Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 17:05
Behavioral task
behavioral1
Sample
ca7ea5b16af2cf934a098a46e8d2c927dcb3de2cdfee9060ef9562606c584e91.pdf
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
ca7ea5b16af2cf934a098a46e8d2c927dcb3de2cdfee9060ef9562606c584e91.pdf
Resource
win10v2004-en-20220112
General
-
Target
ca7ea5b16af2cf934a098a46e8d2c927dcb3de2cdfee9060ef9562606c584e91.pdf
-
Size
22KB
-
MD5
170bc0aadb6924206d14c90d361d0b21
-
SHA1
d2dfedf8c90173e72af36828767cfdc433f74c13
-
SHA256
ca7ea5b16af2cf934a098a46e8d2c927dcb3de2cdfee9060ef9562606c584e91
-
SHA512
eb877906144f5a22b6f8680f4ca59fc0db334a2e5d5b1972cb892f692c2780cdb1988caabd0827c14307445f66b01dee75beb6453b6d1ccdf2575f865782f7dd
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000007e2c4342faf7d1fa9cb1ee8b5b5d4ccfdaaae1ea1d94fc5f0e9f9a97ffe03cb8000000000e8000000002000020000000722ac54c1e0d86d497b643b6aba8e65ce3f509e815996e84939d040a4f4926cd90000000915d679c12953b32d8924e8ad5e8cd2c4745199a4aca065a09bb7dbd05b5cb68192535934fc7d1f8006f37dc8895c1f144820de3b8962e4fdcab181b2eb23742d1e6c721bc5f8ae700dd8ca460e6c6557c2aec2b3351864c3e0fe40a0d27a03daea801d477cbd0a4c6284608ecd001509ac5e631e5d10121b8b3c943dac93ab6a67f64f31e709b95f0dd998cd9d36ef6400000005c7b5dd83e601d68de4c3b557439b099719bf271196ebf8e5fcdf9301c14f8f6ee1f3a23bd67c86eec4f24b4b483c04348dc2a628edc4a14ced9d7d6e9040e30 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000000b5969a8aa1661e85489ebb3a8ae378894cad7f01b32a330c9edeb8b37c3ef27000000000e8000000002000020000000f5d55b810a0dd29db9abc8d602908eaef4d4cd28701a9032ca797a0f27db344a20000000f8f5f3d896eae9cb2f2e6713752c1efa71317759e48702434832eadea48d3c9e40000000528c7ea89b7bb1b7b3dca7b743c72dc470a56e5638cb02b5ba111e864d51c0b1f8ca3a738b9f007604b4c187b6d1401f92462657c339abb86d92b6e66b88dbd5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351018569" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AD61161-8838-11EC-A98D-EA26BCF07CE5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f51e2b451cd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1060 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1392 iexplore.exe 1392 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 1060 AcroRd32.exe 1060 AcroRd32.exe 1060 AcroRd32.exe 1060 AcroRd32.exe 1392 iexplore.exe 1392 iexplore.exe 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE 472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 1060 wrote to memory of 1392 1060 AcroRd32.exe iexplore.exe PID 1060 wrote to memory of 1392 1060 AcroRd32.exe iexplore.exe PID 1060 wrote to memory of 1392 1060 AcroRd32.exe iexplore.exe PID 1060 wrote to memory of 1392 1060 AcroRd32.exe iexplore.exe PID 1392 wrote to memory of 472 1392 iexplore.exe IEXPLORE.EXE PID 1392 wrote to memory of 472 1392 iexplore.exe IEXPLORE.EXE PID 1392 wrote to memory of 472 1392 iexplore.exe IEXPLORE.EXE PID 1392 wrote to memory of 472 1392 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ca7ea5b16af2cf934a098a46e8d2c927dcb3de2cdfee9060ef9562606c584e91.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://a9m1x.icu/0302122/12457856.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\62ZMNYHK.txtMD5
0335d8b4732858585fe70d4a40065523
SHA1e661f838147b65aa3eb5f6c417e4ba8dbb055489
SHA256405f3c12611266c039f1d3dc6b15c0290887c7cb85ea704aef557bf64a66d90e
SHA512effdc2c719d9aad024b1d608099303364f5617d285ebb685c3f8d47c27878ece4387e8aa61bcb858b2ca67417a6006c01d3db8a8ebcf31ad79a9d9126b8439d7
-
memory/1060-54-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB