42b69d127811ca7706dde5099f967a1502a3192cf4e3d4b0b7cf5660959f7d07

General

Target

0720a1760ad35b21d11f219b1296495e.exe
Size

2.4MB
MD5

0720a1760ad35b21d11f219b1296495e
SHA1

b56990e97f273697e8e83970035cddf9882721fd
SHA256

42b69d127811ca7706dde5099f967a1502a3192cf4e3d4b0b7cf5660959f7d07
SHA512

9daad20d9934e2d8aa441146e4c28bdfb08dfa08d68becf42bb67c7d50a2b8f990a639583ea96b32e142cb99aa672658eb66a28208375aa33c1f573551090328

Score

7^/10

agilenet persistence

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BCXSTZ.lnk	0720a1760ad35b21d11f219b1296495e.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral2/memory/4036-122-0x0000000007130000-0x0000000007151000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run	0720a1760ad35b21d11f219b1296495e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\BCXSTZ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windata\\winnote.exe\""	0720a1760ad35b21d11f219b1296495e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description pid process target process

PID 4036 set thread context of 4092 4036 0720a1760ad35b21d11f219b1296495e.exe 0720a1760ad35b21d11f219b1296495e.exe

description	pid	process	target process
PID 4036 set thread context of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4092-128-0x0000000000400000-0x0000000000546000-memory.dmp	autoit_exe
behavioral2/memory/4092-129-0x0000000000426BF7-mapping.dmp	autoit_exe
behavioral2/memory/4092-131-0x0000000000400000-0x0000000000546000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	0720a1760ad35b21d11f219b1296495e.exe

NTFS ADS 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\SecurityCenter2	0720a1760ad35b21d11f219b1296495e.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3956 WINWORD.EXE
3956 WINWORD.EXE

pid	process
3956	WINWORD.EXE
3956	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe0720a1760ad35b21d11f219b1296495e.exe

pid	process
4036	0720a1760ad35b21d11f219b1296495e.exe
4036	0720a1760ad35b21d11f219b1296495e.exe
4036	0720a1760ad35b21d11f219b1296495e.exe
4092	0720a1760ad35b21d11f219b1296495e.exe
4092	0720a1760ad35b21d11f219b1296495e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

pid process

4092 0720a1760ad35b21d11f219b1296495e.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe

description pid process

Token: SeDebugPrivilege 4036 0720a1760ad35b21d11f219b1296495e.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE

pid	process
4092	0720a1760ad35b21d11f219b1296495e.exe

description	pid	process
Token: SeDebugPrivilege	4036	0720a1760ad35b21d11f219b1296495e.exe

pid	process
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0720a1760ad35b21d11f219b1296495e.exe0720a1760ad35b21d11f219b1296495e.exe

description	pid	process	target process
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4036 wrote to memory of 4092	4036	0720a1760ad35b21d11f219b1296495e.exe	0720a1760ad35b21d11f219b1296495e.exe
PID 4092 wrote to memory of 3956	4092	0720a1760ad35b21d11f219b1296495e.exe	WINWORD.EXE
PID 4092 wrote to memory of 3956	4092	0720a1760ad35b21d11f219b1296495e.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\0720a1760ad35b21d11f219b1296495e.exe
"C:\Users\Admin\AppData\Local\Temp\0720a1760ad35b21d11f219b1296495e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036

C:\Users\Admin\AppData\Local\Temp\0720a1760ad35b21d11f219b1296495e.exe
"C:\Users\Admin\AppData\Local\Temp\0720a1760ad35b21d11f219b1296495e.exe"
2⤵
- Drops startup file
- Adds Run key to start application
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4092

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\JVBXFQ.rtf" /o ""
3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JVBXFQ.rtf
MD5
d295c8b2da0c5e453d9f1a38ce851f38

SHA1
edecdb3f9570c1903ed9f77d21920825403f3f8c

SHA256
9febf652d086e359850c6db8029301729d35723f4e1bc85279ce53fbc32034f4

SHA512
b439accc80b93f575589e37e1774a9815f43281597245feff21466ffd6107325324fc78bb57d431f1b8322c9e125b66e799eac6c75afe37208ae2cf92b805a07

Download Submit
memory/3956-136-0x00007FF94D770000-0x00007FF950293000-memory.dmp

Filesize
43.1MB

Download
memory/3956-137-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-357-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-130-0x0000000000000000-mapping.dmp

Download
memory/3956-355-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-141-0x00007FF946830000-0x00007FF948725000-memory.dmp

Filesize
31.0MB

Download
memory/3956-140-0x00007FF948730000-0x00007FF94981E000-memory.dmp

Filesize
16.9MB

Download
memory/3956-134-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-133-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-132-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-135-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-356-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/3956-358-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

Filesize
64KB

Download
memory/4036-122-0x0000000007130000-0x0000000007151000-memory.dmp

Filesize
132KB

Download
memory/4036-123-0x0000000007200000-0x0000000007201000-memory.dmp

Filesize
4KB

Download
memory/4036-126-0x0000000007550000-0x000000000755B000-memory.dmp

Filesize
44KB

Download
memory/4036-114-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Filesize
4KB

Download
memory/4036-124-0x00000000071D0000-0x00000000071D1000-memory.dmp

Filesize
4KB

Download
memory/4036-118-0x0000000005AA0000-0x0000000005AA1000-memory.dmp

Filesize
4KB

Download
memory/4036-127-0x00000000033B0000-0x00000000033B1000-memory.dmp

Filesize
4KB

Download
memory/4036-125-0x00000000065F1000-0x00000000065F2000-memory.dmp

Filesize
4KB

Download
memory/4036-119-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download
memory/4036-117-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/4036-116-0x0000000005F00000-0x0000000005F01000-memory.dmp

Filesize
4KB

Download
memory/4036-120-0x00000000065F0000-0x00000000065F1000-memory.dmp

Filesize
4KB

Download
memory/4092-131-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/4092-128-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/4092-129-0x0000000000426BF7-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads