09432b7ec107330c5fad0f93dd6e58c99a15c4c37a8e25540b42702e72ad2af7

General

Target

09432b7ec107330c5fad0f93dd6e58c99a15c4c37a8e25540b42702e72ad2af7.pdf
Size

43KB
MD5

8a0e49f7ef8df4c2032def1154c580bf
SHA1

324e3b154e0339077e1943f738c91d35754b0f67
SHA256

09432b7ec107330c5fad0f93dd6e58c99a15c4c37a8e25540b42702e72ad2af7
SHA512

46fd0aea1f3b7687ba0e873d7d19b376bd4f9380d1bea72aec375bc328d33821b559101bf583d85f66e18b285b3c1bfaa5d070a65c76e7f4389b4753105c30a9
SSDEEP

768:SmPoD0Ry/mcmF/DxpzqKJAPQ2GwUDc3CGL8IpNZ9HUpux9K:geFbGupmP7b7Hrx9K

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373653768"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FAF87411-5615-11ED-808D-42A98B637845} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000084da932f9b6c6864ae3ecb3892b69abe31c3647ef845133a8aeb8e9aad64f2b0000000000e8000000002000020000000ac43dbdee7b946846e69351998eb9df52b31963748a8c094856004d110d7b2fc20000000b87851e5950ad9fe7f0de9c0ffa557650d017b7169a15cd4cf076b3386acd5c440000000d5e0441f4243f30c25a6bd2379ec99d8689fea21f1793558c705eab360c07017d917a3d563de7e56875018bb5d1a202d5339b4e02f45a7cb63577f60b23e034e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0feb1ca22ead801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a30000000002000000000010660000000100002000000037f2eae6c2f2d8800c47173b5b669bfa7403366adf915662a7fb9b32efd659ea000000000e80000000020000200000001620f544cd427fe4c80dff1e2d4a4edbb66d5b29d2c3e4915e4adf0b3de29de69000000051871eddb18c53eb75e1ed72058da4f7b3e61b6d1c95f53b20b043292b87134a15ed223c9d5b78290149e804dc64b7342da33c0ab748c455d3ed2051ef1689db4d4c6c1fefae5fa9cf8fc0196ca615244c6bbd9788ecbc86bc720d00a673cd101f128675e5389b05a339f2003907cca5a8a5e3e923e4570e40427a13bd06bde16bbb210d1929417a58c479f5a45250b540000000c6ef20a1c0cb820337181f9ddaaa6f3d58a2806e3e9b6a861bb2de111f18172475c9db67e45af144d8f57ac71eb93e41224b987ac943084451f18b2347fd23aa	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

1664 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1076 iexplore.exe

pid	process
1076	iexplore.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1664	AcroRd32.exe
1076	iexplore.exe
1076	iexplore.exe
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE
1788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 1664 wrote to memory of 1076	1664	AcroRd32.exe	iexplore.exe
PID 1664 wrote to memory of 1076	1664	AcroRd32.exe	iexplore.exe
PID 1664 wrote to memory of 1076	1664	AcroRd32.exe	iexplore.exe
PID 1664 wrote to memory of 1076	1664	AcroRd32.exe	iexplore.exe
PID 1076 wrote to memory of 1788	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1788	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1788	1076	iexplore.exe	IEXPLORE.EXE
PID 1076 wrote to memory of 1788	1076	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\09432b7ec107330c5fad0f93dd6e58c99a15c4c37a8e25540b42702e72ad2af7.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.pspmrsmbpj.com/opac/repository/minecraft-story-mode-free-download_GM479516143.pdf
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1788

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
9bf66b6370579e402f5d17d9c6434620

SHA1
4453ba0dd3671d4a02f7ce58bff6a4d3f90f71f8

SHA256
08994cc20bd286840cc8021879bf0bb94b40b1b183242596e4f84877be344364

SHA512
0366acf9d6fe1964ed558baa560fcec8943363b94f690a267cd880c24f29b36b335778f0ae1b07d8d2689a5c7921ae809dbd0b2f53f7e3fff60efd2399350815

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
5e635f7bdbc829ca4e31d09f5b4e0652

SHA1
6f3419d31b8ad295059a1fbd6296f3024d32f4a0

SHA256
78b410be3b882052e3d9fffaa24f0bdd562e1f5656f8eef5c7373939753cb78e

SHA512
56e8f5fffe035a6deba3630f71e26b1e670123c26751dd1b70cf4babd6f81b642d5fcdfcdb8369e5bdbe0883c0e45836d55e359144e1c9805ae07617c679b044

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\UserCache.bin
Filesize
70KB

MD5
0329b71a23a941484f753a46061d28b1

SHA1
231449c2b259a386a3acfdcd1eaba4a294ec9adb

SHA256
e3705e800bbf89a228f4c77b866eb1738ea0a409d0a0fb11280ca0d68d8a5539

SHA512
69d5be281eff97b3a6e00d22f51df152ceb8be3bcdc128ec8bed7334a2484f3b4eb8634deefab0d998c3b0eb87c5c21a013f68862deeea622604fcd9630848ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5I5TTEKS.txt
Filesize
608B

MD5
6478d8fb103877d6b4eb42d4f1d2e31c

SHA1
c11e8be2099532c26ef4bed52dc65b64eb42954f

SHA256
f49b6dd37f96bccd56c5842b6024306f5e1831d186233f72a1e43aee32c97afa

SHA512
865c8b2f6d44eea506cc0caf7e4d3d0401b1c480266e42d372d789d9fd8d8b2fd1dcc91337f354f99b1f8a646a351064b410163bd4c87fc7c2ad60c88ba17a58

Download Submit
memory/1664-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads