hxxp://pdfixers[.]com/downloadPdf[.]html

Resubmissions

08/01/2024, 00:42

240108-a2qfkshcdn 8

08/01/2024, 00:39

240108-az22laach2 1

Analysis

max time kernel
0s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://pdfixers.com/downloadPdf.html

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7462C6B1-ADBE-11EE-B5EE-F6E8909E8427} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2964	2352	iexplore.exe	18
PID 2352 wrote to memory of 2964	2352	iexplore.exe	18
PID 2352 wrote to memory of 2964	2352	iexplore.exe	18
PID 2352 wrote to memory of 2964	2352	iexplore.exe	18

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://pdfixers.com/downloadPdf.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
18KB

MD5
4d9ee47279c96865767c6a68539122b4

SHA1
bcf44e9913ffdda59ab853c5d32e3c825dbea4ec

SHA256
d11a51f3dd122df00a3e8f63734dea1fadd5c2bd8b7039f89a4b64b021ae7b95

SHA512
5d5509838a8e8ea1eb68982abcf753bad4640ff2812540d11414d29f223b2eb6e311a81d04683d8c23e959794f3c679fe6e9223dc36c5d0e8df590dd8732eee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
7742426b6b8fa20c6c33d621ecbb0b59

SHA1
ee131f26462dd8eecd7579b2d7a039a667215caa

SHA256
cc707a04be9dd59c38b7dd484cd230582fd8df488193c06e6aa331e298bbeb49

SHA512
397f17de62b591276a97b2b4e6ad0b09ac68efd44caac239674d50184bece2374e184654af6e42ccbdb756e4d613037a587db0a428a390b9bda3739e36566049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f4a835c88b7678d666e6ce0770b532a1

SHA1
1a69d9c0d5724c9910997e2c1fca63fe2cd88aac

SHA256
6198b1f9e1bcb9d5a01a29b4b43b31d8ba650c12705ea49fd33100255ea0532d

SHA512
5d4303a410d43290bb1c83e1be0db3241323aa8b3adb3236ca4be5f9b90e935357e3bf684a42ad7e451488505c397870d0174cabc13ae019f81923825b31c385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\s8rbov0\imagestore.dat

Filesize
26KB

MD5
75b08838ea7f03f4919453277c2f6782

SHA1
c5f366f4aa2fa1100b8d06cdad1a531b84edaed0

SHA256
37098e5c5c8d415310d67198d93b855ad49a21aa8131b50b7cb40f01fa7554c9

SHA512
1e23b15784acb81e7dfc2d5747b104465ee3fc6aec31be360cccdad31af56a3a7baa7783f3e057cd702eac3f462c71c9c9ade7a7d21ee0d2b39fdc16e11f2efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CDIYSK3H\logoPdf[1].png

Filesize
26KB

MD5
e6c49b85d917f4db4a9d3507d459b124

SHA1
1217eef86fa408bed31f66ed883b6a679ee85139

SHA256
98c44b9d2c49bc9fdd45d8d6941a96906f26039ebddbff47c696f208eb6d574b

SHA512
70105f98308b98f4f25217873228e35516dbb16840cf4e3517c8a12641f79746168646fdf889ca6b899124aee258785975c39c91725b6229d585d183a563eaa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PTCXM161\js[1].js

Filesize
238KB

MD5
e2cc15f21b1d1ceaf37b63c4d1502f97

SHA1
fe6062cee1ffff815ac641a42ab87a25bc858081

SHA256
5aa84fd6c70bdc74e8fcfb8c5e77e8ba7b04b3d2fef2eff99d2273ed92d5c20b

SHA512
91f3011c94d035a5c59b5dd380a1d477514baa653ede1d73d50caf249c59a7fef4afe1e6c1f4574f2629ea22751986de3b4766ebf5cd14fc12206a1030148685

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2783.tmp

Filesize
39KB

MD5
09c32308ab2f06e063bfacfe2a60743c

SHA1
458c90c41cc614c217eeea30d11d85331e51ee5a

SHA256
9a4e15b4afb6adc86cb5f31b0395dde606352fc136a1a77d92beb8d81d7e7056

SHA512
61cad8f2ac2d65e2586c520ee400c211237f047b7ffcc70d0297835dc8a77307fb574999e3955568d01705cb1d6d0c3aa902c8aa4c679f3f1422e597c2e8c4ae

Download Submit