cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670

Analysis

max time kernel
151s
max time network
125s
platform
windows7_x64
resource
win7v20210408
submitted
13-05-2021 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe
Size

352KB
MD5

dd21a3a58b5142e8a7de2ef73066f309
SHA1

f91f60a05764bc1739f26701c07a0486eaf94308
SHA256

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670
SHA512

9314f6ea0c08c910c05380234709d1722652725aa8178be1213753c73227d2dfc8c54aba3cd5f45890ed91665b8d4c0c733062e231047989ca8dc9e8f8b8ab80

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

fltMcont.exe~57D0.tmpmounKEYs.exe

pid process

1896 fltMcont.exe
1784 ~57D0.tmp
1224 mounKEYs.exe

Loads dropped DLL 3 IoCs

Processes:

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exefltMcont.exe

pid	process
784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe
784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe
1896	fltMcont.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\autodmin = "C:\\Users\\Admin\\AppData\\Roaming\\ocseperf\\fltMcont.exe"	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe

Drops file in System32 directory 1 IoCs

Processes:

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe

description ioc process

File created C:\Windows\SysWOW64\mounKEYs.exe cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File created	C:\Windows\SysWOW64\mounKEYs.exe	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

976 WINWORD.EXE

pid	process
976	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fltMcont.exeExplorer.EXEmounKEYs.exe

pid	process
1896	fltMcont.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE
1224	mounKEYs.exe
1268	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE

pid	process
1268	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

Explorer.EXE

description	pid	process
Token: SeShutdownPrivilege	1268	Explorer.EXE
Token: SeShutdownPrivilege	1268	Explorer.EXE
Token: SeShutdownPrivilege	1268	Explorer.EXE
Token: SeShutdownPrivilege	1268	Explorer.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

Explorer.EXE

pid process

1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
1268 Explorer.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

976 WINWORD.EXE
976 WINWORD.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE
1268	Explorer.EXE

pid	process
976	WINWORD.EXE
976	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exefltMcont.exe~57D0.tmpWINWORD.EXE

description	pid	process	target process
PID 784 wrote to memory of 1896	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	fltMcont.exe
PID 784 wrote to memory of 1896	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	fltMcont.exe
PID 784 wrote to memory of 1896	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	fltMcont.exe
PID 784 wrote to memory of 1896	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	fltMcont.exe
PID 1896 wrote to memory of 1784	1896	fltMcont.exe	~57D0.tmp
PID 1896 wrote to memory of 1784	1896	fltMcont.exe	~57D0.tmp
PID 1896 wrote to memory of 1784	1896	fltMcont.exe	~57D0.tmp
PID 1896 wrote to memory of 1784	1896	fltMcont.exe	~57D0.tmp
PID 1784 wrote to memory of 1268	1784	~57D0.tmp	Explorer.EXE
PID 784 wrote to memory of 976	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	WINWORD.EXE
PID 784 wrote to memory of 976	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	WINWORD.EXE
PID 784 wrote to memory of 976	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	WINWORD.EXE
PID 784 wrote to memory of 976	784	cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe	WINWORD.EXE
PID 976 wrote to memory of 1668	976	WINWORD.EXE	splwow64.exe
PID 976 wrote to memory of 1668	976	WINWORD.EXE	splwow64.exe
PID 976 wrote to memory of 1668	976	WINWORD.EXE	splwow64.exe
PID 976 wrote to memory of 1668	976	WINWORD.EXE	splwow64.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268

C:\Users\Admin\AppData\Local\Temp\cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe
"C:\Users\Admin\AppData\Local\Temp\cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe
"C:\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1896

C:\Users\Admin\AppData\Local\Temp\~57D0.tmp
"C:\Users\Admin\AppData\Local\Temp\~57D0.tmp"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~588C.tmp.docx"
3⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
4⤵
PID:1668

C:\Windows\SysWOW64\mounKEYs.exe
C:\Windows\SysWOW64\mounKEYs.exe -k
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1224

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~57D0.tmp
MD5
b1a17e8071c6b7c1bf724c6ad492e2b1

SHA1
970b325b150c4970af89f13203f6f45c20e84b24

SHA256
986fa351a7f552fba656a07500704658f9a71521d097f299b1dc7fa9d51f8925

SHA512
c0ff7c749109a4921da45b559b907cfca41d8534ee504b35f387c5020a868e8da2cb7f9805556ca52499142f096fd2407b6dd3b956286bab9a43b4a23368668b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~588C.tmp.docx
MD5
fee3944c7c5bf660e2ee3ebeee861ab1

SHA1
0808cf02731aa1560ae53591339fee7189d29823

SHA256
f0022e17f4b613886f6122fa2938c8522f639cb98a4816e0e4a913ab4805cf78

SHA512
6a6977649f20489230de512c2cfc6ab96bf6cb931b0500c8b0090f0c13f3db1853eea25df4159d33c53f4ec0b3f2ee83a152846afb24ed491a8d7ff75ff823e3

Download Submit
C:\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe
MD5
e01c17e6e1b1c097b3fd998b0d6802e6

SHA1
5fde3721fbfd68211f066a11cb3cb3cacc890bce

SHA256
7467281c12d4e195504f6c2bf62b5535f129fd26b8d620df23e167f8452c3288

SHA512
f9685cf62d0eeed53a6693e53752a47347aa2f7a086234e9917ef8c6a187f6b91115eb604166525d162360accd00b137d1f3cb3c30d050d6321f745f09e2efa1

Download Submit
C:\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe
MD5
e01c17e6e1b1c097b3fd998b0d6802e6

SHA1
5fde3721fbfd68211f066a11cb3cb3cacc890bce

SHA256
7467281c12d4e195504f6c2bf62b5535f129fd26b8d620df23e167f8452c3288

SHA512
f9685cf62d0eeed53a6693e53752a47347aa2f7a086234e9917ef8c6a187f6b91115eb604166525d162360accd00b137d1f3cb3c30d050d6321f745f09e2efa1

Download Submit
C:\Windows\SysWOW64\mounKEYs.exe
MD5
dd21a3a58b5142e8a7de2ef73066f309

SHA1
f91f60a05764bc1739f26701c07a0486eaf94308

SHA256
cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670

SHA512
9314f6ea0c08c910c05380234709d1722652725aa8178be1213753c73227d2dfc8c54aba3cd5f45890ed91665b8d4c0c733062e231047989ca8dc9e8f8b8ab80

Download Submit
C:\Windows\SysWOW64\mounKEYs.exe
MD5
dd21a3a58b5142e8a7de2ef73066f309

SHA1
f91f60a05764bc1739f26701c07a0486eaf94308

SHA256
cf2232272e2edd669ebb849270110235f87785fcd9cdf72858bccd3f45ebc670

SHA512
9314f6ea0c08c910c05380234709d1722652725aa8178be1213753c73227d2dfc8c54aba3cd5f45890ed91665b8d4c0c733062e231047989ca8dc9e8f8b8ab80

Download Submit
\Users\Admin\AppData\Local\Temp\~57D0.tmp
MD5
b1a17e8071c6b7c1bf724c6ad492e2b1

SHA1
970b325b150c4970af89f13203f6f45c20e84b24

SHA256
986fa351a7f552fba656a07500704658f9a71521d097f299b1dc7fa9d51f8925

SHA512
c0ff7c749109a4921da45b559b907cfca41d8534ee504b35f387c5020a868e8da2cb7f9805556ca52499142f096fd2407b6dd3b956286bab9a43b4a23368668b

Download Submit
\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe
MD5
e01c17e6e1b1c097b3fd998b0d6802e6

SHA1
5fde3721fbfd68211f066a11cb3cb3cacc890bce

SHA256
7467281c12d4e195504f6c2bf62b5535f129fd26b8d620df23e167f8452c3288

SHA512
f9685cf62d0eeed53a6693e53752a47347aa2f7a086234e9917ef8c6a187f6b91115eb604166525d162360accd00b137d1f3cb3c30d050d6321f745f09e2efa1

Download Submit
\Users\Admin\AppData\Roaming\ocseperf\fltMcont.exe
MD5
e01c17e6e1b1c097b3fd998b0d6802e6

SHA1
5fde3721fbfd68211f066a11cb3cb3cacc890bce

SHA256
7467281c12d4e195504f6c2bf62b5535f129fd26b8d620df23e167f8452c3288

SHA512
f9685cf62d0eeed53a6693e53752a47347aa2f7a086234e9917ef8c6a187f6b91115eb604166525d162360accd00b137d1f3cb3c30d050d6321f745f09e2efa1

Download Submit
memory/784-61-0x0000000000120000-0x000000000018C000-memory.dmp

Filesize
432KB

Download
memory/784-60-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/976-77-0x0000000000000000-mapping.dmp

Download
memory/976-78-0x0000000072391000-0x0000000072394000-memory.dmp

Filesize
12KB

Download
memory/976-79-0x000000006FE11000-0x000000006FE13000-memory.dmp

Filesize
8KB

Download
memory/976-80-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/976-84-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1224-76-0x00000000000E0000-0x000000000014C000-memory.dmp

Filesize
432KB

Download
memory/1268-72-0x0000000003D60000-0x0000000003DA3000-memory.dmp

Filesize
268KB

Download
memory/1668-82-0x0000000000000000-mapping.dmp

Download
memory/1668-83-0x000007FEFB891000-0x000007FEFB893000-memory.dmp

Filesize
8KB

Download
memory/1784-69-0x0000000000000000-mapping.dmp

Download
memory/1896-71-0x0000000000260000-0x00000000002A0000-memory.dmp

Filesize
256KB

Download
memory/1896-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads