d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0

General

Target

d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
Size

704KB
MD5

0415df301bbdb86260b68ddeb890ba3c
SHA1

71c6c04ed0b33848b59eb4605dcb55fbb957eebf
SHA256

d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0
SHA512

b281253321ea52a6abb8bb68d19000c6ffe08465e7d6e60316d5fda8dc484afcc2ba19385d1959a8900767a4876824818d5b3bed655655398acda4ed228f8f2a
SSDEEP

12288:DiNPiV9N+CL45fBf7U/1deaBZn+DL3iqHeGsJSjcuFhltIyqIq5BAzfKyD:UPKECL4fo/1d5qDL3TeGsJSjDFhltIQ3

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1208	ScrBlaze.scr
1612	ScrBlaze.scr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\s18273659	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
File opened for modification	C:\Windows\s18273659	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
File created	C:\Windows\ScrBlaze.scr	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
File created	C:\Windows\s18273659	ScrBlaze.scr
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr
File created	C:\Windows\s18273659	ScrBlaze.scr
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\ScrBlaze.scr"	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\GPU	ScrBlaze.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	ScrBlaze.scr

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4236	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
4236	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
1208	ScrBlaze.scr
1208	ScrBlaze.scr
1612	ScrBlaze.scr
1612	ScrBlaze.scr

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 1208	4236	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe	79
PID 4236 wrote to memory of 1208	4236	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe	79
PID 4236 wrote to memory of 1208	4236	d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe	79

C:\Users\Admin\AppData\Local\Temp\d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe
"C:\Users\Admin\AppData\Local\Temp\d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\ScrBlaze.scr
  "C:\Windows\ScrBlaze.scr" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1208

C:\Windows\ScrBlaze.scr
C:\Windows\ScrBlaze.scr /s
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ScrBlaze.scr

Filesize
704KB

MD5
0415df301bbdb86260b68ddeb890ba3c

SHA1
71c6c04ed0b33848b59eb4605dcb55fbb957eebf

SHA256
d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0

SHA512
b281253321ea52a6abb8bb68d19000c6ffe08465e7d6e60316d5fda8dc484afcc2ba19385d1959a8900767a4876824818d5b3bed655655398acda4ed228f8f2a

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
704KB

MD5
0415df301bbdb86260b68ddeb890ba3c

SHA1
71c6c04ed0b33848b59eb4605dcb55fbb957eebf

SHA256
d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0

SHA512
b281253321ea52a6abb8bb68d19000c6ffe08465e7d6e60316d5fda8dc484afcc2ba19385d1959a8900767a4876824818d5b3bed655655398acda4ed228f8f2a

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
704KB

MD5
0415df301bbdb86260b68ddeb890ba3c

SHA1
71c6c04ed0b33848b59eb4605dcb55fbb957eebf

SHA256
d458c2d846299ce987485bb4258672f5f211758559b388bcec9c4f9e50dbe1d0

SHA512
b281253321ea52a6abb8bb68d19000c6ffe08465e7d6e60316d5fda8dc484afcc2ba19385d1959a8900767a4876824818d5b3bed655655398acda4ed228f8f2a

Download Submit
C:\Windows\s18273659

Filesize
836B

MD5
e71783aa563ebf4534fe165496cfbe81

SHA1
1c4beeb8fc7810dd1f4bca12d98ddc5e8c60d6f8

SHA256
68d27bbfa86f9d0addd377080aa4e6a89ae04528969620ed30b9f164ad7b1f03

SHA512
633248df2a26655a2924c112f8b22c9e590d7e3ee646cd800e52e273a7eca98ddd64e70435147bfe6958fbf867361d1bd5aca930f53460fb2f169ff2381f10ef

Download Submit

Analysis

Sharing