c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1

General

Target

c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe
Size

332KB
MD5

3cfb06ec70201cbdb3012291044b88c6
SHA1

3b6db0c3b49ecc22e78e7ead5e4d1f9c6d51b6a7
SHA256

c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1
SHA512

d7b33f554bc465b5ed13f2c4640e6098d5c680cc89e5185cb9d00a13a0759c67856e94360f70273d4d7674536145cab62054fc4fae3acebda1b12251a76bd3b2

Score

5^/10

google phishing

Malware Config

Signatures

Detected potential entity reuse from brand google.
phishing google
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

364 632 WerFault.exe c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe

pid	pid_target	process	target process
364	632	WerFault.exe	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000bee70dec96c49f3e065906089522714740a2f60d0b436a74e285aa3d42335041000000000e8000000002000020000000cce3bd66f2e0d5bd7bd23d0d883f919a1cb2d8e8bd85f692dc20f4a8f2cd8c309000000061d47e9e7e4420c62466a28c85a6baf11f641531d448f59df869bb1beb672d1f82d731e58a9a9dab6f88e14b8adf2c15fd5dd8150d397bba0bcb63c258229f3afe3dd82443d68317530e59a38d57330c284a20727c93572342d9e7ed15cdcb22aebd63643b8d8964b3f8c301f9477f6e5ff9967afdbeeb6734557fd23f388aaff868fa66a62c851c51c563db5f331c0340000000ebeb913ff5ccabdf864259183ba75fb26dffa12595dc96df63f4492f2a79f9871fd530a709803661df26d2293ebcb3d5fb02149b2341eba9da7119a73ed409c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70cf3173ce54d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98F04111-C0C1-11EC-8871-E6BBD082ACA2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b0000000002000000000010660000000100002000000084ddcce13dafebbeca364862d5d893422b7695f6a8cc573ef4a6464abde28ade000000000e8000000002000020000000956ecc307b33d59a3f5bcb1974f61adb600d4f47faef32aebff8df4f5982a58a200000000df465364763a9bb77bcc867f9346ebaa515340d7399b0275a20bab6c8d3fd424000000087950fa4a52e9c18407d42db412728057e090a58537686f680294fa459bbb6d73604a65138588427cefac86574fb4912d81499082ea300d4bca6f4bc01eeaefa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "357234801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1956 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1956 iexplore.exe
1956 iexplore.exe
1696 IEXPLORE.EXE
1696 IEXPLORE.EXE
1696 IEXPLORE.EXE
1696 IEXPLORE.EXE

pid	process
1956	iexplore.exe

pid	process
1956	iexplore.exe
1956	iexplore.exe
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE
1696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exeiexplore.exe

description	pid	process	target process
PID 632 wrote to memory of 1956	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	iexplore.exe
PID 632 wrote to memory of 1956	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	iexplore.exe
PID 632 wrote to memory of 1956	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	iexplore.exe
PID 632 wrote to memory of 1956	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	iexplore.exe
PID 1956 wrote to memory of 1696	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1696	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1696	1956	iexplore.exe	IEXPLORE.EXE
PID 1956 wrote to memory of 1696	1956	iexplore.exe	IEXPLORE.EXE
PID 632 wrote to memory of 364	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	WerFault.exe
PID 632 wrote to memory of 364	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	WerFault.exe
PID 632 wrote to memory of 364	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	WerFault.exe
PID 632 wrote to memory of 364	632	c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe
"C:\Users\Admin\AppData\Local\Temp\c8cdae3ef562a690983698c801fdd4173ad8d79fdd7a01ec30de07e18ec706e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com.br/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 700
2⤵
- Program crash
PID:364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
790bbb5bf9e9688c5585942268b27332

SHA1
e2c27046cdbe137a133a59ff6d3954f2df153ae8

SHA256
9245568dda8143c4bb1e20ac384b6d2f7dc2e3b649f527468265272d7e450c20

SHA512
96dd601d24c179c11caf545f9041eb1f3f9d75f3f8e64ff1eb860bc9dd8fc10ca50ff7ad91a60ce351d73c168e7c5ce080888ee38b1a27769e23a3420578f8ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ezmz917\imagestore.dat
Filesize
9KB

MD5
14342c202ed2fa31e8284ea764576fc0

SHA1
169708e0ce76198444f39b70e389c4faf3b8ecca

SHA256
52682a0d15a597c15d271bc95b9f66cfbe9c0dc370c344c5179729e9b4ee534e

SHA512
803dfb8b0b2589b7539ee1e348d8ec35c870781aedbe30a324256f4f198d8fb713b96dff2fa3e9dc5f63f85eeb74e1065d76acf4dec94d737a0b519359ee5037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0O8D7KIM\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FZ4TTWDF.txt
Filesize
602B

MD5
057a8bf1abcfaca73a4a27d8affa277d

SHA1
c8b14af7b1f398be1151304f6400cf09d85cc4f4

SHA256
7d15d821c93477eda47d4f63cc0d897720e73bf7893611dc9fc1d80ef3acf488

SHA512
c9cbba7f28acba461b135132ab345a4c4d3ac8ebf8da7eb197dea75095c679e75a7839adcd2bb99a68cb0d7a7c9e114c4803301bf27cdf55eb4474a444ee4aec

Download Submit
memory/364-65-0x0000000000000000-mapping.dmp

Download
memory/632-58-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-60-0x0000000075391000-0x0000000075393000-memory.dmp

Filesize
8KB

Download
memory/632-62-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-61-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-63-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-64-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/632-59-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-54-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-57-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-56-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download
memory/632-55-0x000000007EF50000-0x000000007EFAC000-memory.dmp

Filesize
368KB

Download

Analysis

Sharing