Analysis

  • max time kernel
    133s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-11-2024 16:37

General

  • Target

    delegatedWebFeatures.xml

  • Size

    17KB

  • MD5

    7fd9cd05f23d42fb6deda65bd1977ac9

  • SHA1

    df25a2c9e1e9fa05805da69ff41337b9f59755fb

  • SHA256

    ca6c469655d4d0d7ce5beb447dab43048a377a6042c4800b322257567ac135d9

  • SHA512

    6ae8addf0c55058803305f937593ba02202c99639a572be0cacbfde598019cf8db7067e0392bd66c43cf7d8780e454ec5e08d68bcfd491b60a450ffc280c81b8

  • SSDEEP

    384:nPzOC+5CNMCUDCGxkKp2Z+TgNKvoUwyBDZS/1pMimimp5F9aQBb+ZIo1PCCZAhy1:niZtnLkKp2Z+TgNKvoUwqVS/L3mimp5i

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\delegatedWebFeatures.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2680
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c659ef6b1d7691285a226c235adf0e8

    SHA1

    e90e844eecba36e79d9865b311296bf8cca04ff4

    SHA256

    06ac5d76bcc0a6a2c6b5ac4f3d25d789c03beaf3ba7e8b61023580f794b19c28

    SHA512

    a569cc17464f75f88f2f8e659939162e51198edcc7a8bdb0189cc835e862b928e110d22e5491484417fa5a5060e6f0697090230b5b2f70cdcc577111af9d379d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d5c0124641dea40478e751bdc5ec4dcb

    SHA1

    e2f0ed841c0765afa2629248032ad2b3ebe1e270

    SHA256

    c034e04b3eb63ec56a27dec845b5c621c15e771e42835b2f75cc47320043963d

    SHA512

    e4ad190add1b5963a1c4fa2b69151cc6ebf56ca7ba1238508e772fd2eece9ef3090b3f12ba793a96f6b0ab066650fb17ed0b24a6f793a1213a8cee83e2c5e765

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b26d69a1d01c3e21b80030e3773a16b7

    SHA1

    c7b1bbeb3f9981a3ff58f0ca00395144bde7f6f9

    SHA256

    50b9f682f8d7c9946cbe918abd2be7ecbf34416e522add99b549adca1e3defc7

    SHA512

    a28a5f35d2cec20e9768fc53e18e152dced640fee7588b6537e4a57b36c77b95d7f42ea696955a54bed43097d88203be5507701ed1d0c6a259ef3a3dd805b4af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c7c70c465ed5e21ae07d8eec5f8f262

    SHA1

    ca9d53dfdbbc5f348f83ca675133717a26848483

    SHA256

    e582cb7914b30133dc863d6dedfc1687eb895d9762427eaf254b8bad6eb3203a

    SHA512

    baea1f1b6577a74211c3aeea6e0e52ed8d11a2afa274f926b6be8194ecd674eb6777c1f1bd00b8916147edc27c4dceeb6e833214cfd8cb1506409e01691d8ae6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1f56567054ff395445d7a8a27f2ea068

    SHA1

    656aad181968e74e9c9bd3b56283eed938918cb7

    SHA256

    a4227a02073030db469e859573016d0de0b210be9ba3bd6252ab32f16e9285b1

    SHA512

    d13679efc6101d71b4fa7837f8fb96cca70b4513dcd46bae79a865b9e76a9881406303cac9b3c010efdf4ae2e9865b8eeef40b3efd5bdd0c17c60132d7ece8f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b1a8a120a81ff7684603d701e6bbc4dd

    SHA1

    cb9bbd7bad1172d6a88e66da6c7543df2bc04361

    SHA256

    c962afbaa7e0e921167ff64939e1dab2b682378a94e05c9c4091ed483aea3468

    SHA512

    484c574e991bf09e711cad3eff111a5faeaeff2fa618ae2a9a6784e812dbe97567d9a2ca62d72d066fad3f57a8689a8fd8dddd2878a3348be996242196e1adf0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    529c8261f24fc58ef84369a43502a88d

    SHA1

    2636beb9650b487879d8088e9b97a7d2721f5c62

    SHA256

    0da4e404752f15ab94012a8968169dfb322c055d5033b90ccc2310db5e126b5b

    SHA512

    e23e2f8f2b810fa594fe3baaaa33c3bf1b1e82dbba974d7ee1aea7e2caa9ebcc9438f46e8e9e138f07f5de0b5e185dc733fcfcb2dafa3e5f1e80f9ce508deb00

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    abccc4e35cf4d2d95d45690c0964193e

    SHA1

    d955ae942bb248097251f87e5f9cefdb771ad0c8

    SHA256

    70b2c0601f25431df4e138f7ed61a72005f6f79cc9c4d9dc737f58fcc9cacb6d

    SHA512

    96b0653a99159290174fc6634e9411efae2856f84f3f2639690975317f024aa2ef2f05e4ec28e3215857ed382aaa929350c6a74232827a4bb76a2119a6cf9f2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bb8aed38b9fcef4b079d5b678e55e537

    SHA1

    72d682ee2eac4a6769124147bb636878d511991e

    SHA256

    8e6ffa0cda71f2d9f07d68f238a52f25960a92d3eb9f8781dbcdabf8e7a2d21c

    SHA512

    eae3994fba5c36112488d47c6d785cf583498097fdbc751a3f5768a14a54ac3169b5664607c87b7e20a35103e550b9b6445ffd4b8e32cb481606d25f2e4fed45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b0c8fcddb0e00039778c52547b4ede0

    SHA1

    8f0be1220cb2ea6036ca66a201dd09f4429a01c6

    SHA256

    10313879eef0f96299e855638a9e40b75b45b1ebf67d5d2b5daa26db72df4eda

    SHA512

    d9f540fa53c3b1a94bfbaaebc3afe5757e9b5673172f3eac934264d278a7bbab8b9cd7b5ef81dec01bab684dedcfbd9ab2a6554d85c530850cbfb3091fad1545

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a1f0a83a9c18f5d9327f4da263d9805

    SHA1

    70a6822a632461b83e06dd558c7f9925df8b4c67

    SHA256

    9918e184e4be5c6765cc71f7ea1fed740d066f58853a1a574e523dec85071693

    SHA512

    c1a434545841b97f2227e67c58b330a8586f7d860ec9c5c198a099dfacc5742f28e86cc4955cd0263aba840e0557c4f8a69d08d7807228b93462b7ff3cbc35b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a260310146b20135fdf5dc5edcc23ba6

    SHA1

    e18b4af18bc6ad57d19c091b30cae9a451d9a9ff

    SHA256

    adef023e9edbf9d62534f755baf00184f714845cc82cba9c3573168fe1009f24

    SHA512

    3d4841fb2146f23553a728497ca2164398621e4069ea79edee96e482d44b2b2dea6144bcaa1aeb5c358f3ce22826d2675deda8f90402532234600cd40bc90622

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    85d13c714ead07c6ac17a3be21a1d575

    SHA1

    d7bcd22350e6cd3af5347e75c03ab83fd15b4a1c

    SHA256

    b00b3102fefe83b57ce01b16fb8d3cd9260fa17a0a16b755d18ab3f27fa4f0ae

    SHA512

    0562d394cae94c0ea9d2eb246ae296ff6ece69d6720545f4ab8eab3c3c0d5ceeb466860fd817c40c00f324a82922a4c8c6f21245418590c41758257834830f09

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    97ea9e555cfc553add47130dd2640f4e

    SHA1

    726b5488e220a7a2726c28b24ea23b0408644f7c

    SHA256

    2c4703fdb8ec24f3c60c9ba9fc6efadf175a3096e456060eafc4fd678cf54e16

    SHA512

    7ce13e73583af4fed3bc46e0a3d8eb6db2b8a6181d9cc567fdff2da01e783113a4ad47a3f14a29393cc7cc6bd5fdaa13247a46a1dc27ed4d08562b70fc10ab79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    67cf5cf358c9acbeee864eed98ec5ce3

    SHA1

    3ef9854d2ff73eaa6b2d41fbf009f90b4ee78144

    SHA256

    9e09ef378d842601e1070ee38724d3b14d77cd80f5ca9e8876e9cf8ebd9dd146

    SHA512

    da929ff4d108af239722eefc51f800617acfda249ce59ea559f58349e75f853e0e96c41b145810514796540df78a9784a2c20359cb8024a89850b25f05a20a20

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cccb284b2f7c3930c8f5294b1c372b8a

    SHA1

    b609e0dcda3d0819dc54826461511db54ad35696

    SHA256

    d35b3b5810bf3f59e6791186cfd358ed2d1c515d89e74bc2e7b35c4c9d282335

    SHA512

    1c00b7a78dd094e5bed94e15e3b2763693eface73cab91421fc770e2384863af5a2a189ccd7e64b330813687077bfc95114de44000ed09c9a1a47d898226d30c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    26c9ca066e8d43505bbeaa008d1ea855

    SHA1

    88ed8ae05a2720e1b7c5ef270978b3bdad214b44

    SHA256

    4fcbd10825e50847f76b2745a8e53b752e112b32493db056667f606adda8e025

    SHA512

    ff5b7d55400431b0e546ce5c3e6fbef878b8a35dfe574ae47ab5fe8c75d6c67c4a1ce47ce602df53615e0a79dc9e3ecb99973e42c9c1f2472039dcb17f9d2816

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b5d82a425aad14bced827c0aff5b25e

    SHA1

    54e1720f9f102b01d4a0fa1cd073484908dc1beb

    SHA256

    a1a3f44514bab944b19a113e3848ae6427345a7a092d426d6bf48bb809130d8e

    SHA512

    56ec2e1d5fb52975343ed2c6a481b8216444e1580043554228a67517c11393e8f143eb2ef77bc7d1c00345f988b9a5ece7b831352c67ffdcf4228258431d0c04

  • C:\Users\Admin\AppData\Local\Temp\Cab1A8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar238.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b