9a790275a349661ae3c6cd5dd50476cbb84febd492673f3724ccb152c5db45d1

General

Target

Office2020.exe
Size

18.7MB
MD5

90b700738a1ee565ef4143181e7f2ffe
SHA1

74ec2b894b1f9e91f234b085644a780c607dcbbb
SHA256

9a790275a349661ae3c6cd5dd50476cbb84febd492673f3724ccb152c5db45d1
SHA512

97200be701ab9f56d8bd697c6a4a59b3bb30ceb3e2ed42425e1ccc173ec810cad95494d1622a1ba2e307f93d6895ea1ccfb5a524b7ffd2ec63b04e148c361d94

Score

7^/10

spyware

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Office2020.exe

description pid process

Token: 35 3640 Office2020.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Office2020.exe

pid process

3640 Office2020.exe
3640 Office2020.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3600 OpenWith.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings OpenWith.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

2968 NOTEPAD.EXE

description	pid	process
Token: 35	3640	Office2020.exe

pid	process
3600	OpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings	OpenWith.exe

pid	process
2968	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Office2020.exe

description	pid	process	target process
PID 3944 wrote to memory of 3640	3944	Office2020.exe	Office2020.exe
PID 3944 wrote to memory of 3640	3944	Office2020.exe	Office2020.exe

Loads dropped DLL 22 IoCs

Processes:

Office2020.exe

pid	process
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe
3640	Office2020.exe

C:\Users\Admin\AppData\Local\Temp\Office2020.exe
"C:\Users\Admin\AppData\Local\Temp\Office2020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944

C:\Users\Admin\AppData\Local\Temp\Office2020.exe
"C:\Users\Admin\AppData\Local\Temp\Office2020.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
PID:3640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
- Modifies registry class
PID:3600

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EMAIL_ME.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI39442\Java.exe.manifest

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\PIL\_imaging.cp36-win_amd64.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\PIL\_imagingft.cp36-win_amd64.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\VCRUNTIME140.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_bz2.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_cffi_backend.cp36-win_amd64.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ctypes.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_decimal.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_hashlib.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_lzma.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_socket.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_ssl.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\_tkinter.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\base_library.zip

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\certifi\cacert.pem

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\nacl\_sodium.cp36-win_amd64.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\pyexpat.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\python36.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\pythoncom36.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\pywintypes36.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\select.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\tcl86t.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\tcl\encoding\cp1252.enc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\tk86t.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\unicodedata.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI39442\win32api.pyd

Download Submit
C:\Users\Admin\Desktop\EMAIL_ME.txt

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\PIL\_imaging.cp36-win_amd64.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\PIL\_imagingft.cp36-win_amd64.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\VCRUNTIME140.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_bz2.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_cffi_backend.cp36-win_amd64.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_ctypes.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_decimal.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_hashlib.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_lzma.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_socket.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_ssl.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\_tkinter.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\nacl\_sodium.cp36-win_amd64.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\pyexpat.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\python36.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\pythoncom36.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\pywintypes36.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\select.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\tcl86t.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\tk86t.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\unicodedata.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI39442\win32api.pyd

Download Submit
memory/3640-59-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-109-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-51-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-52-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-53-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-54-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-55-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-57-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-58-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-0-0x0000000000000000-mapping.dmp

Download
memory/3640-72-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-75-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-93-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-50-0x000002148ACD0000-0x000002148ACD1000-memory.dmp

Filesize
4KB

Download
memory/3640-111-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-121-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-129-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-144-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-150-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-153-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-154-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-237-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-238-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-239-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-240-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-241-0x000002148ACB0000-0x000002148ACB1000-memory.dmp

Filesize
4KB

Download
memory/3640-49-0x000002148A4D0000-0x000002148A4D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing