cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e

General

Target

cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe
Size

637KB
MD5

eb8e1312e74b4c133e5bb4ffabbf1e58
SHA1

23acc1c64a29bd81a7c7270c60b72c7a8dd1ad1d
SHA256

cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e
SHA512

e002c41be05da011c75e17d88867ec163a7f18d08637c734dad17e1fc3d5f996ea98a2d87266ed63480d1389015a71f6d477285e8cda4d3c9882f6aca434ba5d
SSDEEP

12288:8ecC/877yw/lnqshM7jpajFpF3Z4mxxODqVTVOCkQO0:3wnG7jpajFpQmXdVTzkb0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5084	winlt.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F	winlt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	winlt.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe
File created	C:\Windows\winlt.exe	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe
File opened for modification	C:\Windows\winlt.exe	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	winlt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	winlt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	winlt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	winlt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	winlt.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe
Token: SeDebugPrivilege	5084	winlt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5084	winlt.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 2744	5084	winlt.exe	77
PID 5084 wrote to memory of 2744	5084	winlt.exe	77
PID 2732 wrote to memory of 4944	2732	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe	78
PID 2732 wrote to memory of 4944	2732	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe	78
PID 2732 wrote to memory of 4944	2732	cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe	78

C:\Users\Admin\AppData\Local\Temp\cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe
"C:\Users\Admin\AppData\Local\Temp\cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:4944

C:\Windows\winlt.exe
C:\Windows\winlt.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\uninstal.bat

Filesize
254B

MD5
6b1d3bcd9858cbbb243caf75ea30e63d

SHA1
e6a3e45756d2ebd575a030e6993a5d40e1120d4b

SHA256
24762cdc45de69c2e3c2c173d6e342aa2b2fd5bf96602405df146bac4b08b5ab

SHA512
4a719cfe3cc7d21e1e453414f21abca204bddd89ef9e5c9352d6423049fe51d6347ff3fb331f918b1ad6d79dcf92e72caea7fb6db487dc328c8c04f932dd8b44

Download Submit
C:\Windows\winlt.exe

Filesize
637KB

MD5
eb8e1312e74b4c133e5bb4ffabbf1e58

SHA1
23acc1c64a29bd81a7c7270c60b72c7a8dd1ad1d

SHA256
cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e

SHA512
e002c41be05da011c75e17d88867ec163a7f18d08637c734dad17e1fc3d5f996ea98a2d87266ed63480d1389015a71f6d477285e8cda4d3c9882f6aca434ba5d

Download Submit
C:\Windows\winlt.exe

Filesize
637KB

MD5
eb8e1312e74b4c133e5bb4ffabbf1e58

SHA1
23acc1c64a29bd81a7c7270c60b72c7a8dd1ad1d

SHA256
cfd24ac0d374fef69ee5148befe796c84d533b8b04ec965c731106aaf9ad937e

SHA512
e002c41be05da011c75e17d88867ec163a7f18d08637c734dad17e1fc3d5f996ea98a2d87266ed63480d1389015a71f6d477285e8cda4d3c9882f6aca434ba5d

Download Submit
memory/2732-141-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2732-134-0x00000000034C0000-0x00000000035C0000-memory.dmp

Filesize
1024KB

Download
memory/2732-132-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/2732-142-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/2732-133-0x00000000022E0000-0x0000000002334000-memory.dmp

Filesize
336KB

Download
memory/4944-140-0x0000000000000000-mapping.dmp

Download
memory/5084-137-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/5084-138-0x0000000000EA0000-0x0000000000EF4000-memory.dmp

Filesize
336KB

Download
memory/5084-139-0x0000000002030000-0x0000000002130000-memory.dmp

Filesize
1024KB

Download
memory/5084-144-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/5084-145-0x0000000000EA0000-0x0000000000EF4000-memory.dmp

Filesize
336KB

Download
memory/5084-146-0x0000000002030000-0x0000000002130000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing