aa1e764e7a3cf790e994605d33c58f57f002f34e64495fbb7ece0ae344e9db97

General

Target

attachment-2.pdf
Size

9KB
MD5

c611ea6ab0862ec7527dccfaad5133aa
SHA1

d27c2c7fc427809e5ef7c8a6ec03d02810721049
SHA256

efc14055117633a34851cc7c891515d4f5970e72a01d9de750d6034cbd6d2a7b
SHA512

c19be5bcd46a087ae282617cb364d6819a650bed7a209ca78e3f612816a67f96dc26088dfd9188141187bc6810504c8b9ac8b87bb2c625e66680ca1306420d96
SSDEEP

192:nu9eDWTfiqTbbcABFrQs4qOW1sZd6ySP42+uH+204E0YQMCdE6M+2cElo:uJTaq7tBFrQsOp6ySP42VO4EhQMAM+J/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b542270cd8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F7B2D41-43FF-11ED-9C90-C6457FCBF3CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371664887"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000ed2ac4b09cd46bbb9dd8041572e94ef93f246c3d33c62ddc39be814783149696000000000e8000000002000020000000a990a9ea7341425084e70d79394f2ed61ed24141bf160fedb2d04417fc0cc45c20000000cd325c2eb80294fd412a4e413bb4cbfb36fd7b90a5b72598ef2f3f496e6cbd8a400000001890add0ad78db0afa8e2557a207036f1dd74aad49bfb2cc6015a56de6ae13dbf17dc2ba60fa6119a9845c2463c3dded3ddfc930e4a78e448df368aab0f4836d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c000000000200000000001066000000010000200000006fc9316fd4ae24ee5467ae4c01fcd759ddab111c2d1e2fe6402494df529760d3000000000e80000000020000200000009c4e8b74ed0955b27f23e6694094813fe8ae3a1eb558145ee35f789a57040ca590000000cd87038bf595088fd4d8913865a762aed48cc8d30b5bf2ac5408f9d37e82dfafb9fc7486103346f69935a5321ca4ed34feec775a96cf9b2751181a785b50acc593f0aa4e54dfe2825213a5c272717a893de35c76783edade7e88fcbc30759b002178ce1c35b2acf9c6e7b9c6dd9b9091841519417ecf097adee7e081afa9f4d79b9a6c5b36a12f958c4ff8489676169840000000645fcc1e4d443c36e8f8561fbe88f6ac160257cd1722dda3ed3d3412cc9b308aa49697a49d185fdc25ee69d5236ff693179dd1f087543dd20ef620e36b926be6	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

iexplore.exe

pid process

1272 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1272 iexplore.exe

pid	process
1272	iexplore.exe

pid	process
1272	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
784	AcroRd32.exe
784	AcroRd32.exe
784	AcroRd32.exe
784	AcroRd32.exe
1272	iexplore.exe
1272	iexplore.exe
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
1204	IEXPLORE.EXE
832	IEXPLORE.EXE
832	IEXPLORE.EXE
832	IEXPLORE.EXE
832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 784 wrote to memory of 1272	784	AcroRd32.exe	iexplore.exe
PID 784 wrote to memory of 1272	784	AcroRd32.exe	iexplore.exe
PID 784 wrote to memory of 1272	784	AcroRd32.exe	iexplore.exe
PID 784 wrote to memory of 1272	784	AcroRd32.exe	iexplore.exe
PID 1272 wrote to memory of 1204	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 1204	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 1204	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 1204	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 832	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 832	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 832	1272	iexplore.exe	IEXPLORE.EXE
PID 1272 wrote to memory of 832	1272	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\attachment-2.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1272 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1204

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1272 CREDAT:209933 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\818SVPTJ.txt
Filesize
597B

MD5
019a51ef44e22c5eb341f0df43294c1a

SHA1
d096d1696a77099755ffb9f9d9fb26a13beb3f00

SHA256
ad0d3076de665284180246f605c4b9890fd2a6423290f1f4f1e95c02071c5349

SHA512
cb9870b8acf292bf28082e37c1067fca3070e67c99b9183eaa22b24477d606fd0fc7b2bda57ae4c13d550db08a1351fe6d44378dcc82f78b90511f2fab9d1ad4

Download Submit
memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads