Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20-09-2022 14:31
Behavioral task
behavioral1
Sample
Payment Copy#190922-001.pdf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Payment Copy#190922-001.pdf
Resource
win10v2004-20220812-en
General
-
Target
Payment Copy#190922-001.pdf
-
Size
246KB
-
MD5
db926b78737d7f4789f160b57f7659ee
-
SHA1
69f78005e84a86e9ae4698a7063b7cf7f357700f
-
SHA256
3171911f4527c4e22b1d2bddf421936d9b63d702b742eba54eb55771844b9f69
-
SHA512
1f0bc7543fb62e9e391a36576ac2d05f6886a16fb2987ad1464404c3d52b45e3fb0e0d9db61c9c73c558df37cea52c97cd138df81ae62bb0fac402b4f1907487
-
SSDEEP
6144:pUUtLpXNzMo8Auk55Q/zlk654ARhT7mnBE+Dfq5ql:pUgLpXNzMoQkjQy65/Rx7EC5ql
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370456451" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000007225ac2e3817dead0afbc6bf41fe0b4cd94219ba865c2b67abc448608e361ec7000000000e800000000200002000000007a4e5102e03ada10d56ca0af994b8543904707897fc131ce9ba1b9db0b553eb90000000421d948ab0f8eb51b12d70421a696c788c825b9288a053163191d1e4cc993d79cccbc5632772b13e2e213e6882bf31681e9a7c8be028c96f61f62f673862360db5dea8af3d1c470eb304744c73b9ce67996478c33b864285214d3456d9f8ed556bf808172ad73a308f4e0d0905c85a2f7a1d2a35e3a1beda38055bd75651f1c5b7ac13e7ebb272de90bd06ffd33694f1400000009737a8dfadfbb3be7ea3c83c12a287cf633fce20f1a261a2a5cdb8dcb147b17a0e9bcf9947e480e6a8b2124864342e93856b982c10d464022d7da6b4588bbcee iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000c747ad4ee163e6f667537ba28a3d22c6d97cad2c8fd559419955c9a30bf7d2ca000000000e8000000002000020000000f6dd51360ef6850863bec3d9d91287d754ab3c3c3f5f7f643c4ab05e7f6acad72000000056fce4ee58e7e59b52d2c84f8b617adb2ff28901a99183181b71640d3aec1d1540000000f9327aa58e6faf1c08409c83f37ceaae67a17791e6a0847646369afbef2df56e295cf36eabc33a678118e9ad8969dcebb96020844a50a471aa13f24c16b3fe35 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09ee9800ecdd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5B44A01-3901-11ED-A94D-C6F54D7498C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1048 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1420 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
AcroRd32.exeiexplore.exeIEXPLORE.EXEpid process 1048 AcroRd32.exe 1048 AcroRd32.exe 1048 AcroRd32.exe 1048 AcroRd32.exe 1420 iexplore.exe 1420 iexplore.exe 828 IEXPLORE.EXE 828 IEXPLORE.EXE 828 IEXPLORE.EXE 828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
AcroRd32.exeiexplore.exedescription pid process target process PID 1048 wrote to memory of 1420 1048 AcroRd32.exe iexplore.exe PID 1048 wrote to memory of 1420 1048 AcroRd32.exe iexplore.exe PID 1048 wrote to memory of 1420 1048 AcroRd32.exe iexplore.exe PID 1048 wrote to memory of 1420 1048 AcroRd32.exe iexplore.exe PID 1420 wrote to memory of 828 1420 iexplore.exe IEXPLORE.EXE PID 1420 wrote to memory of 828 1420 iexplore.exe IEXPLORE.EXE PID 1420 wrote to memory of 828 1420 iexplore.exe IEXPLORE.EXE PID 1420 wrote to memory of 828 1420 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payment Copy#190922-001.pdf"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://rebrand.ly/d6tbep8paymentcopy2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1420 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD56c6a24456559f305308cb1fb6c5486b3
SHA13273ac27d78572f16c3316732b9756ebc22cb6ed
SHA256efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973
SHA512587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a0262abeb08b9011f93df4510e32b3e
SHA1d7ebce12748473617adfde123cb5e9596e09d575
SHA2566bada9be06762b154af6a6d107748ecc8542cc53468ba4632776eeb4df95930e
SHA512b08b7e2d7c01d16b1bcc22dcfed3452742932da573883f8693c29718e09c3213d88e88ef26e08a6a58341e96a4d5987611104ed1cca70c358d46f483ed51cbf0
-
Filesize
608B
MD50bd1b86e9a10de462bfb2f84d1ebb924
SHA1f66a1ab3774f7f25fa12ccfef0ccb75ecec02b92
SHA256168beb2a0478bb61ffbe9459437e728db460fbdee5088ff63cb7aad7a9e1467c
SHA5122af4fc5466b69eafde29a59250228f40ae3cf46ff4a7d2ae839ebde902b881b2bb46e4862bcd19fec3ddd5da660f2a923fd0cbf11d839c66135a05aa8ae2fcb3