11505cf3bd90ffc80a27250d7386d73eb9d8254402dacd86573b2c54c90e5f0f

General

Target

i am 27,white curvybbw Unhappy.pdf
Size

26KB
MD5

5a26a72341a22c53d86de96a6d8912bf
SHA1

031442f098f1881df191480f5f0ba713dc185c57
SHA256

024dbe2e4167de82b2ca60d0a1d2b2ea12ec2bff4e44afb019887c19862864c3
SHA512

d49dd2544d76d3eb790004a71619896ba419457eef3a9c86392cb81f7d5c7c43d4c607e35726ae6bef977d6c3777ac463c2fa969d637278d4df4d24e00e91e42

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab67e088ee02c04bbbb148a8e2b6ab97000000000200000000001066000000010000200000009b1ac84ceccd6b30dcfe1e83212e99422ed80c5eab0832d5b73698ec3d34fea8000000000e8000000002000020000000c8873eec08d385d3bd3254e8df1e57b0e7a5a26ed8e2a507c7fb4887832daed620000000c96d5cf739a4d85e48b63694647e38975659f04cc045da09fff17c65529cbb6d40000000058f1abd9c551a2d29a91051c46dab0347e89b4f5333755a13007e4da2bc82615fbdf91cb8dc4ddf4e9e741ae18fdc4ac960dfa26b81f49956202d881e864dda	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab67e088ee02c04bbbb148a8e2b6ab97000000000200000000001066000000010000200000004ea0df7f0da569ce3594c6fbe63c150437f60e8d4f4154792c85cb093542f714000000000e8000000002000020000000ae608d5a444ce423191d1706aa74135a666511828af5658b2dd78b892fd4d5aa90000000e60fb9e2366ba8d3a03ef1785c718af5398e2e2678211c02cc27ac36bdc87b160a8567b130419a31ff5a72b8bc8d1069afe888fa8f92a66cf3154b3a8a27ed2f3540ac06baac199425d6614b9ef9eb9f33430f62e93d9360b1ffee075e79be6970068991dbe359343cff2133175578ebafb1bfa49cf286625d55613c63c325a4cb3e434f228250ba1526b176ed02294c40000000a603968604d3c82c4a3cab189be6f8b68914c995526811f7d9da90086ba039da25f0fc41bd4455b4b5801ce4c17498924f00246b84ff021aff5f57b11c1f96c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b020bc3f1383d701	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67391F91-EF06-11EB-849A-C2EBB310CB62} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "334174609"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

iexplore.exeAcroRd32.exe

pid process

792 iexplore.exe
484 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

792 iexplore.exe

pid	process
792	iexplore.exe
484	AcroRd32.exe

pid	process
792	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
484	AcroRd32.exe
484	AcroRd32.exe
484	AcroRd32.exe
484	AcroRd32.exe
792	iexplore.exe
792	iexplore.exe
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE
1768	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 484 wrote to memory of 792	484	AcroRd32.exe	iexplore.exe
PID 484 wrote to memory of 792	484	AcroRd32.exe	iexplore.exe
PID 484 wrote to memory of 792	484	AcroRd32.exe	iexplore.exe
PID 484 wrote to memory of 792	484	AcroRd32.exe	iexplore.exe
PID 792 wrote to memory of 1768	792	iexplore.exe	IEXPLORE.EXE
PID 792 wrote to memory of 1768	792	iexplore.exe	IEXPLORE.EXE
PID 792 wrote to memory of 1768	792	iexplore.exe	IEXPLORE.EXE
PID 792 wrote to memory of 1768	792	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\i am 27,white curvybbw Unhappy.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://split.to/O5upxYb
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:792 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
2902de11e30dcc620b184e3bb0f0c1cb

SHA1
5d11d14a2558801a2688dc2d6dfad39ac294f222

SHA256
e6a7f1f8810e46a736e80ee5ac6187690f28f4d5d35d130d410e20084b2c1544

SHA512
efd415cde25b827ac2a7ca4d6486ce3a43cdcc1c31d3a94fd7944681aa3e83a4966625bf2e6770581c4b59d05e35ff9318d9adaddade9070f131076892af2fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
9eebc24e4c142e8f20269391daea17fd

SHA1
a1aa0761fd8ce9db5d2a357f1490b7d1627c8f32

SHA256
d32dd70aa725729a325de71c123178cc8bbfdd5b1571160bd590951da23567c1

SHA512
a168dcc05bd8623cc1f3e1a2445589cd999579f004e6d483606397f59ac3e1cc97aab5867aa61b1b421fc16270b6b2e81a705927718d511b24bd05edac3e90bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\sgyae4t\imagestore.dat
MD5
d8cfc6084082d2f063bec779afeca064

SHA1
31dd60827a08772ec2a271b8747b45146efde6cd

SHA256
f733ed0295093f9d98ba9d04a5bf3be6e5777d77c03d90e165728da665f2ed77

SHA512
b1ac15edfac5b52a5d047f98f91bde874f923e0ab3fe3b92f361a09ae6c447f292f20b37c3304f632685a63970f41c4b3b8e25a63e3535a9652bd0eb3c930e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8T39MPO1.txt
MD5
ba594b693ca94d6fdb947f78efe058be

SHA1
1d5816ee3759f7239bdd5665ffab9b57476d5f00

SHA256
fb0ea499fd1f63a0246c9ff017dc4de2a12ff08ce45b745c7931323d981a026d

SHA512
6ede792dcbb3ace6347aca2f24219648d2eff2f2b0c6cad2f0e90d5d6ccaf53911cc61ecf311ef1f40957ea23b751569c20e2ccd3bca7df462fc12f348deec48

Download Submit
memory/484-59-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/792-60-0x0000000000000000-mapping.dmp

Download
memory/1768-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads