Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-01-2022 16:14
Behavioral task
behavioral1
Sample
04c3ad45ad3bb02725b729ac7f04ec422155db5cff44605863540011bcde0b85.pdf.000.pdf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
04c3ad45ad3bb02725b729ac7f04ec422155db5cff44605863540011bcde0b85.pdf.000.pdf
Resource
win10-en-20211208
General
-
Target
04c3ad45ad3bb02725b729ac7f04ec422155db5cff44605863540011bcde0b85.pdf.000.pdf
-
Size
468KB
-
MD5
3d1d598b3ab9e5e78a0718d6ffd6a6d4
-
SHA1
e6996880b71ae34913bd243851b0028e949ea560
-
SHA256
04c3ad45ad3bb02725b729ac7f04ec422155db5cff44605863540011bcde0b85
-
SHA512
91a2c8b71df0704f5903c2ac7b6e50164317808edbe445eef4a487fdcfc6840b1c40e5524025257c090cd7677816a44ed9d23b2db092faca7d812aca8b5dfae3
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "348254290" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba978300000000020000000000106600000001000020000000b584b11875b93a94ab0915a78587f0b2f324d9dd11197835c54f84353838cd0b000000000e8000000002000020000000b50fedbe6738bf8f8bb2f79e1ce17749008c5eddb5d682ae4d59be101269a74020000000d570588364ec7f31d20d20bade6f4985095b01bb9f03e4fdad3507b2bcd331714000000001dc80f0b7bbe21861f033786a3f320e989ed1b629c70cfe9980e7d367d0b61d047b45d67bd02d59a96a2c0866ff8e3ba7f1a90eb4d95582265e5e967fad9685 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e057010f2103d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba978300000000020000000000106600000001000020000000f79d496366cd95be4494bccf8af80a674c71e691e9469af85a3ff41e085e1a8f000000000e800000000200002000000030418983cc3ff915cf7cf2c29b141243aed2305c0ede512d87e367b971f4bb8f90000000cd714eaa080ae87f87faa0c6853a681d698b30ee3f471633f2fd8df5a8fe8f48e4ca6d3a8253a53825f56028775729c79d169efbc1461037725ce9bb72f1b52fb6702398e255042a92c328bf25ff476556d0b4f3b1c33ebeb6185148cef0828a7fcf465fe8764fb6daf13febce53573d6f3f5fec116c7bb9df89e9923de7c89564e194dc59866b1d24a1cb1199a96a284000000000880f32164f330e4ee45e1c429c0453d788443f2999e437efe1035aba66e4e6d53615d414ed5181888192b5b037b60bf8531278efdb7ecce66fffed5916e673 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35BB2911-6F14-11EC-B96D-E2EFF2F4E71D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 836 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1188 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 836 AcroRd32.exe 1188 iexplore.exe 1188 iexplore.exe 752 IEXPLORE.EXE 752 IEXPLORE.EXE 752 IEXPLORE.EXE 752 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 836 wrote to memory of 1188 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 1188 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 1188 836 AcroRd32.exe iexplore.exe PID 836 wrote to memory of 1188 836 AcroRd32.exe iexplore.exe PID 1188 wrote to memory of 752 1188 iexplore.exe IEXPLORE.EXE PID 1188 wrote to memory of 752 1188 iexplore.exe IEXPLORE.EXE PID 1188 wrote to memory of 752 1188 iexplore.exe IEXPLORE.EXE PID 1188 wrote to memory of 752 1188 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04c3ad45ad3bb02725b729ac7f04ec422155db5cff44605863540011bcde0b85.pdf.000.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://web-redirectmailsrvc.cloudns.ph/ZLqRbGY2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z3N7S58S.txtMD5
7e5de2f33fecd43d1b2b32c183e141bb
SHA106efc9ccc1cc7e90c8c6f3a9fc35336467a17e8f
SHA256aa283f1f4bbc88261303f8f0462b2f89f2df6aefa2d492e4ecb83ff08f0b06db
SHA51234445fa1c5a999064fcc0bd054fe806f19c2a5c38ad48eb262a624810bc374e5325f481e3a1eb1bdaad20de85041b6966674a2dac04ce7d6a6e6abf01b421cbf
-
memory/752-58-0x0000000000000000-mapping.dmp
-
memory/836-55-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1188-56-0x0000000000000000-mapping.dmp
-
memory/1188-57-0x000007FEFC401000-0x000007FEFC403000-memory.dmpFilesize
8KB