60541635bdb3c008a9cfa15d8df82d45ec742131c9b4ad1858b558ef7df2af38

Analysis

max time kernel
121s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Material.pdf
Size

350KB
MD5

72c812cf21909a48eb9cceb9e04b865d
SHA1

2dc265f23be4cf7cda328bdf5826601cf4f4bf43
SHA256

39fb927c32221134a423760c5d1f58bca4cbbcc87c891c79e390a22b63608eb4
SHA512

dd246487f348dbba52c7dfaae3f943b0324414c182e0de862db7d23e82ab5362c21b8733cf84af466529c631938fc544d96d78c51ea4330877993e9da7e5cbd3
SSDEEP

6144:zB1De0g/RC7lTqMAwraJOZMtXEHJGPSgwsTx/xE99jvQrZqZDxlK0oZ9TK2A6CO8:6+lq1wWAZMtUHJGPksFJYtdlK5TXuWM

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BFEA6D1-FAAF-11EE-A293-4AADDC6219DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000e9b1ff939f1d6b0603ac5a7c4f1bf2cfc3478f673974a72fcf0aab87c804e426000000000e800000000200002000000057016d7d79e17ac314ec99b86c570be0be5f435b3975dd6381d9d70bcdc4ea70200000002fb024893840985fa2bc74de3bd516aaf05b0f86dc1477a71b21b2efbd82748e400000004646adb9c70e1b123322d8213be873c72111add97f69000a04777b06478ecdeb22e97f0cedf7e755534d951421b21e5f3284a4585456b7245ba249e08c842a15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a96069000000000200000000001066000000010000200000006bc291d855ee5052c78d8bc8ad3c851c728ac9f8ccfaf2671fb7a196a82f352d000000000e8000000002000020000000e219076108b6fb53b1105492a5e13ffeba9fd26bc01bfb81c70e1fbb88072b98900000009c28b4fe94dd9c39762eb4c73eece3c36958132ad515af306e3e87f5500840d1137ab4a149b22d0c7b999ee1a0091347ffcd33656bbe3753f9a3a713bd3e1fd66ace93b39b470c75ee3cbbcc407824f3ca495821bfc4914f0e822d1e241bc815e35854a743120d9fc62fe9c344ea27f6eacf431cf68fd12221569f15c5037aee9815102105f2598714fec60b6fe7611e400000000e46c201d69fc0aa543ce7b84e409fafb80ebb347561b57131552609a579cb47856240bf2180f081413a7c4aa7db66372bb92bc37b66e19d03ff17ba31214a18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ba160dbc8eda01	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2160 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1276 iexplore.exe

pid	process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

AcroRd32.exeiexplore.exeIEXPLORE.EXE

pid	process
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe
2160	AcroRd32.exe
1276	iexplore.exe
1276	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

AcroRd32.exeiexplore.exe

description	pid	process	target process
PID 2160 wrote to memory of 1276	2160	AcroRd32.exe	iexplore.exe
PID 2160 wrote to memory of 1276	2160	AcroRd32.exe	iexplore.exe
PID 2160 wrote to memory of 1276	2160	AcroRd32.exe	iexplore.exe
PID 2160 wrote to memory of 1276	2160	AcroRd32.exe	iexplore.exe
PID 1276 wrote to memory of 2520	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 2520	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 2520	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 2520	1276	iexplore.exe	IEXPLORE.EXE

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Material.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://a.pomf.cat/hgfetb.R11
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
48c824d4b3e58b6851eb61a7eb8d95b2

SHA1
9d35a4211857a5aff349c12571bd654296aa20ae

SHA256
47e90198b7c8985667859cfbf439d9f8bc7bd07e0f39396213757e6e2beac3c7

SHA512
042f2654c1450500d9185a666d53530e1a2cd69c7b07db790a28ddf553c6907436c4ca7afb9b8e25827ead45b730012b4b14422b6f8f393b16af9761cf84ecf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0946f1c5652bbb101f0be483e0ca1bdc

