4251030bb634a6d96f213e1f9859554ebbf8a07270060441178d2f0ac18a3751

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 10:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdcfd218367be02e23fee30a801a7835.exe
Size

28KB
MD5

cdcfd218367be02e23fee30a801a7835
SHA1

78de7f2ff7aecc4d4d91d4cdcd155833bf7494c7
SHA256

4251030bb634a6d96f213e1f9859554ebbf8a07270060441178d2f0ac18a3751
SHA512

c8c0908c4c745c7c5e7316ec5338016e2b21d1d41a6f7d8e026061dffd8768979d8070e7d00c8ca65a08a6ec21402826f19e6ebc15407e093c07c02d32f75e66
SSDEEP

384:ckVc01gfhLgz4qDav/nAVrXNjCYxGaJ1yPdcV:B1gfhLgz4qDav/nAVrXNjCYkaed

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\d3pr.dll	cdcfd218367be02e23fee30a801a7835.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://lookfor.cc/sp.php?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Bar = "http://lookfor.cc/sp.php?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Use Search Asst = "no"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Use Search Asst = "no"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://lookfor.cc?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://lookfor.cc/sp.php?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Search Bar = "http://lookfor.cc/sp.php?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://lookfor.cc/sp.php?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://lookfor.cc?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://lookfor.cc?pin=10213"	cdcfd218367be02e23fee30a801a7835.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Safety Warning Level = "SucceedSilent"	cdcfd218367be02e23fee30a801a7835.exe
Key created	\REGISTRY\USER\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MinLevel = "Code Download"	cdcfd218367be02e23fee30a801a7835.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Security_RunActiveXControls = "16777216"	cdcfd218367be02e23fee30a801a7835.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Security_RunScripts = "16777216"	cdcfd218367be02e23fee30a801a7835.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Trust Warning Level = "No Security"	cdcfd218367be02e23fee30a801a7835.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1244	cdcfd218367be02e23fee30a801a7835.exe
1244	cdcfd218367be02e23fee30a801a7835.exe

C:\Users\Admin\AppData\Local\Temp\cdcfd218367be02e23fee30a801a7835.exe
"C:\Users\Admin\AppData\Local\Temp\cdcfd218367be02e23fee30a801a7835.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads