cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414

General

Target

cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe
Size

54KB
MD5

ea1dc4ec0feabcbd4996ca8bc6ff488b
SHA1

d9b57717f9e84612a76f5f4d74df781f8d504ab0
SHA256

cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414
SHA512

302975a201c8f7fdb2c6b87621d47c42230863b738703fa83df35a5c443668e8dffd78abcaa65bf31a968fa9815a3a65ea54025a1fea3047689dbb4a9d341216

Score

5^/10

google phishing

Malware Config

Signatures

Detected potential entity reuse from brand google.
phishing google
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000002322bf4d209c47aabfb49742c8fb20a60cbd05e165435cf92683b4a0480afbc4000000000e8000000002000020000000e9dd46ebfb47b49de9dc25f74a672bf147c09b55854c2c062c6b22e7d3d9d5d4200000000837f3edccc58e1c9c83a95a644a2309a936ac38a88072a21735d8feef5be16140000000c03dc0b31bc88d68634b2d95bf47a4b3155412aac37c114afd35482c76b453f29a2825489657168228e3deb2a71ade2ad3c163ea2559a7e962a93d071d7c5344	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "357241318"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0cf5ca8dd54d801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000002ddeec5aa910fdd83ae0a90dccb14046e6531605449adb9f806ee918068648e7000000000e80000000020000200000002c5d814ae7ecd18f5d7f05caf511e6052e8f5f6a63ca04c5cb27add34aedab399000000074bd91b7afc5e7afe0514a42de94a45cd9035f0467b9ce7dcc14ebe65d72e5dd4a774c7607cd3dc8c7f5d01e1441367cbd10d70e48d79a3f63c59b762e194a0cb953b61eed4533ba125f1a7b5aa37ea72ae997e7e358ab0867614909c34222080fb2d0476e0cd6c0d7746fd7a2827a1bcdf64f8ceb0c2d2b1cde6e554d6401d5407fee1aece0b57898c30f450c7b2e7f40000000277fa8bde399743434d10ab1e862fa268b923142572ca3f9dc3be34febcf2a3cd44ed4c9d7d413fdbec3fdcd61bad1f328a56d94f8674df092e154cbc49c0382	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2BDC531-C0D0-11EC-847E-E6BBD082ACA2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1100 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1100 iexplore.exe
1100 iexplore.exe
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE
1740 IEXPLORE.EXE

pid	process
1100	iexplore.exe

pid	process
1100	iexplore.exe
1100	iexplore.exe
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE
1740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exeiexplore.exe

description	pid	process	target process
PID 1464 wrote to memory of 1100	1464	cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe	iexplore.exe
PID 1464 wrote to memory of 1100	1464	cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe	iexplore.exe
PID 1464 wrote to memory of 1100	1464	cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe	iexplore.exe
PID 1464 wrote to memory of 1100	1464	cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe	iexplore.exe
PID 1100 wrote to memory of 1740	1100	iexplore.exe	IEXPLORE.EXE
PID 1100 wrote to memory of 1740	1100	iexplore.exe	IEXPLORE.EXE
PID 1100 wrote to memory of 1740	1100	iexplore.exe	IEXPLORE.EXE
PID 1100 wrote to memory of 1740	1100	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe
"C:\Users\Admin\AppData\Local\Temp\cfd1e063534828852d5ca5d29618fa940032f65eb27adce501912f8d6c2e6414.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com.br/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
34287e44af4a8c8e98f3ec60041464cf

SHA1
a5e171b814302e6f6f0aaac2de74fcf75ebd5ab8

SHA256
68ca1f7b15bb57c9715b436f7484a8e28e627009e20d34dc4a155eec7d7fcec6

SHA512
6f93fac68e6d38da419b2c0e703b125b0bc071522a58a2a5d11a869cd86688a883e45e8fdd7dddd62a3388a6118ba4c2e21b578c375efd474fce1d83378f07bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1b4wh1e\imagestore.dat
Filesize
9KB

MD5
3e1798459693533c123a3208f7e0023d

SHA1
0911128849b6f31025d1bf44cabd3ca0fe34be45

SHA256
86f8f90487d066710570f6ff0f9fd5ec513b17c243dc6a3dc7806c594c069d01

SHA512
a1e3a290862180868ca04ed7e94d4ef7ece72e8b38a54371a6f1a55c3726e2fb15eee85d731ee989d34014dc989d71c687b9310e989cca8eae1da1295f4044d7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9FOP67XM.txt
Filesize
607B

MD5
ad8bc5c881cc6b9ce8b1ac26fedec637

SHA1
4a29ed4df0a944233889d678809922926ffcf62d

SHA256
f598a4c1e614d32884bef80640438e737ee199c9c92eb014714681fcd744e243

SHA512
1edf26d8148fb36f840c89cc89ef1d26be730736e43a0630ba2ac9ca9b44aa4417306330f14587644fd9140e687f44b13b6e01e7aefb797b4855c5bfbc975392

Download Submit
memory/1464-54-0x0000000075381000-0x0000000075383000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing