bd514ae94b3f8c698c61477b275e5f8e96e52defcbe7ea1521fb9582c551da25

General

Target

dexogusufo.pdf
Size

77KB
MD5

288308d9e669c4e3ca3bfd33f7c8e528
SHA1

7e23d877a6ee9eb2a348ea0743b752965fd51147
SHA256

bd514ae94b3f8c698c61477b275e5f8e96e52defcbe7ea1521fb9582c551da25
SHA512

d66ac1721d63ff3785d7bfe63f5b7adeda5c426b34e4e14b574bda5a000da71fccc2bfa051d6a13a2ee24cb9f41dd5a29e049bd1add86c6fa1c460a152731616

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98036B51-5F2E-11EC-AF3B-7EB9569AE3EA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ef9a623bf3d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc920000000002000000000010660000000100002000000047d111148665157e4bd5f8225b988205580e5feac0881c92c4bc2c0ff0dc6fe8000000000e800000000200002000000084a0f6a8ba5bcab78cf18d1ee8015290535c97bdebc930be7558b283a6b1b60a900000002e06a6affc7672dc9f7a5d6a6b343f497a4579fbcc5d15c335ba5f11419edb97459cb9c1b8db79893269eceaf59f3ac0825c61e73e6c25e4de03c3ab9d9ce33c428ea7dee7e0edd0b15778a2a896684072cfa8e14f6470ed7d5c05cc519b237c661c2b16444abc7dfc1ebd270eae69c5013a8379c2df47d13e5f0895332a2766f4ddaafab1b9ba4edfff803d064662f2400000001ff42aa294825c1db22184fc9d82a7a4df6becb290278d67767a973fbfceab183788959d605e27ad872ffcb45ac6d6bb64d954a4a68e1761c949270a0a571af1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "346506402"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000006200502ac561966d94dc9061a826f6a8505f87788c5e4f7a9df7141a7cf9f4e9000000000e80000000020000200000005328ce868b78ec4bf60f3b29a68dea8419aed2920a99fc4d4b2fcf3340a33c4a2000000021061a5f097cb8ec5ad82b8acd298de711ef7687a640bbcf435ef656663cc6a340000000654532da2a727b1a6f4280cd017f72900fe8500a8f319ecc43bd932e5916a59ecc43c9c5ddbb1bbef62ea53fb608846a4669b37288efc099d24d670456de9e7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

600 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1548 iexplore.exe

pid	process
1548	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
600	AcroRd32.exe
600	AcroRd32.exe
600	AcroRd32.exe
600	AcroRd32.exe
1548	iexplore.exe
1548	iexplore.exe
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE
1004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 600 wrote to memory of 1548	600	AcroRd32.exe	iexplore.exe
PID 600 wrote to memory of 1548	600	AcroRd32.exe	iexplore.exe
PID 600 wrote to memory of 1548	600	AcroRd32.exe	iexplore.exe
PID 600 wrote to memory of 1548	600	AcroRd32.exe	iexplore.exe
PID 1548 wrote to memory of 1004	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1004	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1004	1548	iexplore.exe	IEXPLORE.EXE
PID 1548 wrote to memory of 1004	1548	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\dexogusufo.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=mnemonic+for+11+organ+systems
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
8380811e4c3ec3e433cc115b000156fb

SHA1
51c93d79901f95a8f76c15ebb46c71ac239aa632

SHA256
8bd87e4ab0854f9d8984b2deb26cb57b9ad634eecaf7d89dc4ae7467a0fa4585

SHA512
033a1463c68979e65851f040ec00df912a9529c9b2c369691ff48f2416f78a3e739339e08a9baf3129496d30ef1f5fd0eebc5604166871c51e685c92b1709ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\o5rwqiw\imagestore.dat
MD5
1fbd4935bc5b7e2fb00d176aee1d89bc

SHA1
3c9688c3c55af9eaf1865377716eca3355cbb83c

SHA256
cda1415b0fe8465f75fda365c7f714a26d56b18baec55786bb9ecc79b31c0cdf

SHA512
2f3cc2f5a779b582afc4c5313b69cc7fdff487606e187e9080be69c02ee6d9cc780266f20ec243892e172e47fe5ef7c641a2fbbe6907f80c7ae3a3b2da79cccd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MYH2HQHG.txt
MD5
4df02beee37c3e581048b6baae7187c9

SHA1
81b71a6b0b3fc5b6b525a1586e08ee4f4e78271f

SHA256
d194731c31d8003531e9b1b48b732e9b90d13ba69f237b40bae1f6187c7acfa3

SHA512
cdba158a4d321c51d7b89b565c9ef09b16079eb4819966dd3139a1d8adbb9d3b2ee6a2d7968fc3bbebf35857bb7fd257678e1d31e0ae3da2066cfa39c2724cba

Download Submit
memory/600-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1004-57-0x0000000000000000-mapping.dmp

Download
memory/1548-55-0x0000000000000000-mapping.dmp

Download
memory/1548-56-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads