09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa

General

Target

09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe
Size

462KB
MD5

5a45ea4ccb7b60d4a9f953aa07ec3920
SHA1

cec0b356bc0a958bdc217553bedef0a0e9e362cd
SHA256

09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa
SHA512

b61f0e801b3169e69b3ff2c3af582c33c515b687906ca755216227154cfb1bda61b670b33f8aa9345f4e3d61006b8778ed44a4cad68e76c7492b9567c04d32a1
SSDEEP

6144:zRPu8zwNAZYCZrIik3tHZhQQ6r4JzearccP8/Fl1q2OjMKrkwGxzsH5f:zJrIik3pIr4JKarcU8D1q270x9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4764	F736.tmp

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	F736.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	F736.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1860	WINWORD.EXE
1860	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4764	F736.tmp

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE
1860	WINWORD.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 4764	4160	09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe	82
PID 4160 wrote to memory of 4764	4160	09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe	82
PID 4160 wrote to memory of 4764	4160	09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe	82
PID 4764 wrote to memory of 1860	4764	F736.tmp	83
PID 4764 wrote to memory of 1860	4764	F736.tmp	83

C:\Users\Admin\AppData\Local\Temp\09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe
"C:\Users\Admin\AppData\Local\Temp\09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\F736.tmp
  "C:\Users\Admin\AppData\Local\Temp\F736.tmp" --helpC:\Users\Admin\AppData\Local\Temp\09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.exe 6F4EDFEF7609D557D7EFA7D75D7620F0BCFDF796D5674DB8D41817AF758A535D17D406399869DBE651F9EC4E28BAC1220DDF25D9AD3FEE82E737F648CA63F085
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\09a441a07435c5b274bd1703bddc91886e5794ff4fccb2b4746b1c38a4788afa.docx

Filesize
21KB

MD5
7079891932a64f097abafd233055a1e9

SHA1
246d95feafe67689d49a5a4cadba18d3ac1914e5

SHA256
c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1

SHA512
6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a

Download Submit
C:\Users\Admin\AppData\Local\Temp\F736.tmp

Filesize
462KB

MD5
26b5e5018d2fe7578e5410426e4a0934

SHA1
779dc3e5ce20524a0ed0ab62cbe78735d62b1e7d

SHA256
e41ad64813aac741ebfe891ffb598e24d0c002b095afd57c81afd3480a017ff4

SHA512
5e578a631221d4dd12e0c9977414ed3d580f8c71116fb8ec2c7b48e5d770fad73caa7816c9f2cde5f6e457277df945bccfcb143f471c87f9b2736cae8c22f72f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F736.tmp

Filesize
462KB

MD5
26b5e5018d2fe7578e5410426e4a0934

SHA1
779dc3e5ce20524a0ed0ab62cbe78735d62b1e7d

SHA256
e41ad64813aac741ebfe891ffb598e24d0c002b095afd57c81afd3480a017ff4

SHA512
5e578a631221d4dd12e0c9977414ed3d580f8c71116fb8ec2c7b48e5d770fad73caa7816c9f2cde5f6e457277df945bccfcb143f471c87f9b2736cae8c22f72f

Download Submit
memory/1860-136-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/1860-138-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/1860-137-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/1860-140-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/1860-139-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

Filesize
64KB

Download
memory/1860-141-0x00007FFCE6700000-0x00007FFCE6710000-memory.dmp

Filesize
64KB

Download
memory/1860-142-0x00007FFCE6700000-0x00007FFCE6710000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads