Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
12-04-2022 18:29
Behavioral task
behavioral1
Sample
XR67CT8V901.pdf
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
XR67CT8V901.pdf
Resource
win10v2004-20220331-en
General
-
Target
XR67CT8V901.pdf
-
Size
464KB
-
MD5
970636e247ab9e38b38cfb4374d5f4ec
-
SHA1
5355f05de1b482bf3e3c30ee3e2e7ed46bc4ce95
-
SHA256
543db39787cae6fae4a682fa07e1fcf457993ca716c367d2ef9abd4ea0738ee1
-
SHA512
62174aac377b4dca28e32c470bbde8a4b40d298ea69c165eddc73a55e62f6cc7802474b3f1dbc45765054461a6e783beaac6b0446f725c460d25ac17d8fd6fb0
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356560407" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{649E6F91-BA9F-11EC-ACF6-EA1988640529} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c000000000200000000001066000000010000200000008bc4d2f0ea6823a33b8383f5321f4941fd0d7094068d20d6534ff8f40cf51555000000000e80000000020000200000001862c4cecc586377d0bd9d05270ebfb0637e7a775e9113cd84d7d20a3d32405c20000000983138351628b6b9a9b92104ea5de3f160a2b7dccbe746ed3c2810c5c6a7ca0e400000002faaa94d465bc081ea87e0ffa164644b8e1a847bd6f79b6947147b9daeaf862f1f8cb92fce35056c69c643947e6504efc0a5a5f43f785e67e8e27a75f44c0402 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c000000000200000000001066000000010000200000005bf06a8bef8bcd487cc6d29016d149d24a60ad3fa0ba1b822cee71fc5a39979f000000000e8000000002000020000000493657a78f62a75a11d59257a97283eacc9c7ce266b1f9be4f12655d62d79aab90000000604faaa41d7c1b12bf54806efd6734f155d1bcae4a6076f750b6fefdb347b10fbc37c40cbbba6046d2bf3ae0df432aa03782e588207322681df89a5a5a4b0f2689aee4d2d26a066eb2cda5cd43aeba932d0064b96f2f5dca8d9bbc5abec172de197f407912210653f498bdca481d698a3965b4ddc4c38f8b1b7024b4f5a4901a7797a6938d36db8b82cd95216f38f56e400000008b3c0370ff3087a93a15f3027d394704ac61d81f552b69e133b7a8bdeb852878a474ed47378fe5fcceae1d8d71e6739addd1cfe0397b7ecb03cd30d6191ebfb9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07c9e47ac4ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1028 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 1896 AcroRd32.exe 1896 AcroRd32.exe 1896 AcroRd32.exe 1896 AcroRd32.exe 1028 iexplore.exe 1028 iexplore.exe 688 IEXPLORE.EXE 688 IEXPLORE.EXE 688 IEXPLORE.EXE 688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 1896 wrote to memory of 1028 1896 AcroRd32.exe iexplore.exe PID 1896 wrote to memory of 1028 1896 AcroRd32.exe iexplore.exe PID 1896 wrote to memory of 1028 1896 AcroRd32.exe iexplore.exe PID 1896 wrote to memory of 1028 1896 AcroRd32.exe iexplore.exe PID 1028 wrote to memory of 688 1028 iexplore.exe IEXPLORE.EXE PID 1028 wrote to memory of 688 1028 iexplore.exe IEXPLORE.EXE PID 1028 wrote to memory of 688 1028 iexplore.exe IEXPLORE.EXE PID 1028 wrote to memory of 688 1028 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\XR67CT8V901.pdf"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://href.li/?https://vk.sv/QbWzT-2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD59ce4c8ada89e6fc8d61d9bcaae32b9d8
SHA1a5f44cb98ca8ccc3900ce45b35aeef70060a50ab
SHA256bc2994c6b6e36ee706a5982d4df9593d13e53633666418d809de75f41a3003bb
SHA512221f1bb1163503e7f6e31a1d411a8b10ac6f07bce880ef717ed7096f87cb3351d389b490c8c6f8c6d69609ac74ba7cb3e0fd3035168d051b495bf555d9ef6314
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\b1rou5u\imagestore.datFilesize
21KB
MD5b46012c1a976fe32bacdab210665639a
SHA19b49601d0a2c71b46a0dc2daa8f3e1800c68b6d4
SHA2560ce00153504cd7c2f3ba87561cf6ab1307f0fb4450c477b58181c7b17150848d
SHA5128e636c4dd8942e1dd9bd3132bbcaa1c31ab161424fa55fa7dc0862e3c5ce184c652401c6e56334f62ebd3c6a986ccd9feb536e0c63d50c84620744bd8e007e2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KGEMFX8V.txtFilesize
604B
MD5d234f20882462d3ab82dfc155a45a258
SHA134c9344f3c1102a47c4002a4a2e27751461488b5
SHA256880f1d2822beb8216ccc2c5d6cd4c042ab8cf0b96391c8538b0527e558b66ce6
SHA512122716c9d528aee8e355183dc1ca19ad2d4fa9c03eebe2de4fd1deb041fa5d413153abf20302f8416d3b4df7192e1758957703d3694a47e2457354a8f3c44f02
-
memory/1896-54-0x0000000075E41000-0x0000000075E43000-memory.dmpFilesize
8KB