Analysis

  • max time kernel
    121s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    15-11-2021 17:41

General

  • Target

    AVISO DE COBRO MESUALIDADES.pdf

  • Size

    87KB

  • MD5

    858f0402eba52523a2ebcb89bfe14f84

  • SHA1

    501504ff6611cb7f4bd00a5ef118b9702153c3c4

  • SHA256

    1b490b2d0459655c46522f7e31fbb40b32cb8e42b87325f3cde040cfa6ac2cf9

  • SHA512

    16508dbd3733fc1d88b9b00650c61c8577736d0bb7e9dfc9003a66ea2f81ab21132b9f3610c3b3b28550d985eeee6aeb3e798e1be6310ae628613a684b3c02f0

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AVISO DE COBRO MESUALIDADES.pdf"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://rebrand.ly/ack_recv_cobr_14
      2⤵
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:516 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1028
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EU9ERU9I\RECIBO DE COBRO_15D1.rar
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1212
        • C:\Program Files\VideoLAN\VLC\vlc.exe
          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EU9ERU9I\RECIBO DE COBRO_15D1.rar"
          4⤵
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:940

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EU9ERU9I\RECIBO DE COBRO_15D1.rar.k75fdo2.partial
    MD5

    e034ce0a98544efd39160c3ecbe3efe3

    SHA1

    1c47e66c260b800a8650b8a4839b45f02a3fcaf6

    SHA256

    6cffab1cf391a16187a0ee30f76eeb935d5100d875415385a130c7e8bd8a9e36

    SHA512

    d1df7b21d8585219355262cb68dbc819ad0639da21dd578529bc04ae4137e1d8e9bfa6a721de71934cda0eba44efbd8bff008675f0f3000a1b8031f4260835f2

  • memory/516-56-0x0000000000000000-mapping.dmp
  • memory/516-57-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
    Filesize

    8KB

  • memory/516-58-0x0000000002020000-0x0000000002030000-memory.dmp
    Filesize

    64KB

  • memory/516-60-0x00000000020F0000-0x00000000020F1000-memory.dmp
    Filesize

    4KB

  • memory/792-55-0x0000000074E51000-0x0000000074E53000-memory.dmp
    Filesize

    8KB

  • memory/940-64-0x0000000000000000-mapping.dmp
  • memory/1028-59-0x0000000000000000-mapping.dmp
  • memory/1212-62-0x0000000000000000-mapping.dmp