8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249

General

Target

8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe
Size

79KB
MD5

5f1c6dca730a015ea3cc3cd9dab2e260
SHA1

f5e8dc4e5429789475b41b70175c57bf98667878
SHA256

8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249
SHA512

a2551f85c24c1a078b2e9a734023d24a94ea13108f98b16b1f878e0400bf81846e12163bec9ac51f0babbf5ccca7ca63321dc3fe2978eb3df4394fc4ce57f902
SSDEEP

384:/TLoBEse1egPc2RmwebA6/T6yjGTzDFKDsywKyPXWGBEyuA2Rt9Qo6WBlWJ7hlsP:/QWeVGSA+rjGTvejm2yuA2R8yY7zskO

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	regedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2964	regedit.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3308	WINWORD.EXE
3308	WINWORD.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE
3308	WINWORD.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3308	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	82
PID 1656 wrote to memory of 3308	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	82
PID 1656 wrote to memory of 2964	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	83
PID 1656 wrote to memory of 2964	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	83
PID 1656 wrote to memory of 2964	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	83
PID 1656 wrote to memory of 3852	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	84
PID 1656 wrote to memory of 3852	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	84
PID 1656 wrote to memory of 3852	1656	8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe	84

C:\Users\Admin\AppData\Local\Temp\8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe
"C:\Users\Admin\AppData\Local\Temp\8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3308
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s c:\abc.reg
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Runs .reg file with regedit
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1.bat
  2⤵
  PID:3852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
291B

MD5
1a3f80f3fc0dedef71657b08f8ab26b6

SHA1
745d17d29e656f0f57a3d2d8db260af1e2126e35

SHA256
30f21a694fbd0bc1bd06d81d0221fb8a5b3390ba4cfa0ef0db8be6b80bba6133

SHA512
c94f5a0d84eb89913817607846223ed7d34b799f90dd4b3e1918614414281bfd16d051701843b7a6cb0e623d1e2cba671fe1bb249e62c9df3bd0d7b9eff1224f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8cf7d7bc828ee7b38a5d9a495acfcadc39e0b0e03534259b9fd3af46aa942249.doc

Filesize
51KB

MD5
20b403a310eb164cc7903e026d62a7d1

SHA1
b46bfec790c512cb02f15c94817b7f974de6e09f

SHA256
1364c66dbddf5a8bb0f9a21b368ef41bb7054de8356b55c1fe4685bcf8189e0c

SHA512
eb4991ae0a93f9b3a874ea67d3ff5754f82cb5fdf4783294b854cff9d7ccc0c615fde7c38f9b9814423407163efe5f0af72e5eec3bb0a08941e16d0aea3a073c

Download Submit
\??\c:\abc.reg

Filesize
605B

MD5
919c47af89419610da8379f1a4bc4406

SHA1
8a38ced0244af3ea4f31ef83a79b02c33db7c99f

SHA256
b6ae6b39d808e52cd4971732f205bfb3ad8d4fb9559e26db6620e693fd9cf873

SHA512
7fd7689941a74377ee2c2efe35103f69a5fe47baeb19265f7470cff5e83313df0087206603e85debf5939a26dd5fb881ee8bf91ea8c1ce5ef511808af537a580

Download Submit
memory/3308-144-0x00007FFE617F0000-0x00007FFE61800000-memory.dmp

Filesize
64KB

Download
memory/3308-139-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-141-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-140-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-143-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-142-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-145-0x00007FFE617F0000-0x00007FFE61800000-memory.dmp

Filesize
64KB

Download
memory/3308-148-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-149-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-150-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download
memory/3308-151-0x00007FFE63C70000-0x00007FFE63C80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads