Analysis
-
max time kernel
4294180s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
11-03-2022 12:45
Behavioral task
behavioral1
Sample
564d295dfb8da90cf310878ecb2db331d1f7d69b8b171529126613859ae2ec3c.pdf
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
564d295dfb8da90cf310878ecb2db331d1f7d69b8b171529126613859ae2ec3c.pdf
Resource
win10v2004-en-20220113
General
-
Target
564d295dfb8da90cf310878ecb2db331d1f7d69b8b171529126613859ae2ec3c.pdf
-
Size
372KB
-
MD5
c0afe5670891bcfff23434331a1cd566
-
SHA1
3169e7c069b5cd40be11f68371bc0fc33be534eb
-
SHA256
564d295dfb8da90cf310878ecb2db331d1f7d69b8b171529126613859ae2ec3c
-
SHA512
5390fed9bb927607c7991ff471c2f280f663ce2a8e1a2f246a7932a25bc74285b478654f770ed465e51d28790bfd4665e0e3829af7e2944ba139d79d33eaaf7b
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 405b966e4635d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9773A8B1-A139-11EC-AC41-769A5DE5B2AB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353767901" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000dca05d8a82bcddf3974339ca897ae0a2d2c058f9824daaba488204d99bd54e11000000000e80000000020000200000009d4d09845f34d7f5bbf51bfb8013e8506762fc4bfb093efdf8f8a81c1c9ba599200000000a677ff3ee684e65700e1261a33be6ffccf2983df93d18725385df90192a406540000000ea559b7c06651e064e5516b8996f23904058d9babe510a396194986f0bf4bbb7916d8326b976da4e166f96df947e5b8e2a62a600febcb708a0a6408375996a9b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc0000000002000000000010660000000100002000000051edeb210b549bb7ab179e10e51b7e3981d9a1d2b894d663767487b177452ec2000000000e80000000020000200000005c1f7853c7f3fe0a880a318ae130a2f143696e2da47b968f9379938401a52e6590000000a8af29005fa03c5dd7da68c07bb79c7a658cd8e5ee6c872ee119b74c2f9ea6281d4ef1d066111f0cb9fec59e5ec00585fa82c1fb8ff2c2d9234797b6ac4f754139e50f9c020b370f8c64eb1619a5f6a30920e4fabe94403e553083e71f378ac544346fe93d50642ec1a5db1385be6ffb4ba90d2b257e2bd351f393931e04701925d7b5750a7c644cb9f277452ff01297400000000815f3a634c88ca451fdb0737523c514c8184697a4f97152e5c6897ec2131cc19d188ed9a86ab8ff6932ba25ce774777d9ea648716ecc3f817cac3c92565e859 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2032 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1856 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 2032 AcroRd32.exe 2032 AcroRd32.exe 2032 AcroRd32.exe 2032 AcroRd32.exe 1856 iexplore.exe 1856 iexplore.exe 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE 1652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 2032 wrote to memory of 1856 2032 AcroRd32.exe iexplore.exe PID 2032 wrote to memory of 1856 2032 AcroRd32.exe iexplore.exe PID 2032 wrote to memory of 1856 2032 AcroRd32.exe iexplore.exe PID 2032 wrote to memory of 1856 2032 AcroRd32.exe iexplore.exe PID 1856 wrote to memory of 1652 1856 iexplore.exe IEXPLORE.EXE PID 1856 wrote to memory of 1652 1856 iexplore.exe IEXPLORE.EXE PID 1856 wrote to memory of 1652 1856 iexplore.exe IEXPLORE.EXE PID 1856 wrote to memory of 1652 1856 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\564d295dfb8da90cf310878ecb2db331d1f7d69b8b171529126613859ae2ec3c.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://yubit.co.za/XSRYdR1H?utm_term=grocery+list+template+free+printable2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
6810f49664720c6d2b993164b7613c61
SHA1024a98a8523afa55561a11b782be8a15f82e0462
SHA2567a0539a519cbedd4a0e6c565fe50d1a5473b69c90eb63dbf271eed9ebe403b8a
SHA51227c0eb171ee6cfda0261d7aa55ed54c2f13250b53ffa3db39ed5dc7cc5b1dadae0951721f82a30915ddcff40fb718a0881cf0b1b7aaabb5554db10d3aa6df2c1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OZ20NJC1.txtMD5
91e3f933ecbd7d3b8f044d7211990220
SHA1e8dd33aea3c0a14f89266943138d2f8706958f76
SHA2560704603296af7ce800c4f0f473fdf4b2038531a7d7c10570f2996a39d4110de7
SHA512b391882b77df7979c180628815678d19e864460da2a1386d946b0865eae2a06bc7fd2f286e740c673a9464e88607ca0c655489bbf954087bb025365614fafeb4
-
memory/2032-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB