Analysis
-
max time kernel
148s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-09-2022 15:45
Behavioral task
behavioral1
Sample
POLITIEINTERPELAREGN09332.pdf
Resource
win7-20220812-en
9 signatures
150 seconds
General
-
Target
POLITIEINTERPELAREGN09332.pdf
-
Size
997KB
-
MD5
09629cd52b39117285be35bf01b1d680
-
SHA1
592c0843890901b5d686ed628e4a6f48840d67a8
-
SHA256
2a5f90ea205b239f02b4afd1886906cd8d5fceca48a7479da27c55d0a18bf560
-
SHA512
29e71e1990893a684f25c89e1c2b0d7c8a262457d2bf13919043fc4ad9c92c8e9d7a521c7468e9b546f83468e9036000c02e854484f77639cdfa19fa639545ba
-
SSDEEP
24576:TemXjoowTcQH954fWxJoos0LMlP+muikO+BG5jsJ:T5TxQH9m8XLMs95
Score
6/10
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE Key queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 OUTLOOK.EXE -
Drops file in System32 directory 14 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\system32\perfc00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc010.dat OUTLOOK.EXE File created C:\Windows\system32\perfh010.dat OUTLOOK.EXE File created C:\Windows\SysWOW64\PerfStringBackup.TMP OUTLOOK.EXE File created C:\Windows\system32\perfh007.dat OUTLOOK.EXE File created C:\Windows\system32\perfc009.dat OUTLOOK.EXE File created C:\Windows\system32\perfc011.dat OUTLOOK.EXE File created C:\Windows\system32\perfh009.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00A.dat OUTLOOK.EXE File created C:\Windows\system32\perfc00C.dat OUTLOOK.EXE File created C:\Windows\system32\perfh011.dat OUTLOOK.EXE File opened for modification C:\Windows\SysWOW64\PerfStringBackup.INI OUTLOOK.EXE File created C:\Windows\system32\perfc007.dat OUTLOOK.EXE File created C:\Windows\system32\perfh00C.dat OUTLOOK.EXE -
Drops file in Windows directory 3 IoCs
Processes:
OUTLOOK.EXEdescription ioc process File created C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File opened for modification C:\Windows\inf\Outlook\outlperf.h OUTLOOK.EXE File created C:\Windows\inf\Outlook\0009\outlperf.ini OUTLOOK.EXE -
Processes:
OUTLOOK.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt OUTLOOK.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" OUTLOOK.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
OUTLOOK.EXEpid process 944 OUTLOOK.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2036 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
AcroRd32.exepid process 2036 AcroRd32.exe 2036 AcroRd32.exe 2036 AcroRd32.exe 2036 AcroRd32.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
AcroRd32.exedescription pid process target process PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 944 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 784 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 952 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1984 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1640 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE PID 2036 wrote to memory of 1644 2036 AcroRd32.exe OUTLOOK.EXE -
outlook_win_path 1 IoCs
Processes:
OUTLOOK.EXEdescription ioc process Key queried \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook OUTLOOK.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\POLITIEINTERPELAREGN09332.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:[email protected]"2⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- outlook_win_path
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
-
C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-57-0x0000000000000000-mapping.dmp
-
memory/944-55-0x0000000000000000-mapping.dmp
-
memory/944-56-0x0000000070EA1000-0x0000000070EA3000-memory.dmpFilesize
8KB
-
memory/944-59-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/944-60-0x0000000071E8D000-0x0000000071E98000-memory.dmpFilesize
44KB
-
memory/952-61-0x0000000000000000-mapping.dmp
-
memory/1640-65-0x0000000000000000-mapping.dmp
-
memory/1644-67-0x0000000000000000-mapping.dmp
-
memory/1984-63-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmpFilesize
8KB