Analysis

  • max time kernel
    135s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 16:31

General

  • Target

    622001c8-ae1b-4bcd-92ec-6930d0905a13.xml

  • Size

    13KB

  • MD5

    f3fa445881d45722a5d0b2bf7c26be9b

  • SHA1

    bdd0ad8c5d03b5232e7b8707237b6ea0c06dcf25

  • SHA256

    ec93510bd1b88928aa6c18c2e2114e2188f9a586f105fc8af18e469cd16ccac1

  • SHA512

    f619a2d8a4cf2282f669bee81506a92ad0ab7e45187a81a52b01748376752a5590ef09feabffae62d23f01b47e02bc3f934cfcb22789e13bdf90cb1f1f11f359

  • SSDEEP

    48:3v8ft1pRoV1p/Kd1JupQzBzrBktJEJdkciV+tATQWNwEj+WJ:It1foV1Ed1wel5gJEbkcitnmVO

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\622001c8-ae1b-4bcd-92ec-6930d0905a13.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2648
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a6bd169a871e87061cfab2b614400b4e

    SHA1

    8d569c72e2e6d029f0af0db04ca231f6dd466d9b

    SHA256

    43754d744012be2814e70b1ca288473c1302da920f35607cfe76953bb066cd2b

    SHA512

    f91b8f9d7c0cc419dff4eed9e905a0001f0c880e420a81575b20735da4b6880c53215cfe72ca9f1f0803e89382ee2d43233185964df893777c8c84c75b08d6de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa88a2eb7b4e06873f3b47b119eb35cc

    SHA1

    77de4d452a2d29d9991abe8bf7bfe3c3ad8f5a30

    SHA256

    495680726a232660bbf28ad85d8f3817d51389b0f449ddaca680a5b21c240d9f

    SHA512

    83238e98e346dd381288cb9c6be5ab7a10f3ca835f63e6239c711a2f3ac2668e3e47e27aac221859ee2f4ea1e60373f22fc0e31252b06edc8ccdf26cedf3b50d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    34faab3a266e1381e35d14225feede23

    SHA1

    29405f8ab73aa1bd18a18003549dfd994837de64

    SHA256

    23ab50929c944c1ad36fbd3f2c319aa0ef53327532a7bdbf2aeb3afa8f8be5a5

    SHA512

    5f1f4b8ba465da3bbf26ca311734a0de00e8104a2619d124f7b4c8aaa7bcd0a82efbfba6ea17d3b2ef0de8de428d283d5f8ed185dd56af999dab44b1f0a7cd40

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    20c41ef07c686fe34ccd015379c639f9

    SHA1

    eebaa06f416043295e9e6888d87fc5c44ef7259f

    SHA256

    7b7bb820da4cb9124c91059628fc1bfaa4ccf63ac555b957f26be9e8a855e5fe

    SHA512

    daa0fcd9797095509c3c8be95f07de6d3a3b04981a4a05c1ee3932116df7ae699baba382dc450e3b6562f1795faaa4bf613fe8aae5ece4d86631d01e5069017e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    889a59406f364ae1dad8c1521fc387df

    SHA1

    cb9f6e4f7f33078bd58e6a904f597cf85e0cc355

    SHA256

    1a854d624f7fa17bb5c451bb7c18322ad1df9e7f822878d1c729a53d0193297d

    SHA512

    6d9674de2c88391431065a6894a01d6567cf3282cdeaffd571b2d73518390e444ade4ebcd95e04a29e61b71131a8a438648a227df4f4307f4ffc90c7872f6b28

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    edf6f650ce2e1583c95e9fd246390716

    SHA1

    7b0ad063bc0d771c538e8ab075f337fa37c990cc

    SHA256

    29a70ede7ea17ed32fcdc8e750dc322fc414f56ab4862c01c88a4b1260c72cc5

    SHA512

    4af5e34d4966956f4760e68abe12a8ee23680bfef8dc3a9874ba07c3aee67b8cbc0948e4c76e44290b22d2d8f1ae83d46c8fe60576675513a192ea6a2e5a2302

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8030d651183b11c7592a76cdfddd15bc

    SHA1

    f0278a04f19e574ac5e0db8df0dcc5de6739fbe0

    SHA256

    f1c957633a1c8a1161a7032c58ef38481ab6f9660e8f610baf25a8cf554ec261

    SHA512

    6229b6db8358a0e0aa338b0052816fbdf2bcd493a193c7f64361e25d6357197fe462785e6b5c51c3e34264509b35fb2f11506c8d57f149c75ebb6efc5fb8a2ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b6ee3e8747d779aaa53264db6c8a26b

    SHA1

    73a2c9de7742f3b39b10c2926ca597b94a04b5e7

    SHA256

    7623b9da95d22daf439177dbacb4e757bda80a465a762f031a94b28d06b591d4

    SHA512

    bb0de5eb434b4d93b4d4b254745b8d4e83ab376a312e49b5ef8935bdac38d9e4516915ad6b91a33f54bd2aa516c6ff23bbd65d1eb80d2539ccbdd9b99b9b74d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd91429a95e98a2d332b5a248daf3fca

    SHA1

    cfe2516f6333bc44f83a60c1f6d86626a6e321e6

    SHA256

    6fb043f33ee1508144e276ac6415ed93b7f2d7dcaec40c157f1988103fadb3b3

    SHA512

    a1732343bd4c30be44b1d7cba9dd56b91c4c1e42037191249174bda2eb9c0165e53bed7de9ac94e6fd712b9bf74a114e95ce57a13624f292365b6a7348d82cf5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5562434c6dbc8f19316bbf6355d4ebdf

    SHA1

    24d0d3059f905220a38f54df98e0ce01bf2c9a8b

    SHA256

    8ffa30f7a465bb718b6710ebf80601b502eaac8f607737c94fef1b7f43292a5a

    SHA512

    a8f1e49eef662703bdf90d8983fb1d06f5701a7e3aa46ec593fc8f7b67f7287fd039c94c3729b2f1a8df0f4905607ac8f9af577e64d00ab1a1639839f55b5b48

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f617cfee60f43a1fd2ea6b75ecc9d9e1

    SHA1

    35c5b7f70cb4c54bd97edb1698c44efbfeea928a

    SHA256

    308dd9c3cc897a1f373876aabd87111b2c87143844b41e6aaa034d699714c20b

    SHA512

    32df480123866360a2457d5bd21732a4665868c1693b6075584693ff2d860130bf1a2aad8f0a5d8f6a63183855aae32d3f9a4b23000f96e3c3dd199f115ef74d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7feb81b1f7808ba8e7755c0eea6e105d

    SHA1

    a87a4c51ebcd44a9620509272a031009671f7e05

    SHA256

    72b3822c158de2d72763b3b9159891f2d5bf2b16cf1c9741d4dc9f85e9a727ea

    SHA512

    5c4f5a4bc88e294a0575e62e125737e8bccad30b613e94ad224a65a7b3a399aea6b9d1767000f23de29ec62cca8c9572933e6be58113b0b0c6447515e1729ccf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6980bd3884bff00339c273d7d145a71b

    SHA1

    e439a3b6178945bc0c79a9a11050e328ea97e4a0

    SHA256

    22ecc7f13f8750b65f5a7a4ef93d8ceb09791fe1a799c6ea97c32bfdead4b179

    SHA512

    97a14585773189632b892288d76170106d268a3a21fdb165710b5e50a1a2118f588eda1bc1f2573dc9cc4d7ed6bd91b3a1004bacf936421fda2a92910782f09b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    138448ff5fd44dfc84d76204a90381f0

    SHA1

    652cf53d4e5102ee4fdb2de3205a19efa361e1ff

    SHA256

    f21e1e56d171c8b22b9b8e0367d9e6109b9be8935c60681d1d2347fc0e09ae0b

    SHA512

    32b87cc7bc09c2da2d415dfc8c1c6d00aa1b2bb95144e7f0d9a7a466a20b3381e297a60b0319319254efeda1566ba2fa9506eca0b5574a1c8846abc92951381a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0441e4eb5d59e4ae9b7710869e9a0cc4

    SHA1

    7ba486966cbd7db9251e5eb97dd063c2bc2fd2ea

    SHA256

    4ad41211d4c9bfb38de7fbd555e23b16da171c29164b76e99479cb7d3f25736e

    SHA512

    7b277f6bc7a471fe7f3e32ca36755fba758c1feadcd64c1292ed64a9010ba953e69b99e1f0082e8f629ee93d452aff922c35aaa879b835fd1cdd8a0ca819c357

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d4899695dbb77a459715e1fb5eae9e62

    SHA1

    d076a17562b0524c4beb5e842f545fa2b4627610

    SHA256

    2c22c73b1e4919a31a3e85730f524abcd041141ec4ceee6e7034873604526b28

    SHA512

    0a299ae4d46308d15c52d7bef74bcea061cdd24d06533ca03e6366eb0f86976d0c66bbd89ca37684f1e201bbf9ed4a810b2dfd790e942e899e438121bb781863

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4105cfcd3631d8ca68ad57dc48e30f25

    SHA1

    6948390a79f46d2abda09b9171343112cde8f2fd

    SHA256

    e290598aabbfc133978763d0cf55af4b1023a9adcba62e8c5b0ecf6676f4a17a

    SHA512

    c23ab80be9adee1199c30303e07a049979d62123e1f64c45a1924dedc37f50ba91e780bc0a423577243670345200be119ab1653b2a7c10bcbc61b11f1403c48e

  • C:\Users\Admin\AppData\Local\Temp\CabCFD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD6F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b