Analysis

  • max time kernel
    172s
  • max time network
    188s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    30-01-2022 16:16

General

  • Target

    15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2.exe

  • Size

    10.1MB

  • MD5

    da05ba791af7598665117a366e74cd9d

  • SHA1

    7ef754a4e914eaec88a8084e2b613b981cfdc23d

  • SHA256

    15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2

  • SHA512

    ef0f0ee4ee393fa57544bf39e0e111f40e95a7465264f7c84568a5cf1b0ae9f3fea3c37b4f8df065d4355afd0ba654126721ce9e226364ab7b284a9ad5753268

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Office document contains embedded OLE objects 1 IoCs

    Detected embedded OLE objects in Office documents.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2.exe
    "C:\Users\Admin\AppData\Local\Temp\15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3824
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2 .docx" /o ""
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:484

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\15c87b1820b67d4d2b082e81fd7946dd00a1072441b7551e38fccd5575bf18c2 .docx

    MD5

    3e84c9c09db215e450846c60971ca881

    SHA1

    d2a06520f76f0a6632d3608e2d5dc7027e10dc74

    SHA256

    f9c5de40a6ec864a183c83e4457383b93acab8fa30a323083d4fb33dfa24ca18

    SHA512

    c5d2491ec6686e25c27a47f0a6da7e2b4551e0e5a749b270daeb1f0639b07bfe21ea13437331ade5bab60b3d8e6d36b2b0b6d954f47d68e2dc7d3d158f606276

  • memory/484-126-0x00007FFDF89F0000-0x00007FFDF8A00000-memory.dmp

    Filesize

    64KB

  • memory/484-120-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-121-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-122-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-123-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-129-0x00007FFDF89F0000-0x00007FFDF8A00000-memory.dmp

    Filesize

    64KB

  • memory/484-119-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-346-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-347-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-348-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/484-349-0x00007FFDFC560000-0x00007FFDFC570000-memory.dmp

    Filesize

    64KB

  • memory/3824-118-0x0000000003690000-0x0000000003691000-memory.dmp

    Filesize

    4KB