Analysis
-
max time kernel
132s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-12-2021 11:14
Behavioral task
behavioral1
Sample
speciment.pdf
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
speciment.pdf
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
speciment.pdf
-
Size
60KB
-
MD5
8189bc8fdbc82d23fa2739d94be36fe3
-
SHA1
b3f69446f59ca51cb0bbca3a35045dbaafb377f9
-
SHA256
4a78765b8c9d35ecbf739ed56e991db8fb692a4e6f3ed5ab7dbf9fcca148dd03
-
SHA512
bcae9d413be18444aa95693bc9073ee307492af18cf307af4f9b09377074617ea8ba8c3902fc83aca9cf049f9720ab303619e02f77f6f0753c4c356fdfc3dbe8
Score
1/10
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000001d74890f082c3572da0c579d091faf014cfda6b424bbf97e114f935221381fda000000000e8000000002000020000000e11893bd7e32c0e54cbf0b3df4dd177d63646d70803ad59eb5a365a1920bbb519000000096735802a860787308bfc0623cbb5209f5ed8ad03b5ac2e0a4ce7f11f377bb4f2c22e9f69b8fbd3467fbefc484d6194962a4e5d85e9962b8397caf997a9dd64f7c85a2b0fb614724682e1dbe868821678e47dfaab34e05cdf3f10a0e6467925ce4a5e671a8149173e72ab0f42f34add23322c74f337d13e991171cb3baedb89cc942701eae6e8790443f01ba1b02bc50400000006c90cfd8c51b2480eda2c445ca047c418f6bb99913f4cdc38b977245738d0c34aa246261bf9e25daa51243c684b1b00c367ccd71c42bce5e7cc5c367e5b029e9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b0668c37f3d701 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2B57B91-5F2A-11EC-BA6C-CA93D16BBF84} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000b7e6d3155baca33dbc9f22eb65012fa366ae9200a8ee8eb5f1bcaa2874a03115000000000e8000000002000020000000c66a9d61cc468058d5283c793cc16cf7e2b08066f47cd52ba29605a266a588a920000000cba1d798963bbe235265203d92df8a59715a20c7604121b5d6206d81829659f540000000145df5fff563166bccc0194baebf05d8c9e0af3f09bb97f7150ee473f34b9845bc80de512c22aff283d8a7b827902def37192a6957a764c72103ebfadffb14b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1824 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1352 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 1824 AcroRd32.exe 1824 AcroRd32.exe 1824 AcroRd32.exe 1824 AcroRd32.exe 1352 iexplore.exe 1352 iexplore.exe 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE 1132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 1824 wrote to memory of 1352 1824 AcroRd32.exe iexplore.exe PID 1824 wrote to memory of 1352 1824 AcroRd32.exe iexplore.exe PID 1824 wrote to memory of 1352 1824 AcroRd32.exe iexplore.exe PID 1824 wrote to memory of 1352 1824 AcroRd32.exe iexplore.exe PID 1352 wrote to memory of 1132 1352 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 1132 1352 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 1132 1352 iexplore.exe IEXPLORE.EXE PID 1352 wrote to memory of 1132 1352 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\speciment.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://ttraff.club/123?keyword=manual+instrucciones+frigorifico+teka+nfe+3202⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx