f20d9d16ffdeeefd5bbc546cdb1976c83159e117a89cd9bcc413be58e0024215

General

Target

FACTURA_LIVERPOOL_ODM950324V2A_2021070200133021000011.pdf
Size

52KB
MD5

141362506d035ff37bec2508f9652932
SHA1

d492432b591816d2a2a90b82e31ba3f3f62f2c70
SHA256

f20d9d16ffdeeefd5bbc546cdb1976c83159e117a89cd9bcc413be58e0024215
SHA512

923e11019dd462faeef5d5d875ed73ef3122b7e33205717066806cdb610046d3f7bfbcefb02d217af0d4f68dd635b101ab58facb11c5bde894b1de1064e166d2
SSDEEP

768:4NRR4dADfXDMQ5chAP5xxtfT6iltwfyPi2RbeepVCNhRo2H6SrFugC1WJ7W/:472d5Q5chABxDT6rqddOpo2rlVJ7e

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D243171-4412-11ED-A993-42FEA5F7B9B2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371673151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DB56551-4412-11ED-A993-42FEA5F7B9B2} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000051e980355c980eaf4439f8d59796ff042c3464c05655d2f2b1d2f6c712a96025000000000e80000000020000200000005b8b771a53e06a1f7adee3ae1cd231dbfdfb6dfb4810e6643d05a3f5d5faa6d090000000aed12eea8c6216aaf2cc122dd1b693df1813490b90b6ff855bd1df37fceae6a1ff170a30f4560614eee7e4b05fa04a24bf9bd64ed6be4ea7d77feb157ba2da26b481019fd27e11fc13b898cf8bbaa732aebe91c32a0f46763c87d126523d3357f63935a3aa9d423288e9cdcca1eb041ce62560a520a7256c39813baec977f7e1ed640dc2e01387a0b30d1e2b139d7d7140000000ff8c29e8f857c2cba8ba4b5b3ae016a6c2ede3df9a5d960608947ce49ccc3b8f187503ae4bdd0c608e7067859e5d1b9714fa0ae4c830518a04338d03d02e93b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000008bdf9f79c1f68d1f51073d73f1bb68f6d97766aa396a1cbbf7cd7448100495000000000e8000000002000020000000a7b51e1f770541b3c0ef6274eddaf8c929593874fc2760c04a7f5f3e39563f91200000004dd55193f84bb98fa1ebcab6a4c44c0f911531352bb2da6450bf7aba03d53716400000001ed41f0a2635056052536a1427444d894c94d38c4a02f4f9a1b88d8947dd5eb10e866c8d376f3a21f405faaaccba4ac9c984060c104f851e7753f307e661561a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8045de571fd8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1424 iexplore.exe
852 iexplore.exe

pid	process
1424	iexplore.exe
852	iexplore.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

AcroRd32.exeiexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1812	AcroRd32.exe
1812	AcroRd32.exe
1812	AcroRd32.exe
1812	AcroRd32.exe
1424	iexplore.exe
1424	iexplore.exe
852	iexplore.exe
852	iexplore.exe
268	IEXPLORE.EXE
1508	IEXPLORE.EXE
1508	IEXPLORE.EXE
268	IEXPLORE.EXE
1508	IEXPLORE.EXE
1508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

AcroRd32.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 1812 wrote to memory of 1424	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 1424	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 1424	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 1424	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 852	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 852	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 852	1812	AcroRd32.exe	iexplore.exe
PID 1812 wrote to memory of 852	1812	AcroRd32.exe	iexplore.exe
PID 1424 wrote to memory of 268	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 268	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 268	1424	iexplore.exe	IEXPLORE.EXE
PID 1424 wrote to memory of 268	1424	iexplore.exe	IEXPLORE.EXE
PID 852 wrote to memory of 1508	852	iexplore.exe	IEXPLORE.EXE
PID 852 wrote to memory of 1508	852	iexplore.exe	IEXPLORE.EXE
PID 852 wrote to memory of 1508	852	iexplore.exe	IEXPLORE.EXE
PID 852 wrote to memory of 1508	852	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA_LIVERPOOL_ODM950324V2A_2021070200133021000011.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:340993 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:268

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www1.mxempresar.shop/pago_comprobante/dasssashytsrfwewdw4w432dcadssswe32dsfwywyw67wjjehnsbvcdfreyd.php
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:852 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6D243171-4412-11ED-A993-42FEA5F7B9B2}.dat
Filesize
4KB

MD5
1756be9e8a72e37b6fe13e2482be0128

SHA1
e938c914c7ca4f0f01e6b5f7a68fed2781a57123

SHA256
8d382cc5b6259f4f015819684c9112d07165aeab36bb00700f5ac17106c543e2

SHA512
a0f1b8c5542e5efbfdbf0553015d9efec90243df59c70f10817d0e26a24b86b214a13548fd6065ac5ee70417fb5f18d580ce94c17bdd05c0a8b7df04b964faf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{6DB56551-4412-11ED-A993-42FEA5F7B9B2}.dat
Filesize
3KB

MD5
14b13858fa0240e09c9c8db9933beabd

SHA1
0bf1d7f88a4a82cfc8d59afc7bc8db01fd662b9f

SHA256
7a0ce2cf86f64adb329ff03d6f40a3dd4bacf265e67f6ffbd92af68aeb36d41c

SHA512
f447670384b9a0bbf88e9118afdda24f4a5bc07873b5927c1a50e81f41968ef80b50cd77e55562e35e0aa5209c6c9338e82b7bc79c1f0c3fd91aa04e6fda8222

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5YOLKWLE.txt
Filesize
608B

MD5
8eb0a1ed2298f2aa5148b0916297518c

SHA1
a031b9653a98f397acd6b6c03bda3ae25809f84b

SHA256
3fb6786aae23316fe411359e885577cc4eda8c1d668c5a3024d2b603e9ad10ab

SHA512
f883f9959bf503b95b24a04cd12dbdb64adc3578c4c72843bcffdcbf89e47ad0715f295bbb7288dafac4032445898d581cd38a996b05947a21965c6c7b6d3259

Download Submit
memory/1812-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads