Analysis

  • max time kernel
    359s
  • max time network
    363s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2024 12:15

General

  • Target

    Portable_x32_x64/res/cravats/broachOneill/hebrewsNae.xml

  • Size

    23KB

  • MD5

    ee59f6e22530309aa1c89e1826b010c9

  • SHA1

    00d80241a03d28c42816868a2c4eecf4bd0d071f

  • SHA256

    4159a3468eda56949355eb5fda59539d2f08bdaafa8fd5021e57761b1b5856a2

  • SHA512

    fd84ee0feefecbe7207f5eab36ddb8e4615ee2e21e1e469775c6cfb60210e22916e789fb185375d3f24f57455e999f771a1a6a19f4febc1386931370f1111e99

  • SSDEEP

    384:AoyJutAZGH54ktClFCYqwDnNEeuVXuu0x9nDRcbDWtYdl121kG/V/3Rq:/61lF5nNEHbYK4Ydl18kR

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Portable_x32_x64\res\cravats\broachOneill\hebrewsNae.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c6685c8ad05d8d7ade15038537caa893

    SHA1

    0ca44d39ddb4fbba303e72854cd6028da566a2ce

    SHA256

    5cd3cb331c7e41bdbf919a08da1a38896d777dfcb7090b82fd0784f2818340a8

    SHA512

    e31e47f8cb253ef7452f225fa12d49a87b133ba6f218c269d1f0f838d890067e46b36b69789cf3d736f87c3927084981670b9b42cf720ae67c17c1359e174997

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4d795798774d9c31cebf5736aeb37a89

    SHA1

    3eaedd583e60e62b7cd078c6e8bb75d32279f637

    SHA256

    694078b2b3ed432d9d001284e01fc67283c5b2efb89bae48dfea2227d98799a2

    SHA512

    59ed36b80b77e075eaac7e4a72e66f5474e65ae09f6c106b7949ab693484ac0e6b273e423626f8bdd3e439253bf91a97d0d54452277574cd8c305728a6dd5901

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b5475a6691b1e6eec9ae6a94d1722617

    SHA1

    5685acf52d52ac81dafd41c80c78e729e4db3b05

    SHA256

    55cabf85a20621b51689baa6658a372525e98ec4f7f555f0dbc56b4838ba391e

    SHA512

    f59ff46124a930fcd2844cdd3e4b3dfc2f8c0ea8dd8e427390ba609729b6c6886cf77a2a84a2db13d10bd5369bccb69cc5bffc22d77fcf0968ada4176d3dfca6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3471a28daff55431ace5b8a8067a2da5

    SHA1

    0d6e5695792ca11622974db6d39699e45efe4b22

    SHA256

    d5eb38d7bc64488eab15b342e04e1227d92564ec048622cbfa123c004449345f

    SHA512

    b1c2671d903a2353e53d1c501f26e5c16ddbe91f9db26098fe5cbd033768773d97aaed0a3fb2ccc72ff792fe05a55f7a0a891bb785e0a62bd920c993886ee187

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    160af30f9fcd0585c7a5d8dd1ab0ca7f

    SHA1

    8002bb67060e15b0ca3f5d20296287e86a17918b

    SHA256

    e94d8ac8ea2b5f2e4acc708438d09779bdbe2aae18b56fb2e840b6ed0bc51258

    SHA512

    6a517a4aa395faf2fdb896b164ef8b0711341e576d4641937b55cd6d7c3e1a42c456c27a143609e19194169a2a4ce267a5d0575557768f1fe81c2dc34fe3cb30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    23b1ebba0dedf7f0cdbdbedc751b01b6

    SHA1

    7d33992bb89ea17ccd82aab4f985a25857f23ed6

    SHA256

    30285d067d6ade12563fe7fdc59496ae9bac6f0d99fa1ea0481cf514165e3067

    SHA512

    431a1c3bad5e404480e85327cf15bf94c32a4fdefa71604cc93fcfc1611c32166a88802d35e05f135d30c5b136c01cabbdb3d3b4a80965c122a3a2d9ab62aea1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3f7245429c64f1728690064889845999

    SHA1

    5c2507589579546c95fa80b2e8d25a54a9f4dc47

    SHA256

    ce4fa16d0f451a8a17b3da8389cb5a7a17fdf2622c1760ff1699258fc9fbb1bd

    SHA512

    710adfa2e8a1d297b1051045cab48ec57b6e73a1078aebc0093e0de8ea721845542d3cf9dcb28fe8f194252eb9bb08aa1e98087cbce5663edd0b4e80983ef81c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1d5bfc8c6b2ff05546a576b519450afd

    SHA1

    48274ff68947a3ef7c62b8d44237b9c15a6ac11e

    SHA256

    fb722d6d559b022659670ad14a95204bf5a6099c86410a9226717d72c704c914

    SHA512

    ae7b0f818f83ce7b8152bff5a9699ceb0a2b62137ab132fb8460cf1756a7b19313286f039d9c52779f055486fe2cfe1bb49616e352170b6f3578f45f528aece8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8906803aba1a7e94c2838ecbb42f6c6

    SHA1

    ca949530306881b50f89677e744db4897ec1cfd4

    SHA256

    04bd5622bf5558da6cf1193cb9458d19c2ce70a5fa57445d697307406fecb5c6

    SHA512

    57d1edba30966bf3fb2b7289b6ce69a45156bf8a2ade4b657d089267f9de2f7c3e1a3a576b980f29d380246af1211ece8b0ae0d0438499a6967bc0d48c7e9e5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f35c2e396bcd6e2dc2961087ef67aeb7

    SHA1

    c5489a21cd36f83e0ae5edcd7f642a3c368176c1

    SHA256

    1be3410981f549adae9f86cbacebb22decdaef9dc12c10515142947ce4228ac0

    SHA512

    ed1ae4da682873bd322780b1c230aecb612fb9340921e27c03467413e516d6cf7b9c9eb9142ba0caf941cbc30b91a5c62d1275d609ce522a3bdce3b685bca071

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2f6b1bd2e9b32b343b5530a49110b03b

    SHA1

    b886d8bfd6b085b73fec2cc278e5987b2627c821

    SHA256

    4f27cf6cf6b7e17e769e157e6dc1850f8ce6ce4790c54f77df930ba4202db658

    SHA512

    6bec9d8fd5648be49ef284d6f4a07b629401258afe4f916e073bfe47c4865fdcda15c15e45a6e4274522fc95a05d4f65608bb48dc7f6e27d97a6ba76c51eaaf7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1691ea2cffc7a3408dc9220be856876e

    SHA1

    15f613a0e95f1ff091b0903e579d8085f3ea3ba1

    SHA256

    6331d0a57195953ead10b3d7c80407bbc0fb9fab2bd4d1510a6e1ad0758125b0

    SHA512

    d3c994c45f150d236451595661ad753a671b1fa10739c5e5f926d4b5be2338a10c6a4165c8bc2598ed8d34dd8d2f20630c359d69979a3fce3c3e2829e68f5b79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4cd4d1b8af598cb8a8c94590dabc182c

    SHA1

    b7796b3f5372b343c6f870fd241efb407d9ddab1

    SHA256

    d0bf7bf21eb9f3981608ae18f10ab64f482b01d9dbc6820c1aef30ffd5038044

    SHA512

    f393124b43e61ce7ab461a1c820e79736b9750e246597c1fa4ccf92014c044f07aaef1db2f350fa5d9a2cad0c5592341ddb19eabb5df0ac93b6a7b75dd1fd21b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    622f5f1d9157c09867b7371b08d8ddba

    SHA1

    46832e416204763992fab7a4fff2e079febda6f9

    SHA256

    9b4b7706d6f15870e92837b8acab2bc59e46e967800efc890ebeb61c9c4159c2

    SHA512

    17aab4f9b7be76103add93f1204925326ae8356b0fd8b83c54b7f940b27e64044928f6dcd10d828e07bb0a6ba1307b828b570bf8c18e1ae169368314a389f691

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2af9182bd9bb0a90fb070404249b8a6a

    SHA1

    4ead08813d4267457974dd3a3178b495e6fbc06f

    SHA256

    4c802db38c1b7ed7efd58f6724713ff9a1544a4f0862a1c1e16a34f31a4b384b

    SHA512

    d7315f0a1504137d08a3de32a9d79af1ceca0dd1e6a9039570434d0d2d3b9824592d281f67eee2fe9ea055b73c7c1a3a9342b361ff9c54ff4c45008184ec1cef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8b4182a1b3e2518483fb928b86e2108

    SHA1

    2e569d17afb1e45f7259aa0d1f675c1ef9fa488b

    SHA256

    b2fd4411b732e66b8c150d9520941737d301fe3a15fdf48f63ff8f03d7331878

    SHA512

    324a8153958c53c15dcda6a2bbf036f6cd7c1fe8462141f09df7801d23eff4941a69c129f94c2d0d4a77b79a531125bf281933acec41d4ef586fbb078318165d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    faf296d5e99547737732a159544ff8af

    SHA1

    fac3fe6f364f8ec7a70301a535a2383b3e7f9180

    SHA256

    9325010dfb83300b54ed52c90cbc07fda6fcceef11bd0c0165fe6615a65dc8fa

    SHA512

    29bcba7306cfac62cd613da21fa7e1a9b20ea3ce23d88400056e1750e64377f53f49a3f59c7dc6b5d97fcd04635c91e3495e89402dcd75d1976cc479b045642e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2dc6e74c5d05710b5bd643973d2840d

    SHA1

    3b9275cf814a4f8ec6c70f1253a91aad548ac765

    SHA256

    5312116c930dfd62eceb8ed6d06612008731bc9623b8d08341cda182136e4087

    SHA512

    4ca1948505cf599cedbf516db666aaa0d75767340a6368f8cb0a09fa152e658ba0abd10f6374fdc2907f7e4e34c6a4d0b2436ada96811d82d52d620689b8cad9

  • C:\Users\Admin\AppData\Local\Temp\Cab959E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar960E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b