Overview

overview

7

Static

static

cdc6e717cb...1f.exe

windows7-x64

7

cdc6e717cb...1f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 15:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    cdc6e717cb9f46e729594feb91200b3cd90a53e91c09790229c16b8cd06b3a1f.exe

  • Size

    69KB

  • MD5

    0d19f273b161ddac5e37002296625540

  • SHA1

    d413b01f7f9c280286e28a84543476a7941119b9

  • SHA256

    cdc6e717cb9f46e729594feb91200b3cd90a53e91c09790229c16b8cd06b3a1f

  • SHA512

    be414568bdb088911434a36a5a3980e68a579c6cda7cdf9f91a4a408a349a87b1645bbc501788e464adc2bbca3dd41b4903a8403df811d2829efac04a761a68e

  • SSDEEP

    1536:dOplpgYQmvKfP9dqzMLon9/zFxhbISz5VffMOZS9da2m:dOp/gYlvK6zMLo9/zF9zPfBSjS

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdc6e717cb9f46e729594feb91200b3cd90a53e91c09790229c16b8cd06b3a1f.exe
    "C:\Users\Admin\AppData\Local\Temp\cdc6e717cb9f46e729594feb91200b3cd90a53e91c09790229c16b8cd06b3a1f.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\FONTCACHE.DAT",#1
      2⤵
      • Loads dropped DLL
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer Protected Mode Banner
      • Modifies Internet Explorer settings
      PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      /s /c "for /L %i in (1,1,100) do (del /F "C:\Users\Admin\AppData\Local\Temp\CDC6E7~1.EXE" & ping localhost -n 2 & if not exist "C:\Users\Admin\AppData\Local\Temp\CDC6E7~1.EXE" Exit 1)"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\SysWOW64\PING.EXE
        ping localhost -n 2
        3⤵
        • Runs ping.exe
        PID:2844
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:1668
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1132 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3764
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3804
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies registry class
        PID:1952
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4808
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies Internet Explorer settings
        PID:4492
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3768
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3768 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2804
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:4008
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies registry class
        PID:4000
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
        • Modifies Internet Explorer settings
        PID:1336
      • C:\Windows\system32\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
        2⤵
          PID:3776
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3980 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2240
        • C:\Windows\system32\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
          2⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:4504
        • C:\Windows\system32\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
          2⤵
          • Modifies registry class
          PID:1120
        • C:\Windows\system32\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
          2⤵
          • Modifies Internet Explorer settings
          PID:2412
        • C:\Windows\system32\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
          2⤵
            PID:5000
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3368
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3368 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1244
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:1816
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies registry class
            PID:3428
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies Internet Explorer settings
            PID:4304
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies Internet Explorer settings
            PID:2088
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4960 CREDAT:17410 /prefetch:2
            2⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:4944
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            PID:3120
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8388616 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
            • Modifies registry class
            PID:3788
          • C:\Windows\system32\rundll32.exe
            C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
            2⤵
              PID:3084
            • C:\Windows\system32\rundll32.exe
              C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:276824072 WinX:0 WinY:0 IEFrame:0000000000000000
              2⤵
              • Modifies Internet Explorer settings
              PID:2104
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:4472
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4472 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1300

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\FONTCACHE.DAT
                  Filesize

                  54KB

                  MD5

                  cdfb4cda9144d01fb26b5449f9d189ff

                  SHA1

                  315863c696603ac442b2600e9ecc1819b7ed1b54

                  SHA256

                  f5785842682bc49a69b2cbc3fded56b8b4a73c8fd93e35860ecd1b9a88b9d3d8

                  SHA512

                  41d6ec0c66c51873cdba8bcd0e35f6237b8dddab843a9d7ae4e2639282596c1f0a18a932bc0a8ab3f60972e4ef1636d590b4e25cb213e66bb20c396192f7d4e0

                  Download Submit

                • C:\Users\Admin\AppData\Local\FONTCACHE.DAT
                  Filesize

                  54KB

                  MD5

                  cdfb4cda9144d01fb26b5449f9d189ff

                  SHA1

                  315863c696603ac442b2600e9ecc1819b7ed1b54

                  SHA256

                  f5785842682bc49a69b2cbc3fded56b8b4a73c8fd93e35860ecd1b9a88b9d3d8

                  SHA512

                  41d6ec0c66c51873cdba8bcd0e35f6237b8dddab843a9d7ae4e2639282596c1f0a18a932bc0a8ab3f60972e4ef1636d590b4e25cb213e66bb20c396192f7d4e0

                  Download Submit

                • memory/2224-133-0x0000000000440000-0x0000000000450000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2224-132-0x0000000000440000-0x0000000000450000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/2680-139-0x0000000010010000-0x000000001001B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/2680-140-0x0000000010010000-0x000000001001B000-memory.dmp

                  Filesize

                  44KB

                  Download

                • memory/2680-141-0x0000000010010000-0x000000001001B000-memory.dmp

                  Filesize

                  44KB

                  Download