cd04570c16f5c8ce0412e4535dc22c0dbfb14f3cb0ff35047100cb84fda59804

General

Target

Lazada Voucher Worth PHP3,500.00 ( Reference # MB-92297560 ).pdf
Size

496KB
MD5

d5fb926b2e51aeda4baafe5b8a5e3be8
SHA1

144fb55fedf75d2a57fff39a849babf4eaf59567
SHA256

cd04570c16f5c8ce0412e4535dc22c0dbfb14f3cb0ff35047100cb84fda59804
SHA512

5447041ac5fb2f8c3c23a4f7776a81eca8128d68e7a472f3c3f1e299e9cd878b6424a7900b085c05523a65305407020ccc2f33778a432e93d172466d2d8e2728

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 20 IoCs

collection

Email Collection

T1114

Processes:

OUTLOOK.EXEOUTLOOK.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key enumerated	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE

Drops file in System32 directory 14 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 45 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEOUTLOOK.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d030b938664ad801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60C2A3E1-B659-11EC-91D2-FA07D4799FE5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc00000000020000000000106600000001000020000000ea37a5953180233a1da160e1ed6a26a4ba00b9704a23ca45671acfe4344e87af000000000e80000000020000200000004ab491ffe8bf80a0cecf0f43787417294f1e6f1006a3833c7cb59a5986a534a320000000d0b8740defd3fb33d93e718958712d80962324ca336485db3d92ebc089d05ca440000000259ad469c7c5028602497e8c28fad29ff9a55b76392ba935f8428a8f44c6029df2d2b9dc3ec88d38371654d2be69f60a19ee4b41d21142d1a228b83cca89369f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc0000000002000000000010660000000100002000000035870746913e8d9c20742fbfd9d77750ae97a9aaa15bd3ec1b9d6763ddac2a0d000000000e8000000002000020000000b2ab247c3848d8809af1e40f311254e9c4931310459bc3c896ee670ac51e78aa90000000f488e3fae502550f30b3e44c4d7fd191e03d027ba1b05e221a75356c6c83e8be8c087aa0a1bbaed5575fea071fb83366c1066ab8b1859e926509bd651645491445a676e2557cc5906a66798434b7cf64195e80ae89446cac0bb12aacefc8d54d82019afef5fb3d9e7a63e9b078796471f8cdfbb99d8d6f7fda5ef0feff37eef4c00d5a1c8e6558a92f09373e407184ce4000000067f1a6207d9cd70178e31a86eb98863c1b848146d024cf4c803409c07eb699cc02ae5943863c36c2b2cc381ad1f6141f3b4b8e76c2313822123682644e498541	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356090528"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

OUTLOOK.EXEOUTLOOK.EXE

pid process

1612 OUTLOOK.EXE
592 OUTLOOK.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1876 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

564 iexplore.exe

pid	process
1612	OUTLOOK.EXE
592	OUTLOOK.EXE

pid	process
564	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
1876	AcroRd32.exe
1876	AcroRd32.exe
1876	AcroRd32.exe
1876	AcroRd32.exe
564	iexplore.exe
564	iexplore.exe
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE
1912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 1876 wrote to memory of 564	1876	AcroRd32.exe	iexplore.exe
PID 1876 wrote to memory of 564	1876	AcroRd32.exe	iexplore.exe
PID 1876 wrote to memory of 564	1876	AcroRd32.exe	iexplore.exe
PID 1876 wrote to memory of 564	1876	AcroRd32.exe	iexplore.exe
PID 564 wrote to memory of 1912	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1912	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1912	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1912	564	iexplore.exe	IEXPLORE.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 1612	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE
PID 1876 wrote to memory of 592	1876	AcroRd32.exe	OUTLOOK.EXE

