Resubmissions
16-03-2022 13:06
220316-qccq7aead6 416-03-2022 10:43
220316-msa1raagfn 416-03-2022 10:37
220316-mnxc7aagcj 416-03-2022 09:54
220316-lw79zsadap 10Analysis
-
max time kernel
4294234s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
16-03-2022 10:43
Behavioral task
behavioral1
Sample
1a9f775e93356e6d09549721bcab5e5ded27ef7d3a2200cce80b1f89514c8646.pdf
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1a9f775e93356e6d09549721bcab5e5ded27ef7d3a2200cce80b1f89514c8646.pdf
Resource
win10v2004-en-20220113
General
-
Target
1a9f775e93356e6d09549721bcab5e5ded27ef7d3a2200cce80b1f89514c8646.pdf
-
Size
776KB
-
MD5
8a9f834abf7d6cfb6452ff3102ec998d
-
SHA1
14e108594294c230a5445b6df54bb8f74a984cdc
-
SHA256
1a9f775e93356e6d09549721bcab5e5ded27ef7d3a2200cce80b1f89514c8646
-
SHA512
68671bf392af9f82de5e3d99e7a13f04e82faab6cb980d5371dce5f08c2f85661f5e6d8016ec15e43c323f41fe304ddb7b95ff60fbc99b76c6295858d094bcbb
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\ = "65" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "65" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\Total = "65" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{588AFCD1-A516-11EC-9919-DECC31BAF6C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\mega.nz\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 572 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 308 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 572 AcroRd32.exe 572 AcroRd32.exe 572 AcroRd32.exe 572 AcroRd32.exe 308 iexplore.exe 308 iexplore.exe 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE 1580 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 572 wrote to memory of 308 572 AcroRd32.exe iexplore.exe PID 572 wrote to memory of 308 572 AcroRd32.exe iexplore.exe PID 572 wrote to memory of 308 572 AcroRd32.exe iexplore.exe PID 572 wrote to memory of 308 572 AcroRd32.exe iexplore.exe PID 308 wrote to memory of 1580 308 iexplore.exe IEXPLORE.EXE PID 308 wrote to memory of 1580 308 iexplore.exe IEXPLORE.EXE PID 308 wrote to memory of 1580 308 iexplore.exe IEXPLORE.EXE PID 308 wrote to memory of 1580 308 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1a9f775e93356e6d09549721bcab5e5ded27ef7d3a2200cce80b1f89514c8646.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://mega.nz/file/Vm4URBzJ#FY1EJHN4p9g15II8MMv_Oo0xQVrh4Xg4w8zHMi7Poq42⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\shpg9mq\imagestore.datMD5
7f724399c7de10560e93dd46b2d91483
SHA100ec65f57afe975cc525e2a1b8c800b25f8dabfd
SHA2563bf9234b2dfe197631b463d1574e9874f11cec3a1ebd8214533e8411d1a95343
SHA512a429f351b8fe3fc80bc526b33f6e1f6441d8a014ccabfb90663b9f7788891694a62ea0ae5448836a3ed1469132a22a426e02f903fc039aa58787278e8b1215a6
-
memory/572-54-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB