Analysis
-
max time kernel
328s -
max time network
389s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-06-2021 20:53
Static task
static1
Behavioral task
behavioral1
Sample
OfficeVerifySign.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
OfficeVerifySign.exe
-
Size
1.5MB
-
MD5
65d160b89f6f563bca60461adc71f979
-
SHA1
a61e74e58d3c5eee4a127dd108cff9dbbcfc8ef1
-
SHA256
3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac
-
SHA512
d7dc4a53fda4880ee689e1e39129af4100f9a877a4ebb8f9915554c7739a956011338bcd7a43726261f0041f1a5976ffc044475e7ceb9b08073cd037bc59a88d
Malware Config
Extracted
Family
rustybuer
C2
https://documentssign-api.com/
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3716 OfficeVerifySign.exe -
Enumerates connected drives 3 TTPs 49 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: OfficeVerifySign.exe File opened (read-only) \??\q: OfficeVerifySign.exe File opened (read-only) \??\r: OfficeVerifySign.exe File opened (read-only) \??\s: OfficeVerifySign.exe File opened (read-only) \??\L: OfficeVerifySign.exe File opened (read-only) \??\n: OfficeVerifySign.exe File opened (read-only) \??\T: OfficeVerifySign.exe File opened (read-only) \??\x: OfficeVerifySign.exe File opened (read-only) \??\Y: OfficeVerifySign.exe File opened (read-only) \??\B: OfficeVerifySign.exe File opened (read-only) \??\I: OfficeVerifySign.exe File opened (read-only) \??\o: OfficeVerifySign.exe File opened (read-only) \??\t: OfficeVerifySign.exe File opened (read-only) \??\X: OfficeVerifySign.exe File opened (read-only) \??\S: OfficeVerifySign.exe File opened (read-only) \??\V: OfficeVerifySign.exe File opened (read-only) \??\E: OfficeVerifySign.exe File opened (read-only) \??\f: OfficeVerifySign.exe File opened (read-only) \??\i: OfficeVerifySign.exe File opened (read-only) \??\J: OfficeVerifySign.exe File opened (read-only) \??\k: OfficeVerifySign.exe File opened (read-only) \??\W: OfficeVerifySign.exe File opened (read-only) \??\A: OfficeVerifySign.exe File opened (read-only) \??\G: OfficeVerifySign.exe File opened (read-only) \??\h: OfficeVerifySign.exe File opened (read-only) \??\K: OfficeVerifySign.exe File opened (read-only) \??\Q: OfficeVerifySign.exe File opened (read-only) \??\e: OfficeVerifySign.exe File opened (read-only) \??\m: OfficeVerifySign.exe File opened (read-only) \??\M: OfficeVerifySign.exe File opened (read-only) \??\N: OfficeVerifySign.exe File opened (read-only) \??\p: OfficeVerifySign.exe File opened (read-only) \??\w: OfficeVerifySign.exe File opened (read-only) \??\y: OfficeVerifySign.exe File opened (read-only) \??\a: OfficeVerifySign.exe File opened (read-only) \??\b: OfficeVerifySign.exe File opened (read-only) \??\F: OfficeVerifySign.exe File opened (read-only) \??\P: OfficeVerifySign.exe File opened (read-only) \??\v: OfficeVerifySign.exe File opened (read-only) \??\R: OfficeVerifySign.exe File opened (read-only) \??\u: OfficeVerifySign.exe File opened (read-only) \??\U: OfficeVerifySign.exe File opened (read-only) \??\D: OfficeVerifySign.exe File opened (read-only) \??\g: OfficeVerifySign.exe File opened (read-only) \??\H: OfficeVerifySign.exe File opened (read-only) \??\j: OfficeVerifySign.exe File opened (read-only) \??\O: OfficeVerifySign.exe File opened (read-only) \??\z: OfficeVerifySign.exe File opened (read-only) \??\Z: OfficeVerifySign.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3716 set thread context of 2172 3716 OfficeVerifySign.exe 78 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3716 OfficeVerifySign.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3716 wrote to memory of 2172 3716 OfficeVerifySign.exe 78 PID 3716 wrote to memory of 2172 3716 OfficeVerifySign.exe 78 PID 3716 wrote to memory of 2172 3716 OfficeVerifySign.exe 78 PID 3716 wrote to memory of 2172 3716 OfficeVerifySign.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeVerifySign.exe"C:\Users\Admin\AppData\Local\Temp\OfficeVerifySign.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\OfficeVerifySign.exe"C:\Users\Admin\AppData\Local\Temp\OfficeVerifySign.exe"2⤵
- Enumerates connected drives
PID:2172
-