SHA1
973e9ba02b3a9a9e4bb70c701c0af39c7995c026

SHA256
2d491fd44f3d9160034aa32abeb847fc3c6d5de637e8c15b44fc96c0a5d010f5

SHA512
d6e9c2704890f5b003133cc3488290ec77dcd2dd2443c36066f6e2163140899a97ccb926ec2dd8172a018e21b50d0655c53b1021fc0d40357e00b3e7ee861dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
696e3b3e6182b5fe309ec4b07280e80a

SHA1
597d2a36058bd7aaa3cb3f6bbc5523a323537d8f

SHA256
3ea26a65b417bd3e98d573c949ba85d7a79257820880bf669186d9fa05862da9

SHA512
2d971d79eadbbe1e12a20f7e4a802b65eb117b300aa712ed68b70814606be31a6a7c12c42cecbd94fafabad1a6e99598b70865e38747cd9844ee600f248c5fc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
606d625f40afb53339f3ae7d05c7ee03

SHA1
f1391390821b864e22d32b93771a6650c3c2efb5

SHA256
519a6e6081d5cef033b69523c6c0ef89da9982508322517b6e5a5eca83cc4015

SHA512
6cb689a56686c1a4633f4704c97e0a63dc5c51362ed1548e58b72bdeebd9d1f4970194b7cdfc0669e1c1814977610c7abff6dc8f99065fd62948beb9ce9528fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1ad2f469349f51f4333a6c175def537b

SHA1
504124fbf7b2c02d48d3cb8fc54d1acf76e0f55f

SHA256
72bd2be1d521dfc982004fcef058990bd4d49d98ca07bde2d536ab08cfd51519

SHA512
2f07ad6e2512095fa89b29aeb6f800f86e8387606cd5e97501c58ff6ffc1652421a6ff586b48c04de96eea9aeea51ac9bd0aaba7a93cb50b1fef345dfe0b013c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c3d0dcba3d62d7fe50329a16e0b44598

SHA1
244600e095d4c3ac0306b095f80e9dc3f6fc5c4a

SHA256
1e020d301d24d780af809c3d5d864b63a6638b9ace79c67d183b5674cf30a80a

SHA512
ae3fe4a6618daa43fc212021cac5358d6abc16a519a6797cca478e33b0c7bb5697147f1a43b7651d8ab246bdb0cd9b34ecb273ea20ce65fa7fbe2fac65190c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
dc20ef716b17d2822ed2721e167016ac

SHA1
3b31f73a3c57a65d706870ed3bdb02d04a543bf4

SHA256
60bc281ea6f55839691d74b48c27e5a22e3d71c3d86aca53f3e62e5058215d72

SHA512
203ec1931e7ee50a6aad7bb2ad913ebb8d2bd36cb57ba6cb5d0b11f330cd028245b710f89d481fa8f0fbb5568b2d5ba53fc6234e9f5a32138646f87f6d30adb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6a7e69579619a49e2072ad9b0e554b4f

SHA1
8e0c9c13f8ab4c9ff9987d539a65f2f58847ec94

SHA256
5d7ff9216e55ec203c3c10126a19d5c30bc6d289c12c51ff9783ada1ce157788

SHA512
bb0953193ee27619fc5bd0f3af2f353c30fdc9184e5301e70664ee40f2e912025c97a1551e4fa91447ce826b3b302754f174876456220fa7e714ce319b5149bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7091594054e4ccafc870d1100520e53b

SHA1
54f55ec567737a5f1b68d19f54af8a2e829b2716

SHA256
74d3c124039348011f51ad9e569d76e866cfc79ba8ac6a1375393e49c6f4280b

SHA512
9c76808cee2bf1ca864ffdd554063d9d80955157e2554154be682bfb77f62b1196bd92ca32cda1e6adfee1c3986e753bdd6ddbdbfa4b0ccf2ed4c72fbfdcfd19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8D54.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E36.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
3e915a8cb32492c6ea99780f63f92261

SHA1
f91e5c16f88766363fc7cfbe00bb492aef6277f1

SHA256
e84db533f81dd15b2ec7c07b1d32cc3fd9159daaa0790104123dc1d53709ab71

SHA512
9aba82791f10d9975c39d6ce966dbbcd2efa592b71243a3f059c0e4bcaf209ca971378e08dde6c5f4a7bbac16fc6e8c0d25d40b52594147a1bc7bd68b98e67cc

Download Submit