8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d

General

Target

8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe
Size

1.2MB
MD5

41519a90fac57bd8783c09187a127607
SHA1

2bb72ccb4cd8de1780c62efada6b6b17f6a77e97
SHA256

8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d
SHA512

b6cf21bd04a1ba0e5ceb6fcfcc7f4b19a3552d48d617d461b0b4791bf35d63f2c2028c82b3840bb77a47d7032ea09220c7303816b3c4e4612ecea58c7e8efde5
SSDEEP

24576:h85OMvYfGUbcOgUrBCm9ZkIFPpqMZRGrUN8Gy4cJJnMLXqXvRqjO3:6ObFP8MZpjiM7qY0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4180	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr
2980	tmp2.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe

Loads dropped DLL 1 IoCs

pid	Process
4804	regsvr32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ODB = "regsvr32 /s \"C:\\Users\\Admin\\AppData\\Roaming\\officedb\\officeDB.dll\""	tmp2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4180	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr
4180	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr
4180	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr
2980	tmp2.exe
2980	tmp2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4180	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	84
PID 3620 wrote to memory of 4180	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	84
PID 3620 wrote to memory of 4180	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	84
PID 3620 wrote to memory of 2980	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	85
PID 3620 wrote to memory of 2980	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	85
PID 3620 wrote to memory of 2980	3620	8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe	85
PID 2980 wrote to memory of 4804	2980	tmp2.exe	86
PID 2980 wrote to memory of 4804	2980	tmp2.exe	86
PID 2980 wrote to memory of 4804	2980	tmp2.exe	86

C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe
"C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr
  "C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr" /S
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\tmp2.exe
  C:\Users\Admin\AppData\Local\Temp\tmp2.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s "C:\Users\Admin\AppData\Roaming\officedb\officeDB.dll"
    3⤵
    - Loads dropped DLL
    PID:4804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr

Filesize
828KB

MD5
81c6c0f999d39286079ec6eea5b788b7

SHA1
a6f8d57292c42fdca19cdfabdc1b3e64c2a66373

SHA256
0987ba224bdfc0e15d9474a2df8a327fff0a7eba404fce1f5cd5372f5c2552c9

SHA512
c072c8bbc53a25a79c9940d890950f7eb8241cf780cb0a48764dc79d3dc4fa85fa13de89ce5aac1a697083c97ce966e973e15f0aeaca19904162105456529484

Download Submit
C:\Users\Admin\AppData\Local\Temp\8f39e6130a2b8934e45c8d55a7c7755abe7f9f149b296921c28eed0ddc27c11d.scr

Filesize
828KB

MD5
81c6c0f999d39286079ec6eea5b788b7

SHA1
a6f8d57292c42fdca19cdfabdc1b3e64c2a66373

SHA256
0987ba224bdfc0e15d9474a2df8a327fff0a7eba404fce1f5cd5372f5c2552c9

SHA512
c072c8bbc53a25a79c9940d890950f7eb8241cf780cb0a48764dc79d3dc4fa85fa13de89ce5aac1a697083c97ce966e973e15f0aeaca19904162105456529484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
364KB

MD5
4e296586a1f5f6bcc01f8ace32715e6d

SHA1
cd0927d7fcb9765e6a5845b15bb3708a3a9b000a

SHA256
2d37480922e6fd894a4bd535190be297673ac7b89e6e36cf0543816a9e629898

SHA512
69f06cf00b38cb9dc4edcdddaa9f711684e78f1af313c2b7511d8d5983f741cd4919701e0db4ea74a53f744f328591014063cf00de7be65fc6293eabab3f9e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2.exe

Filesize
364KB

MD5
4e296586a1f5f6bcc01f8ace32715e6d

SHA1
cd0927d7fcb9765e6a5845b15bb3708a3a9b000a

SHA256
2d37480922e6fd894a4bd535190be297673ac7b89e6e36cf0543816a9e629898

SHA512
69f06cf00b38cb9dc4edcdddaa9f711684e78f1af313c2b7511d8d5983f741cd4919701e0db4ea74a53f744f328591014063cf00de7be65fc6293eabab3f9e56

Download Submit
C:\Users\Admin\AppData\Roaming\officedb\officeDB.dll

Filesize
104KB

MD5
37ee769d5c39d3f6cd9c8506e0ba9353

SHA1
beb2c5974393990ce5d42045a0f958fd7122e9a4

SHA256
14fe68c477fa6c02fe1328dfefc93ded488aa31ad5765c7be339cb83b537587a

SHA512
7461c6c709cf23946ee0b218c9f4c7b1e2892c0661e53137c03e5d274d8bf848584736f28fd00dce7196a9e29671098a7af0ef1a55f4b040ed7cee18dbe684ab

Download Submit
C:\Users\Admin\AppData\Roaming\officedb\officeDB.dll

Filesize
104KB

MD5
37ee769d5c39d3f6cd9c8506e0ba9353

SHA1
beb2c5974393990ce5d42045a0f958fd7122e9a4

SHA256
14fe68c477fa6c02fe1328dfefc93ded488aa31ad5765c7be339cb83b537587a

SHA512
7461c6c709cf23946ee0b218c9f4c7b1e2892c0661e53137c03e5d274d8bf848584736f28fd00dce7196a9e29671098a7af0ef1a55f4b040ed7cee18dbe684ab

Download Submit

Analysis

Sharing