cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f

Analysis

max time kernel
90s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
Size

204KB
MD5

d1da4871924d59fe6667f5c753eb91d6
SHA1

e9f4ce044b5c38c43e6a023b8ec93dda482046be
SHA256

cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f
SHA512

a7bf767177715880308a08318b55fbbcf51b37b507098a2d36c4d173234900399359db4a1877a803ce879282253a4cc61df8f54476aca7ad9ecb1d44efe39b85
SSDEEP

1536:s6KF7Mz2YP3hLOcsckFV72zwlLsJX0Cgf819pQOgICvZGIHaCp1uXnHATsg/csEn:t53lHkSwlLba9p92vIFHADH1+ML7ny

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1616	12611.exe

Deletes itself 1 IoCs

pid	Process
916	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1684	cmd.exe
1684	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c0031000000000021554f6e10204c6f63616c00380008000400efbe2155ef6b21554f6e2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000002155ef6b1100557365727300600008000400efbeee3a851a2155ef6b2a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c0031000000000021555676100041646d696e00380008000400efbe2155ef6b215556762a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000002155ef6b122041707044617461003c0008000400efbe2155ef6b2155ef6b2a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000835574bf102054656d700000360008000400efbe2155ef6b835574bf2a00000001020000000002000000000000000000000000000000540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c600310000000000835574bf10204346433443317e310000ae0008000400efbe835574bf835574bf2a000000515c00000000080000000000000000000000000000006300660063003400630031003100380036003600390032003600330034006500390062003800620030003400300035003100330062003700330031003600640037003100370063006300350032006200650061003000330037003000380065003800390039003700340030003000620064003900340062003600310033006600000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1324	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	26
PID 1524 wrote to memory of 1324	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	26
PID 1524 wrote to memory of 1324	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	26
PID 1524 wrote to memory of 1324	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	26
PID 1524 wrote to memory of 1684	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	27
PID 1524 wrote to memory of 1684	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	27
PID 1524 wrote to memory of 1684	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	27
PID 1524 wrote to memory of 1684	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	27
PID 1524 wrote to memory of 916	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	29
PID 1524 wrote to memory of 916	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	29
PID 1524 wrote to memory of 916	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	29
PID 1524 wrote to memory of 916	1524	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	29
PID 1684 wrote to memory of 1616	1684	cmd.exe	31
PID 1684 wrote to memory of 1616	1684	cmd.exe	31
PID 1684 wrote to memory of 1616	1684	cmd.exe	31
PID 1684 wrote to memory of 1616	1684	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
"C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f
  2⤵
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\12611.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\12611.exe
    C:\Users\Admin\AppData\Local\Temp\12611.exe
    3⤵
    - Executes dropped EXE
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFC4C1~1.EXE > nul
  2⤵
  - Deletes itself
  PID:916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f\yqh.JPG

Filesize
88KB

MD5
8de5d13881c86110bde78f486ce110e1

SHA1
6ef18101e902859cb481b7fe2229bdf329e4e704

SHA256
8783ac5941fd594a9f34907d3353d2bbcff2585fca4d09c39df40b7c1ab0b91e

SHA512
0dfa09a4c7179a2a32ae5c60820f043a3895e2a4a87c3fa2f627213ddadf7093781c8db702ddbfd127f3b5072abbf33a1b03f85bf847712378af5982410308f6

Download Submit
\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
memory/1176-65-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download
memory/1176-66-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/1324-59-0x0000000074011000-0x0000000074013000-memory.dmp

Filesize
8KB

Download
memory/1524-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download