97a88acadfd9c243e5c047612fd02153e7e0130db31c672f94855ea576ab45dd

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PAGO FACTURAS.pdf
Size

80KB
MD5

014adba57b2d1ca0e4a5742fd9fbc69a
SHA1

3e374b1feae0cbb82d8e27f44a26c9ff40f86888
SHA256

97a88acadfd9c243e5c047612fd02153e7e0130db31c672f94855ea576ab45dd
SHA512

586263c1fe84f9d1c5617174045aa76d8327c6cf88aca95ecfab384b469dc57f4adb79c539c0e899edceed9a3507e0d619e5dc532b932dd415f78ba0f5f4f829
SSDEEP

1536:dTXsAUjqyAmEECe5xGargdW0vPpVN+htruDJdmb:FXU9A7EL5pTJraPM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000024735df90d98ff4219b8e10384f9d299756f0690fac637a318301f69f547a0d9000000000e8000000002000020000000ada83111a3807f32a6e58b9e4784c4571e1c398664691e74e12368164754def690000000c5260231f6dbef0c060950c8e106df744b3304f809d7d6ecddac68be79deeafbd720f71dbd6155f43eef6870db85efc959d22e27bc745a8803784d5fed709248f2cee33ed7b4b15beec0b548960ea2330edd4a654ce74c92566ea705fd1c94beb2df0f520c3b71dd451f059600c76f433fa045e65ba8d5ee7bbb062bb55f156852465935dbf9b2af8bea5a412dcde5c0400000000f8785a31b24ef5b5211bb31f4a1f0765c4f9faf25baa31e60d17bd8f59d51a8f93751ebe5dc9b0121ad41f7431220ccae79f7a3ebeb0f78a85cde19451a94c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0af0d78a95dda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A31595B1-C99C-11EE-A3D4-6E556AB52A45} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a80a525d0035275b618dfdb2b2ca256c66688fa40186998df8c0b0a93bce8eb1000000000e80000000020000200000005b38c2f65349585f1c3b85401573a6353db71ae94fe05e5eb1b28b5a8e0d28af20000000dad165f7db21e36e69a9e04105f86fe2badb88071abaa6bd421f6ace119ec019400000008efa3d32178a988bcb41d3f86e3dd35d368d9851ad92c1e6a25281aafc25870d929c49879bedc5045ac9f87687ae5f6660c52fbeb0a7c683f112b5018ba3753c	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2236	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe
2236	AcroRd32.exe
2724	iexplore.exe
2724	iexplore.exe
1688	IEXPLORE.EXE
1688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2724	2236	AcroRd32.exe	28
PID 2236 wrote to memory of 2724	2236	AcroRd32.exe	28
PID 2236 wrote to memory of 2724	2236	AcroRd32.exe	28
PID 2236 wrote to memory of 2724	2236	AcroRd32.exe	28
PID 2724 wrote to memory of 1688	2724	iexplore.exe	30
PID 2724 wrote to memory of 1688	2724	iexplore.exe	30
PID 2724 wrote to memory of 1688	2724	iexplore.exe	30
PID 2724 wrote to memory of 1688	2724	iexplore.exe	30

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PAGO FACTURAS.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://ver-archivos.online/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
658ea0b970924bf5906eca29ce5794ee

SHA1
1c276964d61d8c624d2fd37cc82834d6b12cfe5d

SHA256
434e3f97a695c96eaad79f1efc4715998e7d5d16a7e74cd70065afa57d72d9b8

SHA512
70791b660135b6400c04a12a2808bc528c96a24528062df33b5b48f53fd002ac24c803b11ea7f7030e42c4549b10a4f504d0de2b4510d6bfacf5663b6e080046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dad873efe1df636cf208a4026301f298

SHA1
da9326f44a8f88384c506ab5ae972c4e23efefc2

SHA256
2447b56aab1ef7e8aa4514827fee7b9f4d3c0840937745475cb668b3b40ac388

SHA512
ec220499dd8fb62bd537a45000b4819bca9ce685b6a3ffa424a0622dfd70a62d214f5afbe652db8a98d1acfb2e8873cad43c1342475f82621ac535ba71fbebc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e36ef62bec089c0abfa1d008ea77736

SHA1
661e6580591ec148932e1ce96507195e7bdffa16

SHA256
fd2307827aeca323ec62ef2e16b9f75fa8ee22dff553814b8b6525eeb7039d62

SHA512
41ca88e272827fa22e228e5f0fe8872698f2f06522fbf8fc9181cb9fad11d67a887183e10d0c9729551aaa661f55f372d0d478cc2bda0a7e503206df1adebcf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f384b0606aa5b5a0658552806318b35b

SHA1
923fc2e6f3aa3f9551cba173e65e3c634d85b98d

SHA256
639ca04681544436441d9b38fd9ad23da7ce5b567af656e490dc905f87ac6881

SHA512
b4b65cc584b3f9e058f0209beab8f9a00d3263a5d57f3143f6ece0d5f4ee7a66360e9e3a74566764f87e52a78bf8d4c9ae7e982dec69b7e1f1f378fd61f5a60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c512b4a1ac635e4cf52c29e5d0dd18

SHA1
adae58a9916f62131573dfe2d22b59107ce3b46f

SHA256
d4d24d51536571542f57601cd260e25e925b2aa6d7fcef2776e248bfbc423f8d

SHA512
cd6d8b4f5695ee04b3ec28fea7c910ab3e2a6961078cd458b8d9f0202de966db86a884aa2d4a45b58dcd744867154b1d80b31b8c8c26c65e8fc8b5a300078162

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a44f3da729b711ab8838801b210014a

SHA1
d7e1bd3b84367159c15b0b00063ca8f583be672a

SHA256
10bac77c42e77ff4a090f425509a983a190cfcb2ea06ed8b28eb27e974bffb34

SHA512
e3bdab3f48a7641201e3361e047940c455267d3d93430a6608b4afc129950336048f222277ad94a7508f38c39ecdeb198a0391739f43393618e357c0033a04d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4a0c427cd560862d52a6160a578517b3

SHA1
81db81f8ecab91010289c395354fdc7b4a0ce8bf

SHA256
5324fe64fb73b576f66ac823ecd95410093de638d90145962ff08ac3f22ee740

SHA512
21214c21c3f91171ea04eed3c46cf43ea29da2c5115ec59b521112c5fdad1852e4582844671f3ce1599d5562b2915ba59710f72e41874c802982dc7466ef9d6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6afa4a106112182370f41ec92339a809

SHA1
09f8b516ee12a380a7d26a9c3a1969f162c7e22c

SHA256
68c240809d59e731b9c5b80c65c586da522c9e22b7197af50b9fdc749dccefe8

SHA512
294445e958e93248f09de4dbea9a5dc3fae7cae35e75a7a71262138cec6180e48ac5e8735e27cd57e234261cd46138174f6717a6d9cc860c8dcf714a4a6d3c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cf1e5f3a082c775b43651de451534b4

SHA1
12ba6596fcf9da8eae65cd79c19410a37d9bf4df

SHA256
07a4bccb9b1d531487709dd909469513d61689f4828e3999c50e3dc7889e29f9

SHA512
029aeee6a4c39d781d925f4713c6b42e7b6624f8bff4c8da33c9ac0634a4001e54e47aa51dad53a4edd47b8fbd4b4524a519706c641491527cfb134aa2a2871c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4972.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A30.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d4ae640aaf68906a7060134333e26dd5

SHA1
8cd7be251d186de12b3a8cae7371f47b8ff46fc8

SHA256
40f86ae7d4b6c777179dff84a00c2a38f8e5d32a29128f9b5c4b8e9368c2dd55

SHA512
4fe09bc641aba56ff72039dc4e6efea2347a9963bda27bea5e447e71a46c7f7e6c67b6982487b415e9c0922789442768a9d77980e9a13ef8029b423043ae185b

Download Submit