outlook_win_path 1 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lazada Voucher Worth PHP3,500.00 ( Reference # MB-92297560 ).pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://efdagjh.r.af.d.sendibt2.com/tr/cl/tdrP8MQhCGrZNr-8-33StuHwuy8Hp7Ekk_yt-VwrN55Ntjql-reZvQv7N0qpHjQ7Tl1MNwpn7XkBhsi6trw7Ej89iBNvPTpUKLVW1R1MJ5jkqw7Pjy2lwnxkPXRvaTU6pPDnhUAEWW1tqLFvEJ-cp10rZGzCBv1rpmTJUdLghgLS47R_jIqELj_pSLOODBbusxXTTJL-Q7T1_-gxt_-TODZ9dcRYwer_sTziTGD97vuILdhz-Olp83eKqYP8tcdR8uNv-a4pogPGTaM594JNe67j7gEf0xduRXWPoqwGVHrOvQoLZBDpnO5PS3mY8V-TJd-o-6nuISa2JjAGFTwzKAhwIMe-WVtlRexKe6D4RemsCiVl2-TITlogDB8k52upSHo5od-nYw0DEOxjBDMm
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1912

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"
2⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
PID:1612

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"
2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- outlook_win_path
PID:592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
4871e8d0b8a8f981ac21004cf96886e3

SHA1
fd51d98747043ea831cdaecf5f1eae75353e5ceb

SHA256
56797b92b606bbd1be7ead7c9078ec4b83ea49764b76d5998bc7758a537dfebe

SHA512
537e8f0d17f8f1cbd201246328f25849963bdd6b5de3be4a73934ef8a72519048c822cc1d668a4b466bb96a22a6b548551774924f5dcf97e2bf0ddcd13d2b199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\shpg9mq\imagestore.dat
Filesize
5KB

MD5
fe3cda3ff9fe0bed872939df0bce1504

SHA1
2db4d3d91572b6b22c8db3e338f6322679048b4f

SHA256
707479f1ed9043a3347cb93da03488f27077d25346d31f5ed5358b10f72c1b4f

SHA512
cf333a89c9b570284a246f3279a91e8cabeef3ae9b4a48abc2507997e91a40f7fe849545e30e1ac9ab5276d5126d4332121af80f6670a57606ae0a7997a460c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf
Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\Temp\outlook logging\firstrun.log
Filesize
82B

MD5
f43527e42c88329e3685abcb7d38c425

SHA1
27134e26a4ea5f5143ac94f8ca084f1b36656c69

SHA256
bb3f6795de102cd1fe84e42a12ceb2832753c5be383967db1b51ca2c722ef347

SHA512
42bbbf1e159aebf05e5fbff322fffc3284b3cd28ce884073e005f685e7c939d9548fa7277864a162e37f80fa4a55a32b5c8e4256a544114a6b35cd862c2cf23c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JAOGBACM.txt
Filesize
608B

MD5
8ba5188a672c666553287bd61ad374dd

SHA1
5f578aae9fa9431b0420d141a152deba7317a845

SHA256
8209c2520dfec4f36783661156e6e15c7f2ea5e7e35ab1ec726f6967420bb97a

SHA512
87dd2be04602c6035317f582ff01ae2087dd2a08302c383857481a72eb81bcbfc236b98fb64f9a85503d53ec6b780d0d3f74bb4b64860ba06048bc36b44a94a9

Download Submit
memory/592-63-0x0000000000000000-mapping.dmp

Download
memory/592-68-0x000000006F05D000-0x000000006F068000-memory.dmp

Filesize
44KB

Download
memory/592-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/592-64-0x000000006E071000-0x000000006E073000-memory.dmp

Filesize
8KB

Download
memory/1612-57-0x000000006E091000-0x000000006E093000-memory.dmp

Filesize
8KB

Download
memory/1612-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1612-59-0x000000006F07D000-0x000000006F088000-memory.dmp

Filesize
44KB

Download
memory/1612-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1612-56-0x0000000000000000-mapping.dmp

Download
memory/1876-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads