Analysis

  • max time kernel
    357s
  • max time network
    359s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2024 12:15

General

  • Target

    Portable_x32_x64/res/cravats/broachOneill/gabblerTinderyBeaming.xml

  • Size

    49KB

  • MD5

    26484e50798901e7aa126b2964129325

  • SHA1

    e3ae9e21fe7dd0fb0a9bd34372108f2232a631af

  • SHA256

    4b3bad92cdb31ebdaa0088ef4852859ee847220fff0da8b841c4c1a89e348555

  • SHA512

    861617a106a1c7c2d974531b25ecbe8d6139ed044d228370056cef91e299031f9a9cd9f0d3b8a3c7a85c677fdba7b9a1d8da63e33f61c1a559f2d0824e700df4

  • SSDEEP

    768:/fDKx05DHBVrah7xArfx5c9wiFJ6IgXuHNXUQ/UN:3mqraQfx5cboIdHVB/UN

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Portable_x32_x64\res\cravats\broachOneill\gabblerTinderyBeaming.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e285fcb950104c06fe3b3b9cbb23136f

    SHA1

    85d7484eba10d448ba38ee01fc2037c8b163df22

    SHA256

    bbb77e27abda079bd1336753e95c365da5591ad2dd5e7dcde025d194fbd925fb

    SHA512

    4ff3a45d609d7c3377bc01ed42fe2148964b9eedae9f45c5c86e4bae2d8794981990b355c89b58e12e2a6e735b334d3b9d966825d590d892e662b021d946249e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c996a3dc8bc4e7b129a2f4c72d5489bb

    SHA1

    b3d096299cc3b14c6b75b70d6381b2210eb8da0a

    SHA256

    7ad62084184d13b4be5b70f18fa5bc8e83d6f3d107740ec6cf0f10e1d3f5a7a7

    SHA512

    a48abd25fe85ecced48ca71c5cfd37f7a65f5141b26efbfe15110f1be78ebec22ffc0b763d09ad767f86137e434d12a974ad17556a2a026723f4847615e06781

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    65096e960a3d84103b437838e6febd68

    SHA1

    8d203d00e886877557485a8bb3cfe8d1aed3e87a

    SHA256

    6ff284f311af977fc41ca78fe55fdfa84ddc1ae10930a2370b25d88d288b776a

    SHA512

    e29537c46c7405988ad8f6f51bb842fef888e102e254e58c6339c537c601fa20906be740f2e53826a5f6a87696c0b1a59ed23e487811c25fb556367049d26fb1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    069748a040d5ca1207943cc04dace2ab

    SHA1

    3e2e1559039bdb26718abb030c6d1067849f0bd8

    SHA256

    929f1ebc870b1773043e7e2d7b957f5ea2d6cecfadea285c573345064ff40883

    SHA512

    10299f3b4265d38437938543505d0dff4739051bc16932e34480f049896cb9120f78c863de2880514b0861ec70faf1c776e60a921a1ba04ed75e5f31c29e8c06

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    63c82d215738b37d9441892831cc5bfc

    SHA1

    a14242c138ab1dfb8ca37db8cc81fd4ab3bf5267

    SHA256

    8efc90251689960e1908a4f4676226c2e5fe71f9f1790c5089230e2d7ebdb42a

    SHA512

    eb714a39a51929d302933108e7d44d5ffcd51245e15e28350af98cce962cee53a6f20d9ed5c8bd58bb64d19039e183f8c0be87d81ded7b1bd8f6a3129f60aa4a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48c3fd36a043683499e4b22e5cad8e82

    SHA1

    6a52c5a68c4916ceb423b09cfdb815f87746bafe

    SHA256

    17506bdb3dd0d19ad970b751c8f608fa7e811a8a00fdc5e02fae3f056c6f3316

    SHA512

    f1c0647ce03fbd2f2e090b073d64e6bf1c895236c9338952611410cf18d4c33e86bbfcff39ae4b4b783708211a9d2bb3b9e5e3ff338b345f0517988691b54367

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9bffba250a34458cf15ac3cb81d16ea6

    SHA1

    541b0d088dc7b62b12930caae01a9e5216a3c1b1

    SHA256

    2597bcb7e4c02a50510775213812ae1ff48a229a5b673a91c884adb34e0f0699

    SHA512

    580306116ba25b9a771f971717696a30797708c160bfad844aaa724be2447075e947e3043792e9a2c4844f8ce146ae2356e9b38a1a5005e62526e7d372366ceb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fc0a530d921e4473cc2bf61a8c2be210

    SHA1

    de9bfd19ffedf86eb99e77cbbf32e38c4940b651

    SHA256

    cb0186bb67172e93a267f03e95e0472231d3f16ca70c15157f1c9c985e0e3242

    SHA512

    28abbc4bcad2c8646e3291113796f12d23d7c69ac9c2148923b538c850b48b11f2fd5aba17e028e9771f272a2bb3c14261c3ad4d5b2997667e15ce32f71d1921

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aae15dd0aaa4f3f3746d7eecdac0c016

    SHA1

    d5db36389ec43377182ebf8645b7650bf204ab92

    SHA256

    003b8f38bf48877ae963b472f604d0579055e38f2e55f6a91cfdb35f15850dd0

    SHA512

    d68171d9fe61f169edcccc130ef52581e0ef0eb1f4c5aac6395c943e7a4a6b27c35addc5ced4806713663b48ecba8fa195abff0b1d9b2a224307b557dd777590

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b57910e6ead3345ffe90f4db60a6d47

    SHA1

    b9540c035d5ef57c795c3f3e2c12a1c5e5e27204

    SHA256

    72b9427fe208ed2b31bb4d759d66edbf567a2590163ca60db814c1c2b36d72bb

    SHA512

    95a119981e9bc7447d76c10f2a6e776b8dc24b28a4434d501b241d0a3be2a9346d82a730bf37afc816ef956da1445c466e6097e21f570b2141049134978a861e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e414b5f6fd2ab5f677541a2f590e8e23

    SHA1

    d3d4078f92f490f1fe46a3091f662bf3ba1a7652

    SHA256

    0d34e4fc33ea1f1f97504d125628f191864259d492f68e93747c538abb6ecd83

    SHA512

    d6948104b9aa32e78e7820fee1aed627ecae85b6c1b64712d39dead30dc0659c08313f8b13195989043e663115ccb65703766896c13a617fa791f982df9104db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    79610b59a63a2ef14f491ee813591935

    SHA1

    ad4b50c0d6d68b3ac36b807dfa9fb5db66e5f2c6

    SHA256

    f5308652e00814b60d0036a3410cdea35b7238a3ed745b2243d4c20171129b84

    SHA512

    c1f66ec8520545b116f5dd0666da21e5a43f754e3c365fdd31ee6bcd92515f968b8cda09a0f8cb0f72d66a6bd9245a917b7b859b826d8b1f3c615eff692228fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f5b5b59f04f8d3ecc83b36a9f31dfbf

    SHA1

    321e0d3cdd40e8f8852a0ffe8dbf000c5a56457a

    SHA256

    a479ac83e255ee9d015c96b78019f1133a882fe93721ff59de54d404c9773457

    SHA512

    054cf126d046bee64f4c67537ae9cc8481f098519bb5191d45c843a0d69ad35683b95d12a10bd30e4afed15e052ddc82434ffc003bebce6a972c7a8d7ecd4ee6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    188b08ff59b7e6cda782391c88d3395a

    SHA1

    bcf2a79b846e66851bbd36f67f0857af0b98fdca

    SHA256

    8558111946aed6785d5725201304cfba1bec2d45c0c4dc66f920ea9734a8d5e9

    SHA512

    bee481161efa8b6d8e202e1060e47e9fcc38a353c885a12207d0378d7efa6c6bb5828bda5cb9fcb1bdca9832ef0ed24ad9ded9567f2858d8366a4251bccd6d6d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cae9f3779e41ecc16ba00df9fa874284

    SHA1

    6b47bd39d65189bfef73f3ac07bbb5252d0dd97c

    SHA256

    11e270fdbb37abff386a549fc767a80036bf78b41ebc8857d4f6ae00df174917

    SHA512

    5b0d5e83ddbe6b4f1ba21a8944e460990e3de33cbc60a06c08acb4a211631c1c319f3c46898db7b7b33a54207f4d2040c06b7664f27106fa7fe1d231c0822444

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16dff7110cb27e84bebd85db5d49023e

    SHA1

    3a801f8d51e20eaf244e0c131be7f41535d6cff1

    SHA256

    edc7f97e19daa1d031b5a12f607d9fb7b505831efb926ccfc12ddfd1bc6a4168

    SHA512

    8a6d050ca17eab053c95ad5d12ae8c308cc80417ab428d0ccea9cea79ad7add10b68da46a8a8f8ec472448e70713dce1ec88015b69ad7c9d410759826b8f3876

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3bf067977c1d1b303bfd9d7fb1523f3b

    SHA1

    a1f6ee5e4137e190522b97eb759f228015cf6272

    SHA256

    d0531a66bc9b746f607547e3654314702ffb1c621f17d8d549b580818706e93c

    SHA512

    2c522fb75677ae4aa8cbc5cb0e33f1546464ac6248cffa4c2bcaee784356c0dc76f4a95463515bef2553762820dd47415918ffe396acae0cc3a3fc0d4bda7780

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8a25f6791fb1eb10919f3fb6db511a39

    SHA1

    cc2728790251a368aacc2e602c7da8ced697e185

    SHA256

    7c667250daec2e58ffd27e208ea16b1f0879b21da00bff2276e20b5fcc025f9f

    SHA512

    9e53d253dd8d1229505d7c7c7064d3f0ecf181e000447bf238a10445f317bfbe2da6425a04c5f81eb9f9477093e9a83273065398bf8c2aa31ac4ba207e96f6a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    935a991c9446d6a61c498168b8993f2b

    SHA1

    9b8c2a95b42b24e8f0649909a89d2ec74b866da4

    SHA256

    335f2cdd598e9d30b323314dddb84015abbb381db21cbd983191d874cc9c7ad0

    SHA512

    700781931f2a7b68d12f8bf3d84566e6ad3bb571af044ef86d610d207713d8064239c3ad09c300090b0d9fe678afebd978b65a335dd0daf4ffc019243e4c36ed

  • C:\Users\Admin\AppData\Local\Temp\CabE505.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE5B4.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b