0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1

General

Target

0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe
Size

462KB
MD5

a0d37b344184b8dfba49de76f68a8e40
SHA1

1d8a05c7503ca31f3020bc396707a7ba1e1eb052
SHA256

0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1
SHA512

42736df5c160e059b34f395eea65e64a45ecb47c156fc5e66bc3494930d03456cf8fa2927e986f2e671523d83d361ab4d4a1cdf1edee21b9d0ac36e9fd9b417f
SSDEEP

6144:zRPu8zwNAZYCZrIik3tHnjGdvX22u8v7S/ig/3Tcu1TCnaZziw4RxxARC3EJzAb+:zJrIik39ydvm2SD/5EnEqhn0o3Jxi9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4840	1C90.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1C90.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	1C90.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4992	WINWORD.EXE
4992	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4840	1C90.tmp

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE
4992	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4840	4892	0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe	81
PID 4892 wrote to memory of 4840	4892	0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe	81
PID 4892 wrote to memory of 4840	4892	0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe	81
PID 4840 wrote to memory of 4992	4840	1C90.tmp	82
PID 4840 wrote to memory of 4992	4840	1C90.tmp	82

C:\Users\Admin\AppData\Local\Temp\0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe
"C:\Users\Admin\AppData\Local\Temp\0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\1C90.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C90.tmp" --helpC:\Users\Admin\AppData\Local\Temp\0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.exe 88A9A9EB7D4C4CBF0306D01D283FBCFCA8161F5EE5CEBDB5D2992FC392C0F52619640391421F96B9A1A5043F93847FF945568F550E05B5EF91002216834BAA45
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0a0eeb78f6a208d867012c3cde3fc5f74363f673c4eb7e00c2d4e9a1b87d8ef1.docx

Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C90.tmp

Filesize
462KB

MD5
cbfea3107a8c4666ec76a20525debc18

SHA1
070bcdde5b936022486cef1d43eaab4ce8a8a2ba

SHA256
03f43ad35e8720691f81b08aa9241e09ebadca0287cb1813d290dc5d394fa0a5

SHA512
d3a001cc40dc32b41902f4c8e10fbf03ad00cdad3c9c164bfcd4043d300a2e1aac545fde8b4acc8bd7570041007c1609ce3bf3c5eeba56e455dc61e8c318c163

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C90.tmp

Filesize
462KB

MD5
cbfea3107a8c4666ec76a20525debc18

SHA1
070bcdde5b936022486cef1d43eaab4ce8a8a2ba

SHA256
03f43ad35e8720691f81b08aa9241e09ebadca0287cb1813d290dc5d394fa0a5

SHA512
d3a001cc40dc32b41902f4c8e10fbf03ad00cdad3c9c164bfcd4043d300a2e1aac545fde8b4acc8bd7570041007c1609ce3bf3c5eeba56e455dc61e8c318c163

Download Submit
memory/4840-132-0x0000000000000000-mapping.dmp

Download
memory/4992-135-0x0000000000000000-mapping.dmp

Download
memory/4992-136-0x00007FFC7DCD0000-0x00007FFC7DCE0000-memory.dmp

Filesize
64KB

Download
memory/4992-137-0x00007FFC7DCD0000-0x00007FFC7DCE0000-memory.dmp

Filesize
64KB

Download
memory/4992-138-0x00007FFC7DCD0000-0x00007FFC7DCE0000-memory.dmp

Filesize
64KB

Download
memory/4992-139-0x00007FFC7DCD0000-0x00007FFC7DCE0000-memory.dmp

Filesize
64KB

Download
memory/4992-140-0x00007FFC7DCD0000-0x00007FFC7DCE0000-memory.dmp

Filesize
64KB

Download
memory/4992-141-0x00007FFC7B370000-0x00007FFC7B380000-memory.dmp

Filesize
64KB

Download
memory/4992-142-0x00007FFC7B370000-0x00007FFC7B380000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads