cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f

Analysis

max time kernel
156s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
Size

204KB
MD5

d1da4871924d59fe6667f5c753eb91d6
SHA1

e9f4ce044b5c38c43e6a023b8ec93dda482046be
SHA256

cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f
SHA512

a7bf767177715880308a08318b55fbbcf51b37b507098a2d36c4d173234900399359db4a1877a803ce879282253a4cc61df8f54476aca7ad9ecb1d44efe39b85
SSDEEP

1536:s6KF7Mz2YP3hLOcsckFV72zwlLsJX0Cgf819pQOgICvZGIHaCp1uXnHATsg/csEn:t53lHkSwlLba9p92vIFHADH1+ML7ny

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4504	12611.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000006b557d6c1100557365727300640009000400efbe874f7748845522082e000000c70500000000010000000000000000003a0000000000d967240055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000006b55b26e10004c6f63616c003c0009000400efbe6b557d6c845522082e0000009ce10100000001000000000000000000000000000000e996ac004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e0031000000000084552b08100054656d7000003a0009000400efbe6b557d6c84552b082e0000009de10100000001000000000000000000000000000000c0ded400540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000006b557d6c12004170704461746100400009000400efbe6b557d6c845522082e00000089e1010000000100000000000000000000000000000020f30e004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = ca0031000000000084552a0810004346433443317e310000b20009000400efbe84552a0884552a082e000000132e02000000070000000000000000000000000000005f70a0006300660063003400630031003100380036003600390032003600330034006500390062003800620030003400300035003100330062003700330031003600640037003100370063006300350032006200650061003000330037003000380065003800390039003700340030003000620064003900340062003600310033006600000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000006b552674100041646d696e003c0009000400efbe6b557d6c845522082e0000007ee10100000001000000000000000000000000000000e1ad2b01410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3164	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3164	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
3164	explorer.exe
3164	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3900	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	84
PID 3328 wrote to memory of 3900	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	84
PID 3328 wrote to memory of 3900	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	84
PID 3328 wrote to memory of 3608	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	85
PID 3328 wrote to memory of 3608	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	85
PID 3328 wrote to memory of 3608	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	85
PID 3328 wrote to memory of 4308	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	86
PID 3328 wrote to memory of 4308	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	86
PID 3328 wrote to memory of 4308	3328	cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe	86
PID 3608 wrote to memory of 4504	3608	cmd.exe	89
PID 3608 wrote to memory of 4504	3608	cmd.exe	89
PID 3608 wrote to memory of 4504	3608	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe
"C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f
  2⤵
  PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\12611.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Users\Admin\AppData\Local\Temp\12611.exe
    C:\Users\Admin\AppData\Local\Temp\12611.exe
    3⤵
    - Executes dropped EXE
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFC4C1~1.EXE > nul
  2⤵
  PID:4308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\12611.exe

Filesize
14KB

MD5
90a241b997af67de416c736f04862248

SHA1
e42e4a9612f50dd4e29d5cb9faf6b0a56691f7cb

SHA256
fccfd9a13f2710e9677fe43816607425e80feb28e3573c55c27906fc7a68eefe

SHA512
e6ec07cbb809bfcbb3a4b98bc58613d42e8b667f15a2a2cbabf1badf31a40e4fae2c81b2cf7278bc49e7bb16d6b7f05e8373be0b3c0aa6de748364bbacc094d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cfc4c1186692634e9b8b040513b7316d717cc52bea03708e8997400bd94b613f\yqh.JPG

Filesize
88KB

MD5
8de5d13881c86110bde78f486ce110e1

SHA1
6ef18101e902859cb481b7fe2229bdf329e4e704

SHA256
8783ac5941fd594a9f34907d3353d2bbcff2585fca4d09c39df40b7c1ab0b91e

SHA512
0dfa09a4c7179a2a32ae5c60820f043a3895e2a4a87c3fa2f627213ddadf7093781c8db702ddbfd127f3b5072abbf33a1b03f85bf847712378af5982410308f6

Download Submit