Resubmissions
16-11-2021 12:04
211116-n8q8cadfh8 416-11-2021 11:58
211116-n5f8zadfg9 316-11-2021 11:55
211116-n3qpmaaffn 4Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
16-11-2021 11:55
Behavioral task
behavioral1
Sample
ModuloConfermaIndirizzo_2016_56.pdf
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
ModuloConfermaIndirizzo_2016_56.pdf
Resource
win10-en-20211014
General
-
Target
ModuloConfermaIndirizzo_2016_56.pdf
-
Size
89KB
-
MD5
3e4e9232f4a973055eef13a2692ffc54
-
SHA1
94cc703064b56a0416d884be1bf6a2edb66521c1
-
SHA256
445f1576ff067209bd366064032e5826ef4b3b0e6b299184443053be75e49289
-
SHA512
e6958ff09ca3ac3e826ce80d91c319d67390af75632a1012694799999ab9fd6b9a00e147b62fcd681fca76502a0fa2ff345af97e7754d3dea3c4c9611258dca6
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb1936000000000200000000001066000000010000200000000c0c985d1ae4b560761a1096707c38ee1f0d90a2ef914f3dc23849125f2e35e2000000000e8000000002000020000000b33601b77f25af06feb5341aeb8f16e9a6f5125e9ab0782db27dfbdb07022754200000002645d95c46b170ae293ce906f7a228262e08acaea4b6fd93fa8e095d247c33ae40000000e00b20395657ddd0a179f4ba6ef6051a352bb570f9ce9e3c0ca378f8f8ee5deb5b7ca56fc6249c61249606fa2abdebd3b125ac3018252ae439974459cec264f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B88F741-46DD-11EC-AF99-4AC5DC9B600B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d2a1f4e9dad701 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "343832577" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005bf5749d3a275447873d564a46cb193600000000020000000000106600000001000020000000f1226706f54d7e57957e863b8db93e6a63d7ad31c9e083c8473de0444b0602f7000000000e800000000200002000000080fcaf9122fd9e5b32dc3067726c8ac35487f3b1ce058efcfdffc959226a0f20900000007e740fc7bc879f0edfdb821edce659a07596c06e739d961746af93e38d9944b30f385c29df16bb82b6a4f726d633a1ddc8ac8b69d9947700eaff6c4dc9179b4df232f86f5d313c2e7d5e9c6a5efee9596675efbf7ff01ac0281d89c4ca9e739463853f973b4dae2a04e59ab04d9e6672db62fa316d62bbdf44adda765bfcf90246acf03ef5b5c71d94d3406dff15ccb840000000770097d602a3eaa9e6794e863ed9f9764bbed6f68c1e2e0a6cb802869d68bb72c9f31420888d99be0b35d21c72cd59d6dce721a740d455c42c3db657ae15e8fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 836 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 804 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 804 iexplore.exe 804 iexplore.exe 432 IEXPLORE.EXE 432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 836 wrote to memory of 804 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 804 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 804 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 804 836 AcroRd32.exe iexplore.exe PID 804 wrote to memory of 432 804 iexplore.exe IEXPLORE.EXE PID 804 wrote to memory of 432 804 iexplore.exe IEXPLORE.EXE PID 804 wrote to memory of 432 804 iexplore.exe IEXPLORE.EXE PID 804 wrote to memory of 432 804 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ModuloConfermaIndirizzo_2016_56.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.b-soft.it/FOTO/DHL/ModuloConfermaIndirizzo_2016.exe2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:804 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\59D5FEL2.txtMD5
675b382e051c79e8bacb93a82249f42c
SHA12dca7b031bbb656a07375582f61834b40b9500e5
SHA256c27e3f2582f391d1f49fdecd1541bd613d9b9bb89eb10f3b30834806f4d5b76c
SHA512d2ad91e543c527152fa004d663be5f4683cbb06fcd7333e98720e129a9436bd5a53ba4b0480b9e38b28f4cd3651cdc6660fbbb9bf05b64a30ee376cb3a7d9052
-
memory/432-57-0x0000000000000000-mapping.dmp
-
memory/804-56-0x0000000000000000-mapping.dmp
-
memory/836-55-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB