5c99ca9a1667785e1299d3d5539bc2f87bf3b932e4f85498009eff9ea9737222

General

Target

0670HJ571bo77.pdf
Size

354KB
MD5

d4e45135d318247b0db5f7a66b886dae
SHA1

c21412e7242999d5e0d89f7a260012688ee2f49c
SHA256

5c99ca9a1667785e1299d3d5539bc2f87bf3b932e4f85498009eff9ea9737222
SHA512

e0ff6c244779409534fa13da55cd86fe9c3ce30cb2dc5fcf6356a48f98ad22c441e532a37b69644eb58b2aca58b2c74418df30c3dd407fd4520d22c3c43ccfb5
SSDEEP

3072:G2jex3TK0GZ845NL7pOjKaajWuP7xd4p9G4hoMSRETHtq4QF89OfkM8kDWD83M6p:s94eEFCXGyaRqHY4QK9W87ZJArNcY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 6059e8c10fb1d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9C78A41-1D02-11EE-949B-6EF46A3BE504} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\.7z\ = "7z_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\edit\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000_CLASSES\7z_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2804	rundll32.exe
2176	AcroRd32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe
2176	AcroRd32.exe
2248	iexplore.exe
2248	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2248	2176	AcroRd32.exe	28
PID 2176 wrote to memory of 2248	2176	AcroRd32.exe	28
PID 2176 wrote to memory of 2248	2176	AcroRd32.exe	28
PID 2176 wrote to memory of 2248	2176	AcroRd32.exe	28
PID 2248 wrote to memory of 2228	2248	iexplore.exe	29
PID 2248 wrote to memory of 2228	2248	iexplore.exe	29
PID 2248 wrote to memory of 2228	2248	iexplore.exe	29
PID 2248 wrote to memory of 2228	2248	iexplore.exe	29
PID 2248 wrote to memory of 2804	2248	iexplore.exe	31
PID 2248 wrote to memory of 2804	2248	iexplore.exe	31
PID 2248 wrote to memory of 2804	2248	iexplore.exe	31
PID 2804 wrote to memory of 2596	2804	rundll32.exe	32
PID 2804 wrote to memory of 2596	2804	rundll32.exe	32
PID 2804 wrote to memory of 2596	2804	rundll32.exe	32

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0670HJ571bo77.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://webmail.une.net.co/home/[email protected]/Briefcase/factura_electronica40368715.7z
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2228
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZEULFN0\factura_electronica40368715.7z
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZEULFN0\factura_electronica40368715.7z
      4⤵
      PID:2596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZEULFN0\factura_electronica40368715.7z.0yerxsf.partial

Filesize
2KB

MD5
b05c48fc2e3aef3b1f82a8da79faf089

SHA1
d75c8028d794c067f2799e126ea962cf4c2ac005

SHA256
a1d48692b9dc3ed7707f97c39f354ce25a9be11392583ef894ef189f6e550831

SHA512
ab4ca0aae10895c7f97365f22e6e6d93ea46a124083d648099a73e22dde74979726764e7b46ad74aa2aeb3252103d3af5f7353fbc316de11ccde0b4b65f06e22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZEULFN0\factura_electronica40368715[1].7z

Filesize
2KB

MD5
b05c48fc2e3aef3b1f82a8da79faf089

SHA1
d75c8028d794c067f2799e126ea962cf4c2ac005

SHA256
a1d48692b9dc3ed7707f97c39f354ce25a9be11392583ef894ef189f6e550831

SHA512
ab4ca0aae10895c7f97365f22e6e6d93ea46a124083d648099a73e22dde74979726764e7b46ad74aa2aeb3252103d3af5f7353fbc316de11ccde0b4b65f06e22

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa0991225d1790a463b43fdb4ea47c3a

SHA1
305101ec8f9f314e8553919fd73121e24f682936

SHA256
b4eb8e73356916a150b900a76fac15e03ccb5a44369dca098ce8df9a99b9f106

SHA512
330e08327f2924a30736664ec510e63dee3decea606869a7aca5cc99e55cd478a3c399541b38c8952aeeb00c5c6a829004c9cea1820ca42609869bc85751501f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads