b171a44387c0aefd851068fcafed96de79e931e7a9d95eb65380e71425bae9a1

General

Target

THE PROPERTY LEAGUE.pdf
Size

31KB
MD5

0c296e920e4f26cd01ca6b4836c1b2e6
SHA1

f5c225e9d56eb5b0234d424c686ead1002307002
SHA256

b171a44387c0aefd851068fcafed96de79e931e7a9d95eb65380e71425bae9a1
SHA512

e4785c98c742ebf904c48d37b71137a368933a53f1c8dfc93e6117489a7a56dd42f2b3d0e471b2ca77e944ac63ae93aec7a61041b02378350031370102d973d0
SSDEEP

768:yDIxjZFWp0/ti6wtNOeLerr9kKbx0CIyDTyXAB9n6g/qLlFk8F:pdOVeHRx06DTyQHF9G

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006ee7d91a69c308498765d61d4377b9c35ef9fd93c7bcc55c4b9c31cbd0f977e5000000000e80000000020000200000003fcf0fa17e2043aef4f17c7f775d380c762df6e2cadf64a3197844bd83e38750200000004026e1ad9139a59eefd8e0f539d4e1763222d9b10e47ada1540adf7325f03618400000005175f630800ae8615fcf16006f5fc07032698d39735d8250b3d52ebc153ea46609000276f79d17ba12ae10706ea14d958527d23ef8f632666a442a6d8fc171ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372383707"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4638B11-4A88-11ED-A20B-4279513DF160} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00acd6bf95ded801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000c00bd0d20c7e83a5b8789135335b0e1b725a8a97adc5f287544cf79c8a67b5dd000000000e8000000002000020000000af2d6f7f404f05b12f6030900d3b7b1d410efa94cbe473d927184d144db7a9c9900000004a40328cb5584f963a0372388c8c5c0290f43e5b2c17029c0ba812a5362df070bbc692fdba7b9938c5b406e50edf9a7c3c92ecb7655a55939d7ba5a260a409bcf04d241848f4cd2ee4edbcff9b6302e7e28e786d81c6d00c891e2c8047cad9a915db621f2fe5051743281bfdfff31f5b1f5d5036967a9abbaff916c22e19e6c5bd70607dfb4fcbb6e3861a63e9b79dbc400000008e3ff04c243aeb7ec0c61e19f73d587b97b6aea1b63654587c4ebce12119a7565e67ecf6b682ade1e80e7c7c4b882d6557a0622a9e85be8383431422d8fdae15	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1732 iexplore.exe

pid	process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
2032	AcroRd32.exe
2032	AcroRd32.exe
2032	AcroRd32.exe
2032	AcroRd32.exe
1732	iexplore.exe
1732	iexplore.exe
112	IEXPLORE.EXE
112	IEXPLORE.EXE
112	IEXPLORE.EXE
112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 2032 wrote to memory of 1732	2032	AcroRd32.exe	iexplore.exe
PID 2032 wrote to memory of 1732	2032	AcroRd32.exe	iexplore.exe
PID 2032 wrote to memory of 1732	2032	AcroRd32.exe	iexplore.exe
PID 2032 wrote to memory of 1732	2032	AcroRd32.exe	iexplore.exe
PID 1732 wrote to memory of 112	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 112	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 112	1732	iexplore.exe	IEXPLORE.EXE
PID 1732 wrote to memory of 112	1732	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\THE PROPERTY LEAGUE.pdf"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.acibastos.com.br/on93493_732832newupdate/1/21421.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
cb0b21f2a4805e18ed308f52b0dc49c5

SHA1
86b9c88a9986b036190f4d4da2d47f5394494114

SHA256
3c622c8890eb5b17cbaa2897ef0c31e6b45d50f5710671ec5613cc02de3d2846

SHA512
b6ac948fc72bb37ae0bb2024c90e78476cd25c14d38d51a69563322b5aa148ed0a5a534e30189981180ffe8687808c44dc8307d22825d5ba120a2f6dc0db99e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TAR9OKL9\ac7524407d19ac9e670a3e3b7bd7ebc3[1].jpg
Filesize
30KB

MD5
be5274af7d8bd25b8148a190ff515399

SHA1
b8d0850fd92ee935287e17988b89e53607808c8c

SHA256
26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6

SHA512
64893c625be72783088575e36ef26ff4573243f32601bda754eda72b7515063b5e4e4831697d16ac663529c910ae12ccd145bec530f2a9bae4d9324301c65667

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IAAXQA3W.txt
Filesize
608B

MD5
f2dc8e3d182c443fcea1f511d60a99e3

SHA1
132f4210b4eb904d0fd3671cb8fb61626d86f106

SHA256
e26e4e9c4a2368b784e925f56bc1d21299ed871b83e9d6225247b540b5aee901

SHA512
52ac0e73daf66b35aeea0b6027d36a0d348e65e186bfe33dee8aea8c9d8e95bd4da26909885c92b0de5b30bae1d53256f83dc84d3b5ded08cdb813c8f257e37a

Download Submit
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads