Overview
overview
3Static
static
3PDF Embedd...ML.pdf
windows7_x64
1PDF Embedd...ML.pdf
windows10-2004_x64
1HTML Javas...d.html
windows7_x64
1HTML Javas...d.html
windows10-2004_x64
1PDF Javasc...er.pdf
windows7_x64
1PDF Javasc...er.pdf
windows10-2004_x64
1PDF Javascript.pdf
windows7_x64
1PDF Javascript.pdf
windows10-2004_x64
1PDF Launch calc.pdf
windows7_x64
1PDF Launch calc.pdf
windows10-2004_x64
1Analysis
-
max time kernel
173s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220331-en -
submitted
14-04-2022 13:56
Behavioral task
behavioral1
Sample
PDF EmbeddedFile HTML.pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PDF EmbeddedFile HTML.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral3
Sample
HTML Javascript obfuscated.html
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
HTML Javascript obfuscated.html
Resource
win10v2004-20220331-en
Behavioral task
behavioral5
Sample
PDF Javascript trigger.pdf
Resource
win7-20220310-en
Behavioral task
behavioral6
Sample
PDF Javascript trigger.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral7
Sample
PDF Javascript.pdf
Resource
win7-20220331-en
Behavioral task
behavioral8
Sample
PDF Javascript.pdf
Resource
win10v2004-20220331-en
Behavioral task
behavioral9
Sample
PDF Launch calc.pdf
Resource
win7-20220331-en
Behavioral task
behavioral10
Sample
PDF Launch calc.pdf
Resource
win10v2004-20220331-en
General
-
Target
HTML Javascript obfuscated.html
-
Size
769B
-
MD5
6753e429e2a5fb32278e9614eadd3416
-
SHA1
4c64652ead8b010e94b267836bdf57b97fa52700
-
SHA256
b71ebf3c71bf7695e41f6a6a0498d651023c1dc705b6aa4b0fef1ae9bcfecf4d
-
SHA512
ce7d5ae038f39cd19f5bf9ee3a3ad095f3102b7277e65cf15cb99a93d8620a1e559418d823c4bc005b477dd5ea8b95d740697c7692077a4811e73c1d4245dc9b
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30953508" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "199162272" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356721837" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807b60232450d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "199162272" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f971000000000200000000001066000000010000200000007baf402ccbcb29a87e7883e9b157ed223c3b6632b8272162933d98b72f0c3398000000000e80000000020000200000008f2e01b1f1af24f752bbfaa287674dc7edeb90324a997d52e308c65b01386be820000000fce20d3c5ee207519a8b4cf4f3efd9342015b02bf7b1ebaf8eb34b4126cfb24540000000f44d4cce23b4e4f554a5588740cda5317f5c0ea68820584f1e4d5844699935c92da05fd2fc8554c0688ebfa833d5d3d82dd80ecc4a69734da0c973850dab453d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006af1d4fbcefdcb48afc82ad132f4f97100000000020000000000106600000001000020000000630e6e786215890d6234923eb3ca36c2afe6963416518064068ef048fe4bbad4000000000e80000000020000200000003f8f5694017a3bef4c571001670540bae80fdc46f95852df2450d622a6bb9d7820000000b00b770139af0439548b9b9d2dc9732942e4691e5cfe395ec969b3468174eb9f40000000e7d26581b4317da40cbaee2f3d7bafc3b1fc5e634202912b80fde5faf1650df331a86d17789d29521c6bcf89e5b587c6ae5779a44c526e0e817cbd0b6261e791 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30953508" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3431E7C1-BC17-11EC-9125-46170251781C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02933232450d801 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 888 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 888 iexplore.exe 888 iexplore.exe 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE 3160 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 888 wrote to memory of 3160 888 iexplore.exe IEXPLORE.EXE PID 888 wrote to memory of 3160 888 iexplore.exe IEXPLORE.EXE PID 888 wrote to memory of 3160 888 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\HTML Javascript obfuscated.html"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:888 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx