Analysis
- max time kernel
25s - max time network
135s - platform
windows10_x64 - resource
win10v20210408 - submitted
15/05/2021, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
officeverifysign[1].exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
officeverifysign[1].exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target officeverifysign[1].exe
- Size 1.5MB
- Sample210515-2lmswccpae
- SHA256 3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac
- MD5 65d160b89f6f563bca60461adc71f979
- SHA1 a61e74e58d3c5eee4a127dd108cff9dbbcfc8ef1
- SHA512 d7dc4a53fda4880ee689e1e39129af4100f9a877a4ebb8f9915554c7739a956011338bcd7a43726261f0041f1a5976ffc044475e7ceb9b08073cd037bc59a88d
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2544 officeverifysign[1].exe - Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: officeverifysign[1].exe File opened (read-only) \??\h: officeverifysign[1].exe File opened (read-only) \??\J: officeverifysign[1].exe File opened (read-only) \??\l: officeverifysign[1].exe File opened (read-only) \??\N: officeverifysign[1].exe File opened (read-only) \??\z: officeverifysign[1].exe File opened (read-only) \??\Z: officeverifysign[1].exe File opened (read-only) \??\A: officeverifysign[1].exe File opened (read-only) \??\B: officeverifysign[1].exe File opened (read-only) \??\K: officeverifysign[1].exe File opened (read-only) \??\o: officeverifysign[1].exe File opened (read-only) \??\T: officeverifysign[1].exe File opened (read-only) \??\b: officeverifysign[1].exe File opened (read-only) \??\g: officeverifysign[1].exe File opened (read-only) \??\i: officeverifysign[1].exe File opened (read-only) \??\L: officeverifysign[1].exe File opened (read-only) \??\Q: officeverifysign[1].exe File opened (read-only) \??\S: officeverifysign[1].exe File opened (read-only) \??\t: officeverifysign[1].exe File opened (read-only) \??\X: officeverifysign[1].exe File opened (read-only) \??\D: officeverifysign[1].exe File opened (read-only) \??\G: officeverifysign[1].exe File opened (read-only) \??\n: officeverifysign[1].exe File opened (read-only) \??\v: officeverifysign[1].exe File opened (read-only) \??\a: officeverifysign[1].exe File opened (read-only) \??\F: officeverifysign[1].exe File opened (read-only) \??\M: officeverifysign[1].exe File opened (read-only) \??\O: officeverifysign[1].exe File opened (read-only) \??\P: officeverifysign[1].exe File opened (read-only) \??\q: officeverifysign[1].exe File opened (read-only) \??\e: officeverifysign[1].exe File opened (read-only) \??\k: officeverifysign[1].exe File opened (read-only) \??\R: officeverifysign[1].exe File opened (read-only) \??\u: officeverifysign[1].exe File opened (read-only) \??\V: officeverifysign[1].exe File opened (read-only) \??\y: officeverifysign[1].exe File opened (read-only) \??\f: officeverifysign[1].exe File opened (read-only) \??\r: officeverifysign[1].exe File opened (read-only) \??\s: officeverifysign[1].exe File opened (read-only) \??\U: officeverifysign[1].exe File opened (read-only) \??\x: officeverifysign[1].exe File opened (read-only) \??\Y: officeverifysign[1].exe File opened (read-only) \??\H: officeverifysign[1].exe File opened (read-only) \??\I: officeverifysign[1].exe File opened (read-only) \??\j: officeverifysign[1].exe File opened (read-only) \??\m: officeverifysign[1].exe File opened (read-only) \??\p: officeverifysign[1].exe File opened (read-only) \??\w: officeverifysign[1].exe File opened (read-only) \??\W: officeverifysign[1].exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2544 set thread context of 3420 2544 officeverifysign[1].exe 77 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2544 officeverifysign[1].exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2544 wrote to memory of 3420 2544 officeverifysign[1].exe 77 PID 2544 wrote to memory of 3420 2544 officeverifysign[1].exe 77 PID 2544 wrote to memory of 3420 2544 officeverifysign[1].exe 77 PID 2544 wrote to memory of 3420 2544 officeverifysign[1].exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\officeverifysign[1].exe"C:\Users\Admin\AppData\Local\Temp\officeverifysign[1].exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\officeverifysign[1].exe"C:\Users\Admin\AppData\Local\Temp\officeverifysign[1].exe"2⤵
- Enumerates connected drives
PID:3420
-