Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
23-07-2022 09:21
Behavioral task
behavioral1
Sample
e269f955f008635d1df7033c38dd3f4049d15fa3ec74cff9db43d240282aff45.pdf
Resource
win7-20220715-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e269f955f008635d1df7033c38dd3f4049d15fa3ec74cff9db43d240282aff45.pdf
Resource
win10v2004-20220721-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e269f955f008635d1df7033c38dd3f4049d15fa3ec74cff9db43d240282aff45.pdf
-
Size
46KB
-
MD5
8bdd2cdd39b2ad7b679faa50f629ce2b
-
SHA1
30a585a33ab6a192758dfe07c375c0dca8fdaa66
-
SHA256
e269f955f008635d1df7033c38dd3f4049d15fa3ec74cff9db43d240282aff45
-
SHA512
3f49221e2b26e0da669890774c4776ffed0f871a519110d9ade975e6fa2c3a3adaec122b220520a2c9e2ea24a22e277860522aeabd23ddaf937889253e25ce24
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "48" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "124" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "77" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "124" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365333088" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E40D70A1-0A68-11ED-936C-5A3151DE7991} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f00000000020000000000106600000001000020000000b398d97488cddb7f9dc9f66ca89a28a86463d761f8b1710078553a227184fd98000000000e80000000020000200000006a075ce7ff2a5ad69fd0f6f9da9130a9fb407beeef259b58af143d726bf59d13200000005105af41de1fa64e9c8aa6ed556f536ea5f6abf2ddef154c45c1ed9dc92025e2400000000c0a9878f03559a6070b5f45c8092cda7bbc46aa9e709c7e0e375e719fb82c29646e67aa75b79bc3f7b627950ea4eb90ee0e3f50aeb4cb43205d617504af07f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "27" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "48" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "77" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e528c10875d4b347a30c038b2e32007f00000000020000000000106600000001000020000000e36a9bb1bc5d94c7b8a634d9376b6d503cf1dc121daba972b506a5e01b2665e3000000000e80000000020000200000002d5ee4864d4829d0dadcf893b2b19a7dc926ea69705fb3dbdf814df4e0cd8b7a90000000eb02406d51beacd86244f3cc0548e3089ada187805685ab21df3d2b0dacb28bf0b8f9505818b982eb77bfbb9c11a57482a2f941f7c07c91930dc840eac0df62f5255cdbf95152507fd836faaa17ca363cbe89b5f6bb36b7a6a0a9e1599e095dff45c5a60e98e4660c8dabf79af5da544e2ba5edeeb8a7a8ca05ef8d83100d7e1658463d8a2b08dd3edc7b973ca0969f540000000d740aa53a7a8c4384b30ea5a6c611464d87f1f977b84193ebb1a8882edf903f554401ad285b793acb796f5e19fa7accfb8a6cf4e16b3f3c3a9ba6ce54da2add3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "27" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "27" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "124" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "92" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1305" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "1242" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "1305" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "92" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a455c0759ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "77" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "9" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1242" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "1242" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\ = "92" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\DOMStorage\globalmarketscenter.click\Total = "1305" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1136 AcroRd32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 1608 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1608 AUDIODG.EXE Token: 33 1608 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1608 AUDIODG.EXE Token: 33 1152 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 1152 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 980 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1136 AcroRd32.exe 1136 AcroRd32.exe 1136 AcroRd32.exe 1136 AcroRd32.exe 980 iexplore.exe 980 iexplore.exe 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE 1152 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1136 wrote to memory of 980 1136 AcroRd32.exe 27 PID 1136 wrote to memory of 980 1136 AcroRd32.exe 27 PID 1136 wrote to memory of 980 1136 AcroRd32.exe 27 PID 1136 wrote to memory of 980 1136 AcroRd32.exe 27 PID 980 wrote to memory of 1152 980 iexplore.exe 29 PID 980 wrote to memory of 1152 980 iexplore.exe 29 PID 980 wrote to memory of 1152 980 iexplore.exe 29 PID 980 wrote to memory of 1152 980 iexplore.exe 29
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\e269f955f008635d1df7033c38dd3f4049d15fa3ec74cff9db43d240282aff45.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://worksflow.net/geoid2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:980 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1152
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5301⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD525f8406663671efabf802488b3b5fdf7
SHA1d97abce37d936cfce0ee5f841e53018a8017d7f4
SHA256631701cce37195687dd60be80971524a41cd6fd3c342e2746d897f20dec2bae3
SHA512e44c9029d5229a2764ba0b0a6ecd26f96f3f0986d20b3859102adee25827f1ea53e00cc2c945c9c58e363c2e4ac780df3e5e872489bddb221f7524975506f50f
-
Filesize
4KB
MD582e6c39a4e2348d40364d123db19335d
SHA140d0ca253197c8e72ff77e11b463c3ed68d6f262
SHA2566287621c2345e1953e5d20d45792ee26cc06c100e3fb14208dc69d1f117a1872
SHA512690446548b907d15fc054f06566e576f881f02de3a41e6dcc308bc5c4fed02b1ae8c71090c275949a06df846646ee38d4eb6ba1627acd5ce7e77ea19dd1dab95
-
Filesize
606B
MD541a54d0a5486f4c5d34c0e0757d2335a
SHA1be4caa17fb1b1dd2d30e56fbba9bcf868c9bd80b
SHA25658d90c8ca184cb235115082d3b784473ca1c81e005eefbcf945a95fb392eb580
SHA51263b04b53f8a0267fdc34605cccc78514a277b9fc402a5ca2eaac99b92d6dcf7fb3e52147f51d531835e174f96c7a03374e8c41f33f666f5d5c3029c1a9a40d3b