cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c

General

Target

cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe
Size

461KB
MD5

89b9891c998ce2eb71cb507ce4121c5c
SHA1

954c7da615a722275c98b065c7911d7a264f6d08
SHA256

cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c
SHA512

50957b7e6062c58392a0a7364a87de545d3f717fa5742288506361f002af66a5a02f01d7a682e17fbbda09ac5c5156b214c49c2a27295ef0369bad5c22cc0af0
SSDEEP

12288:pLHULTl4x2z6DmGWT6U3ce/lR9YtDddT:pTr2ODUhMJB

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c974800000000020000000000106600000001000020000000f5a669197a5dbaa0416edee82002fbcfcf1c245a371555aad26c9e121e66b16f000000000e80000000020000200000000b8b463ad251f16d994ae524d632113b50514c6ec5419d4b2cf66d9f4210332520000000a8103095d8c0e636f963754fa36d719ccc58bc77d8d48c0ff3273757d61d1b87400000007e2f12b6c745f9814d8b6543f79b76a22b5d7884dad1151cbdcd68ea97362469a8ddb290ccabe49055ac0251ff1e6a3df6054c1c3dcfc420878605f2f8740f53	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09228f0780cd901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00adbeb780cd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377429107"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e6851ef31fd3cf49b332bbb4721c97480000000002000000000010660000000100002000000016340c344f7f0e828a8e0e91f41f9760b2d303ec69dc6961b8e8d21fa13145b8000000000e80000000020000200000003cfaf42446f99092a6afac82655317c50c44025139b3e924706e54965a3f700e20000000f7bbd0223f099d2729e8e9d899d2d7b450ceed73aa839a51ae144585bd49733d400000003dec1673b639b359410b8a46ee316b83a2675fdf34531ff7d80353b8cdbbc02645a7a8eda858f4c8781fa0f3c7c2b0a8fbdd3ec08a0375a9d4e77fa6be165a02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0A9C3353-786C-11ED-919F-DE8F97E08347} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
212	iexplore.exe
212	iexplore.exe
3728	IEXPLORE.EXE
3728	IEXPLORE.EXE
3728	IEXPLORE.EXE
3728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 212	4032	cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe	80
PID 4032 wrote to memory of 212	4032	cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe	80
PID 212 wrote to memory of 3728	212	iexplore.exe	81
PID 212 wrote to memory of 3728	212	iexplore.exe	81
PID 212 wrote to memory of 3728	212	iexplore.exe	81

C:\Users\Admin\AppData\Local\Temp\cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe
"C:\Users\Admin\AppData\Local\Temp\cd80c0b827f98dccd1aa9bf5eb866a6b04047313eaafa54bc142af503095fd4c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://cbl.toolbar4free.com/cgi-bin/s.exe?type=1&h_t=1&c_d=1&id=Rk9OVEdPRE==
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:212 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:3728