Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-09-2022 07:56
Static task
static1
Behavioral task
behavioral1
Sample
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
Resource
win7-20220812-en
General
-
Target
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe
-
Size
328KB
-
MD5
d4c5e5e909ff0def4cd6be23a09d43ae
-
SHA1
d7ce18914c638c66d6e5377c40adf22c7c847289
-
SHA256
64f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
-
SHA512
01bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
SSDEEP
6144:ty3ZvTcfs331nuT8n2+a0JDj21k4/WQUDu5IYuVpij4eNtkH9d7mCvd:t0vTcfsHcwn2+tkVODDOqgUKt+3mC
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
complementooffice.execomplementooffice.exepid process 1760 complementooffice.exe 1980 complementooffice.exe -
Loads dropped DLL 1 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exepid process 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Try2 = "C:\\Users\\Admin\\Documents\\complementooffice.exe -boot" 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe -
Processes:
complementooffice.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA complementooffice.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
complementooffice.exedescription pid process target process PID 1760 set thread context of 1980 1760 complementooffice.exe complementooffice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
complementooffice.exepid process 1980 complementooffice.exe 1980 complementooffice.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.execomplementooffice.execomplementooffice.exedescription pid process Token: SeDebugPrivilege 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe Token: SeDebugPrivilege 1760 complementooffice.exe Token: SeDebugPrivilege 1980 complementooffice.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.execomplementooffice.exedescription pid process target process PID 1048 wrote to memory of 1760 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 1048 wrote to memory of 1760 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 1048 wrote to memory of 1760 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 1048 wrote to memory of 1760 1048 64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe PID 1760 wrote to memory of 1980 1760 complementooffice.exe complementooffice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe"C:\Users\Admin\AppData\Local\Temp\64F59FBE4B383B157C81ADF3439876610A99C42AC6D91.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\complementooffice.exe"C:\Users\Admin\Documents\complementooffice.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\complementooffice.exe"C:\Users\Admin\Documents\complementooffice.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
C:\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
\Users\Admin\Documents\complementooffice.exeFilesize
328KB
MD5d4c5e5e909ff0def4cd6be23a09d43ae
SHA1d7ce18914c638c66d6e5377c40adf22c7c847289
SHA25664f59fbe4b383b157c81adf3439876610a99c42ac6d9160810d53dae0a0114ce
SHA51201bdbe9a459ded687f875c63d82310b2cedea994476560b092e63dfabfe2b68ded767f6fb423fb38637cdc40645588e44a8a7a7dd8cf2913650a89760c428af9
-
memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1048-55-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1048-56-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1048-62-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1760-63-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1760-64-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1760-58-0x0000000000000000-mapping.dmp
-
memory/1760-72-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB
-
memory/1980-65-0x0000000000402000-0x000000000041E800-memory.dmpFilesize
114KB
-
memory/1980-67-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1980-68-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1980-70-0x0000000000402000-0x000000000041E800-memory.dmpFilesize
114KB
-
memory/1980-73-0x0000000074DA0000-0x000000007534B000-memory.dmpFilesize
5.7MB