44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78

General

Target

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
Size

1.1MB
MD5

fc95d7841f298dbe638cbe63d7878d89
SHA1

919324ceb106a872866c9b78612094666644b03d
SHA256

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78
SHA512

b7a581dda18cf09b9b4f69e922244efb90b8494536e1281b01a86a5dcc25cf0a3edc1361895b4bbd305eb8368471a37b811c4ce956f8e047f8aab7365fb2b45f

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\ReadMe.txt

Ransom Note

Gentlemen! Your business is at serios risk . There is a significant hole in the security system of your company. We have easily penetrated your network. You should thank the Lord for being hacked by serios people not some stupid schoolboys or dangerous punks. They can damage all your important data just for fun. All files on each host in the network have been encrypted with a strong algorithm Now your files are crypted with the strongest millitary algorithms RSA4096 and AES-256. No one can help you to restore files without our special decoder. Photorec, RannoDecryptor etc. repair tools Are useless and can destroy your files irreversibly. If you want to restore your files write to emails (contacts are at the bottom of the sheet ) and attach 2 encrypted files (Less than 5 Mb each, non-archived and your files should not contain valuable information (Databases, backups, large excel sheets, etc. )) You will receive decrypted samples and our conditions how to get the decoder. Please don't forget to write the name of your company in the subject of your e-mail. You have to pay for decryption in Bitcoins. The final price depends on how fast you write to us. Every day of delay will cost you additional BTC Nothing personal just business As soon as we get bitcoins you'll get all your decrypted data back. Moreover you will get instructions how to close the hole in security and how to avoid such problems in the future we will recommend you special software that makes the most problems to hackers. Attention! One more time ! Do not rename encrypted files. Do not try to decrypt your data using third party software. P.S. Remember, we are not scammers. We dont need your files and your information. But after 2 weeks all your files and keys will be deleted automatically. Just send a request immediately after infection. All data will be restored absolutely. Your warranty - decrypted samples. Contact emails Primary email : unibovwood1984@protonmail.com Secondary email : ormecha19@tutanota.com

Emails

unibovwood1984@protonmail.com

ormecha19@tutanota.com

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

344 cmd.exe

pid	process
344	cmd.exe

Drops startup file 2 IoCs

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery.bmp	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Recovery.bmp	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

description	ioc	process
File opened (read-only)	\??\L:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\I:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\F:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\Z:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\W:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\S:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\R:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\P:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\H:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\G:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\E:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\Y:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\Q:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\O:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\N:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\K:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\J:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\V:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\U:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\T:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\M:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\B:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\A:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened (read-only)	\??\X:	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

Drops file in Program Files directory 40 IoCs

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

description	ioc	process
File opened for modification	C:\PROGRA~3\MICROS~2\MSOUTL~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\nslist.hxl	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\Mozilla\updates\308046~1\UPDATE~1.JSO	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\state.rsm	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\Adobe\Acrobat\9.0\REPLIC~1\Security\DIRECT~1.ACR	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSINFO~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSOIS1~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSGROO~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSSETL~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\DOCUME~1	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\Hx.hxn	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\HX_103~2.HXW	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSOU~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSWINW~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\APPLIC~1	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\FAVORI~1	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\HX_103~1.LCK	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSWINW~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSEXCE~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSPU~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSTO~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSONEN~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\state.rsm	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\STARTM~1	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\TEMPLA~1	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSEXCE~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSGRAP~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSPU~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSPOWE~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\Desktop	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\HX_103~1.HXD	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSOUTL~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSPOWE~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSINFO~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSAC~1.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\MSMSAC~2.HXN	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\state.rsm	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\Adobe\Updater6\ADOBEE~2.XML	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\HX_103~1.HXW	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
File opened for modification	C:\PROGRA~3\MICROS~2\HX_103~1.HXH	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1669990088-476967504-438132596-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE

Opens file in notepad (likely ransom note) 2 IoCs
ransomware

Processes:

NOTEPAD.EXENOTEPAD.EXE

pid process

668 NOTEPAD.EXE
340 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1892 WINWORD.EXE

pid	process
668	NOTEPAD.EXE
340	NOTEPAD.EXE

pid	process
1892	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

pid	process
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
Token: 33	1624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1624	AUDIODG.EXE
Token: 33	1624	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1624	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

WINWORD.EXE

pid process

1892 WINWORD.EXE
1892 WINWORD.EXE
1892 WINWORD.EXE

pid	process
1892	WINWORD.EXE
1892	WINWORD.EXE
1892	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe

description	pid	process	target process
PID 1136 wrote to memory of 344	1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe	cmd.exe
PID 1136 wrote to memory of 344	1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe	cmd.exe
PID 1136 wrote to memory of 344	1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe	cmd.exe
PID 1136 wrote to memory of 344	1136	44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe
"C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\44F0B6~1.BAT
2⤵
- Deletes itself
PID:344

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:668

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1764

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1624

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Documents\Are.docx"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1892

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\ReadMe.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:340

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\44f0b6ee096aeb62aa585a0c37decaae0177eae22c18e40b0e823d9eaf856b78.exe.bat
MD5
837c409563fc188640223174a9af63c7

SHA1
f67029d8acc3322e0b3be0498ec8ce68476fa3db

SHA256
57976e286311302bb9c2bc4b379984002fdaf4dd44a47e969827f96aebd87a47

SHA512
3008f150f91a8e8a180f53fe1c8a6acc55364e732f5e54f8c78d6169459a16817d0a6e389355b26d641348ece017e3148a9c2daf0e3150ef507382cd960d3ca0

Download Submit
C:\Users\Admin\Desktop\ReadMe.txt
MD5
d0fb4838a9b950e6311e0fd7d18c138c

SHA1
1f96f64bd12434d6216040a20d6631f9d9d35c7b

SHA256
87de37c3692d3b960ab8f73c7ecd12d7894cb2042ba5741ffbcf8e769f284d63

SHA512
d853cba6e1dcab9a36f61f1f495128c6e739637d6ec478fe4d0d2d8ab7fb8601131ffcd30538b5943ce3ef932e574394b3c899c6ecff7a19f97d1c27d0eee488

Download Submit
C:\Users\Admin\Documents\Are.docx
MD5
5ed40f0ec8b466a61a280b9b1865f84f

SHA1
9c7e0a790648b6618986ae9436021c2f65416ae0

SHA256
c0c010fe6f8a5796e287a59c98a6464e3f87f3c709cc608a62d07737f5b0ebac

SHA512
f846cf54de58bbc25729f82cb37c55dd36de917b88bc368b313f5e79d14d3823ba56bc9b5ae65e4ecc87fd4b2f99c8bf10d42bef475099b0f9f4943d4d509e10

Download Submit
C:\Users\Admin\Documents\ReadMe.txt
MD5
d0fb4838a9b950e6311e0fd7d18c138c

SHA1
1f96f64bd12434d6216040a20d6631f9d9d35c7b

SHA256
87de37c3692d3b960ab8f73c7ecd12d7894cb2042ba5741ffbcf8e769f284d63

SHA512
d853cba6e1dcab9a36f61f1f495128c6e739637d6ec478fe4d0d2d8ab7fb8601131ffcd30538b5943ce3ef932e574394b3c899c6ecff7a19f97d1c27d0eee488

Download Submit
memory/344-54-0x0000000000000000-mapping.dmp

Download
memory/668-56-0x000007FEFBD11000-0x000007FEFBD13000-memory.dmp

Filesize
8KB

Download
memory/1136-53-0x0000000075641000-0x0000000075643000-memory.dmp

Filesize
8KB

Download
memory/1892-59-0x0000000072801000-0x0000000072804000-memory.dmp

Filesize
12KB

Download
memory/1892-60-0x0000000070281000-0x0000000070283000-memory.dmp

Filesize
8KB

Download
memory/1892-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1892-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads