Overview

overview

4

Static

static

1

file.html

windows10-1703-x64

4

Analysis

  • max time kernel
    20s
  • max time network
    19s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-09-2024 01:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.html

  • Size

    312KB

  • MD5

    97fece26af4f5279600387113ec7a02b

  • SHA1

    86d411a91b34dba004c3e5799a227eda84ab1db7

  • SHA256

    08f7acf513413cf08610d66b91f8a4c3a7d61514693edce9508b0c0c10301ac6

  • SHA512

    79c3f89095705394fdcfd66b7a9c506fb780639e26a4f4e5aa9a526ad8757f13981749f8623ada896bc5d3a0d596feca7728b2b295326add18935c0c0db05456

  • SSDEEP

    3072:MivgAkHnjPIQ6KSfc/fHfPaW+LN7DxRLlzglKZVilk:rgAkHnjPIQBSf2/PCN7jBZVilk

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "C:\Users\Admin\AppData\Local\Temp\file.html"
    1⤵
      PID:4988
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:872
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:5080
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3300
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3264
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!121\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
      Filesize

      4KB

      MD5

      1bfe591a4fe3d91b03cdf26eaacd8f89

      SHA1

      719c37c320f518ac168c86723724891950911cea

      SHA256

      9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

      SHA512

      02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!121\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
      Filesize

      338B

      MD5

      48cdc91fb6eb2f12dabbe37562171e54

      SHA1

      ec5d19a25e3b751af48b7b7c79908b7ce15e9fd5

      SHA256

      df7e440d7eb94303282685a1eb145b654cb4e87f5f7130bfd7c38052639d0b51

      SHA512

      f6883c87a3f6b880ebd262d7c2d0368962b2a9c54a0b9b4f79b9a19f055522c89309df2bf22b4cdfb18c3e2cf90305a7988b45f862165c310cbedabb10b7dad9

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFEEB80BF4FC5C053E.TMP
      Filesize

      16KB

      MD5

      c2289e9c40df9319746bc58ab159a2b9

      SHA1

      9cd6e17c39cf65bea59d17dd80715b2263402d95

      SHA256

      0fcd22c89f7f116c17d51dad264b93000954f3351684354ef89fa4438ef861d6

      SHA512

      eb490cbe4d6a3547775940d5442f9f6f15b24af8ae909e0f276976206ae848f83618a24c166f9f78f8cb696bc028a4458a6fcded634d2a68cf1f1b0e9e7f56a4

      Download Submit

    • memory/872-0-0x0000020F13220000-0x0000020F13230000-memory.dmp

      Filesize

      64KB

      Download

    • memory/872-35-0x0000020F10830000-0x0000020F10832000-memory.dmp

      Filesize

      8KB

      Download

    • memory/872-17-0x0000020F13330000-0x0000020F13340000-memory.dmp

      Filesize

      64KB

      Download

    • memory/872-151-0x0000020F105F0000-0x0000020F105F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/872-147-0x0000020F124F0000-0x0000020F124F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/872-144-0x0000020F17550000-0x0000020F17552000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3264-43-0x000001E083A00000-0x000001E083B00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4356-118-0x000001576E620000-0x000001576E640000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4356-57-0x000001576E020000-0x000001576E022000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4356-59-0x000001576E0E0000-0x000001576E0E2000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4356-55-0x000001576E000000-0x000001576E002000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4356-50-0x000001575D910000-0x000001575DA10000-memory.dmp

      Filesize

      1024KB

      Download