2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c

General

Target

2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
Size

706KB
MD5

3ac3494886b2df27ae6acebb36bb5ed5
SHA1

5fce26a566de4c07ebb4374b8f7c963b3f12b783
SHA256

2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c
SHA512

8c824b689b9f8c624edb2d5807ad2d552ae3a9a642895183a5a1acf0ad52ac2b8bdfec5aa036e51a0062a1b4a31fe7f604a1bd9be6950355ecd3a2981034e381
SSDEEP

12288:gp/iN/mlVdtvrYeyZJf7kPK+iqBZn+D73iKHeGspEAsekFS37t9lOqa:gpQ/6trYlvYPK+lqD73TeGsp1gFCXi

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1492	ScrBlaze.scr
1084	ScrBlaze.scr

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr
File created	C:\Windows\s18273659	ScrBlaze.scr
File created	C:\Windows\s18273659	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
File opened for modification	C:\Windows\s18273659	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
File created	C:\Windows\ScrBlaze.scr	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
File created	C:\Windows\s18273659	ScrBlaze.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\ScrBlaze.scr"	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	ScrBlaze.scr

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1816	AUDIODG.EXE
Token: 33	1816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1816	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
1492	ScrBlaze.scr
1492	ScrBlaze.scr
1084	ScrBlaze.scr
1084	ScrBlaze.scr

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1492	1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe	30
PID 1800 wrote to memory of 1492	1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe	30
PID 1800 wrote to memory of 1492	1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe	30
PID 1800 wrote to memory of 1492	1800	2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe	30

C:\Users\Admin\AppData\Local\Temp\2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe
"C:\Users\Admin\AppData\Local\Temp\2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c.exe"
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\ScrBlaze.scr
  "C:\Windows\ScrBlaze.scr" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1492

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\ScrBlaze.scr
C:\Windows\ScrBlaze.scr /s
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\862FZCFB.txt

Filesize
74B

MD5
4644ce10fe704c3b38aab171d8ffd2b3

SHA1
4dfb113885dac8b1e13967ad3352f5f0be5a2512

SHA256
4c5130a10da64fc3f21107e24d2287d6fcc89ad35675b8c1e133c90de34f9f21

SHA512
1a3e9f366832e373fa41bfcb66f172d6352faa15e3fabb2b77265e5ce09479f71ba1789b5995029e7d533bc207852484ceb31276df40c0beb8d892b068c78940

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
3ac3494886b2df27ae6acebb36bb5ed5

SHA1
5fce26a566de4c07ebb4374b8f7c963b3f12b783

SHA256
2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c

SHA512
8c824b689b9f8c624edb2d5807ad2d552ae3a9a642895183a5a1acf0ad52ac2b8bdfec5aa036e51a0062a1b4a31fe7f604a1bd9be6950355ecd3a2981034e381

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
3ac3494886b2df27ae6acebb36bb5ed5

SHA1
5fce26a566de4c07ebb4374b8f7c963b3f12b783

SHA256
2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c

SHA512
8c824b689b9f8c624edb2d5807ad2d552ae3a9a642895183a5a1acf0ad52ac2b8bdfec5aa036e51a0062a1b4a31fe7f604a1bd9be6950355ecd3a2981034e381

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
3ac3494886b2df27ae6acebb36bb5ed5

SHA1
5fce26a566de4c07ebb4374b8f7c963b3f12b783

SHA256
2b174addd6e130d66559c95210340cf00114ff083f0477c3a87d3ec4aa9cbf0c

SHA512
8c824b689b9f8c624edb2d5807ad2d552ae3a9a642895183a5a1acf0ad52ac2b8bdfec5aa036e51a0062a1b4a31fe7f604a1bd9be6950355ecd3a2981034e381

Download Submit
C:\Windows\s18273659

Filesize
911B

MD5
b707b07b0c8d0f3f0e6f0bade078330b

SHA1
5421c81a29c816175a6c9676e0291427ccdb0999

SHA256
4f207107052f7a6c0488e136ca8f3bc40217be66285493270c7c6a843baa9a71

SHA512
ed027eeedcb3257940d235fa4a9ed21e43d5676109d608558617913e7a869f3c1a1a0e811d469232457db21e1764db6969d6c8d3970c1a2dc87155fa4b7785c4

Download Submit
memory/1800-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing