df6805a9a3fbb83fb903e0de434353e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef963dcb3b4f0a9e01fd2a6bc4c85d84

    SHA1

    7c2bd9d914eb05e997e334eba0036d903f3697d0

    SHA256

    a3d433751f67ec336f1a5c34de95a1ac73325f87ae6c8cfea32af82deba40d75

    SHA512

    a86e716d808e3c6dac24df43f723e96b0c3e2c85899e18e1d73abfe4d8e4fa3afc446f7b834752a63ec38afcb7568e4bbbbda94c58c0d20fe991255a8677168a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    856e1527f377e13826e5fda24b29f396

    SHA1

    95cd7f943c18f6638e9d8f7f6c9589e9287900db

    SHA256

    f9da138b51bbb761290fa4bfbf4172720d22593344fb81df43c6c38fe2755039

    SHA512

    4a7bbc7fb20baa0cdc2a5ac3a4c64f24cb9ab902be0f6fa7f2707456d77fd102d3c1b86956ba8f24349da0150b13a3e8d1b5a9d454163bba1df4e3b9ce1fe35c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f35f99ff67148353f4c96310b5c5f3b

    SHA1

    a62869afbc7a0e11e6a8ef94efb34b923f9ff5c8

    SHA256

    2d5ce2a7368c4947f0f3807d455430b315be034d7be0730dade8b4573edf936a

    SHA512

    3987d2b59cc59234efd39ea60f5c19a6be5cc0d913fb47120fb4b6354bc9006047cc83eb51f5d70e5eb5a6f9f185b9ce36505a0140696b0c8a77d0cf123bebac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    45cd22fa4acce5bd5d7b95ef55ff161c

    SHA1

    38393a8e53ad7b221086f2fe911167d10853e9cd

    SHA256

    f6aaa432ddc006aa6858d489896ca145429cbfc1f4e6f525b6e4a0d980b1f842

    SHA512

    72a33d9b088a005d972f3b4628618e431e22515f1282891d5beed53dab5f2257743c527d98bf2cc2c1409ae96b40ba3bbcac3b9edd5855ad02683ca69c33b57f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c996ed2555edb6cc36eebbff5fc2d9f3

    SHA1

    846caee8625e261ee29389a34694a69906dddf70

    SHA256

    755250765b1541aadf38d35505db549008ec29213e62057a3a94328b12a9691f

    SHA512

    9365aeb3ce8e9b2e57cc894f3fd617cc9f496ae70b08cd0d35addeb3ea4915c26e1058abea1695395b41f21de4e89121424051b27f520a5974a2a3c5173c6b16

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eb08394acfa6a331c2e559e88b0557ca

    SHA1

    dab1978b7dee86801b77260b3bb7e7d5cbe371cc

    SHA256

    fa4cb8581cf086765d79e80b645a61bb98bedf703dd727c3eef0e615f69dbbb6

    SHA512

    1b77e23b9fa8d67d521e8c3f1a7cac4c2a99c2aec6e4c321abfa08133e0a16d9b8e1f9934cfa54341be9afafbcd18189844d685d927304577484c2f2f7780bbd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40acbf39d74ccf16dc27bef8c0af3165

    SHA1

    41c4e07ad685322c74cf28c1c5933cb75961c1fd

    SHA256

    fbdfa9e99399d5f2c0ee8984943cac31710b88b7d068f8c117de6df773167d1c

    SHA512

    fae3f25185552449154e667eaba70667cac3aac67a68eef72f284f27535d1fd94ec5ab576abb13556b557d8f4b74d4399729d8032fe4f948e6bad34dc43a905a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e0ce11c1a381e5560eba136f3a43aec6

    SHA1

    183db60f7a8c1163763d335c96c229065272d1a0

    SHA256

    2717dc14ca68b4b38ef0cbcd56ee073ead1a5035c94e449fb52bac335c530fb7

    SHA512

    93a9c12b1fba36f7c66a3158e153137b048907b558314f1769a051fdf9cc4b4b14115f1aa27c6193bf22f9416588e9ef4f84883c972c1261cbee28323bfacecf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0901e75d66ad24992975d7ba92853718

    SHA1

    269a68902eb046fa185e406b6db93ebcaca7232a

    SHA256

    e1bb28e580dfb61168a6fcac3f64c2fa678855492e352d45ad8820cd2d4e1cc4

    SHA512

    c4d44a62e561bb84b32a44718e261ecc3f63a112dc51ce92be8fcc4b987851cf50fb97bb17599083712566a084904850913164cc9eae1ba3bbed7d88a91f4704

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0ca0561b13a3c4938d4b80334ca83ee8

    SHA1

    cfb48ab6d4c7598b58eae1abe5d350d7166c76c7

    SHA256

    6d8a1cd5cd3114568ec6561a19cbc7a99b0fdc8972276854e1cea57440e75d40

    SHA512

    4c9764df6be3b9ec85ac13fd794c5edf2626f53c6dfcfa5010d53df0f0fbf31f56f6f22cfe79dd0273fa12a6ef3463879a7e95e744bb0ff15568b2affc718107

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e754c8aa2584e0a6b968652e81344c94

    SHA1

    ab00e62d33e04edef079968556c5d8931ce2fc33

    SHA256

    f8db7d25c535ffd0f682abbfadcefd6889502f12c6e81ee17e5f277853fd885c

    SHA512

    ea28cde4fa361d02b264e2287a0457c25cae6b6ebc51c1ae32e63a319f31f1ae19b3b52582b7a2204b519dfb0b286e9ec2f243f4c106f5bb9f09eb4778ee5f3d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9ee5e16305073e2eab52f6e6605b7a23

    SHA1

    330c00fe9df7dcd81513f9ebb1ca53f46bec9a32

    SHA256

    39b248706dba184c5216a979c27fae3defd372c222775886c620c36321022622

    SHA512

    a17bcd725edcdaf3b13c0bf559bf7f32d29e333870e61975c8899bafbb4d30020e92272e9a2b2d0eb8585521fe7f893eb1fc234e1905a98b11a995dd981398bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2e2cc1d615728a227c5e5e30f4934ff9

    SHA1

    add98b8f9a22798d54da9a565d74d6686844e77d

    SHA256

    96c26d8b58db1acff687fd5feed898e41bc97fd8aa696223f842ceb096210fc1

    SHA512

    67019c2fdd7bb174322a7a84b8840400414c9079634574cbfe5a8ba0bd2e56a87a45ca6cef99dc3be30393deb77cef77cb8a4bf9c7474572b93c6a9cdbcf5825

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca2c8dc8900152703ca4c2ab1ef0c748

    SHA1

    c57316012f68d78c878f966531dcf3e3e8a18293

    SHA256

    3effdf851222ef6300d07f85796a1c3bd3128728440dd2d9989c046bcc5e2427

    SHA512

    cae94fd51512e448b63aebfe4ef408606f134b767b6bb996abdc927b3418bc8b698850a370a3e431a22fff1e672bdd19a6e7b066f49665a3a53383d271529802

  • C:\Users\Admin\AppData\Local\Temp\CabF5F6.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF6D5.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b