Overview
overview
3Static
static
3PDF Embedd...ML.pdf
windows7_x64
1PDF Embedd...ML.pdf
windows10-2004_x64
1HTML Javas...d.html
windows7_x64
1HTML Javas...d.html
windows10-2004_x64
1PDF Javasc...er.pdf
windows7_x64
1PDF Javasc...er.pdf
windows10-2004_x64
1PDF Javascript.pdf
windows7_x64
1PDF Javascript.pdf
windows10-2004_x64
1PDF Launch calc.pdf
windows7_x64
1PDF Launch calc.pdf
windows10-2004_x64
1Analysis
-
max time kernel
110s -
max time network
194s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-04-2022 13:56
Behavioral task
behavioral1
Sample
PDF EmbeddedFile HTML.pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PDF EmbeddedFile HTML.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral3
Sample
HTML Javascript obfuscated.html
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
HTML Javascript obfuscated.html
Resource
win10v2004-20220331-en
Behavioral task
behavioral5
Sample
PDF Javascript trigger.pdf
Resource
win7-20220310-en
Behavioral task
behavioral6
Sample
PDF Javascript trigger.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral7
Sample
PDF Javascript.pdf
Resource
win7-20220331-en
Behavioral task
behavioral8
Sample
PDF Javascript.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral9
Sample
PDF Launch calc.pdf
Resource
win7-20220331-en
Behavioral task
behavioral10
Sample
PDF Launch calc.pdf
Resource
win10v2004-20220331-en
General
-
Target
HTML Javascript obfuscated.html
-
Size
769B
-
MD5
6753e429e2a5fb32278e9614eadd3416
-
SHA1
4c64652ead8b010e94b267836bdf57b97fa52700
-
SHA256
b71ebf3c71bf7695e41f6a6a0498d651023c1dc705b6aa4b0fef1ae9bcfecf4d
-
SHA512
ce7d5ae038f39cd19f5bf9ee3a3ad095f3102b7277e65cf15cb99a93d8620a1e559418d823c4bc005b477dd5ea8b95d740697c7692077a4811e73c1d4245dc9b
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3554AC31-BC17-11EC-AA84-D6AF54037788} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000391a61928115d0df34dbdbdedd335c7c76a2c6161f750cd05e5e28bb53545d8b000000000e8000000002000020000000dadbe400285c5219c93ac6ef267eeeac091de4610940829fe0523224e538cd8a200000001ede23154aa4a04b919c3c5f5887ca5c4b04c763de872cad1055dd08c3b0b70e4000000009bd4a3d158b9e52f162a9b94bee5a5e09437ef7889a5c0458a11b589166b09da85e1ffbeb4bbce66937496d8f891cd13992e81a70d9c72968d43a7b8fb71ed1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0067001d2450d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000fe7499c5e27717181c3c55c38cdaf4482911d22c1e5f38c24c6fc5fbe885335b000000000e80000000020000200000005f87219cd899dc574a4f516887d9e80e040f6c90867c4bfb753a62c21219a03b9000000056771e1699c9bba17328a6f0408c5c581614bdc9b999ceaca9de764c887a8c78502642df596f711888b5f018798b73900f3ddafe26d32fbe2a8db94a02ea3e771973de358a2730d03142db36aac0385f4ce7c705b807cb8a17e16bb96804afc40c0de831308e7b6fd7596d041047b38ec240b35b3616d7b936c35d4f514f09f7438bb8fee8ba92b59df38cc32ffd3da440000000c3369f334317d34b5e617e48de448bee70fc2b61b9277c342841177e5a24e6fffc0c96f8e17db7191b62fd749f45148297de4312e7134fc171fbc7567e359ff1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356721827" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1480 iexplore.exe 1480 iexplore.exe 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE 2028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1480 wrote to memory of 2028 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 2028 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 2028 1480 iexplore.exe IEXPLORE.EXE PID 1480 wrote to memory of 2028 1480 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\HTML Javascript obfuscated.html"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K3VQ0NJZ.txtFilesize
591B
MD5b7721cdf2280ba01d59eb72a39e7eb91
SHA18f6aee9caa06346b600eefa4c65735803cec74f0
SHA256ecdc18846ed3e5f0fbe5cda03b8c53780e479d0c2a44b5f4ce780f971b0a1acd
SHA5124daf1b293d4163961767e92a33b70d33cd3a20fbfb882d4b7ef0c7391e1cc625cb7790603e07975891d8baeaf12eb44a274219d51398b12c9a39b4ed96bb5b59