Analysis

  • max time kernel
    150s
  • max time network
    62s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    06-11-2022 19:31

General

  • Target

    cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c.exe

  • Size

    191KB

  • MD5

    0f59a92a741c75589d649af26b7c0920

  • SHA1

    7c42edba2f2a764ee1051397acb24564aedb5c5c

  • SHA256

    cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c

  • SHA512

    3ecb19e2a76bbf34d4443466c49b4c672ec22431c5c04ff8a414cb31d1cf42fef2f96c574226d2a326fa2712c70f01264a9052d35a8ccc8e583520a85ae3dc39

  • SSDEEP

    3072:dBI5ArKGCnhgU1XA+ArXjeaMoh6lgUaVwQ+/76bSSN+PS7VyoCeJ6ik+wZ:dK5ArKjbAxXSaegUqGeGpBohM+w

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 9 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of UnmapMainImage
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c.exe
      "C:\Users\Admin\AppData\Local\Temp\cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Roaming\mstsdt32\convInit.exe
        "C:\Users\Admin\AppData\Roaming\mstsdt32\convInit.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Users\Admin\AppData\Local\Temp\~EB1.tmp
          "C:\Users\Admin\AppData\Local\Temp\~EB1.tmp"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1844
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~11EC.tmp.docx"
        3⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:284
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          4⤵
            PID:328
    • C:\Windows\SysWOW64\dpnscont.exe
      C:\Windows\SysWOW64\dpnscont.exe -k
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:468

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\~11EC.tmp.docx

      Filesize

      16KB

      MD5

      ff0b548839422cda08a614f0a1952731

      SHA1

      721a6644c463655a1a0653c4297a5b9732259bf8

      SHA256

      abac053945ffd817b661aecf6ba8e5ea5c862f2c3f3f10c909f5361c0b38de91

      SHA512

      9cdf3105b902de995b5e411fd552227a461dab061a861f8bb44ae9e89fe1430c8ca44e4b3af1aee400df94d7e3a3b826b01e292a57381943ce64ceb5c9141a3a

    • C:\Users\Admin\AppData\Local\Temp\~EB1.tmp

      Filesize

      6KB

      MD5

      f0887ae27ed1bc1004689e09dca56fec

      SHA1

      07b87fbad05e339b97e96c2ce2f7126687f7eeed

      SHA256

      5f74b20cd83769b7ab87dd5ea383d34ca5a06bd67fb51480379a4f70f1239de2

      SHA512

      fba6e502a8b11edc3c386221cd6bd3408eb2d7eae10d13fbf7925ac8a19fb2f84605361ebbc3f1d48ff7ece25bda1c40cb69bcdb636da704e6906fd21d0a82d3

    • C:\Users\Admin\AppData\Roaming\mstsdt32\convInit.exe

      Filesize

      172KB

      MD5

      53bc4c84b39672dda4d5a8b9b1dd7cc7

      SHA1

      627c774ff3513511df5cc760b1bcd2b8e8a93a4d

      SHA256

      e3f87a48c946c9b132d9d7e6ef5aa426f622ebf4270c026763e1aa77c216fb95

      SHA512

      bdbe58e988012ba03a51926436d581292ccf4de0de83dadf063cc552516c6f04bf74a89247f312d8f1faff557b5ae3a69864f4021083406eb5900bde16e060c0

    • C:\Users\Admin\AppData\Roaming\mstsdt32\convInit.exe

      Filesize

      172KB

      MD5

      53bc4c84b39672dda4d5a8b9b1dd7cc7

      SHA1

      627c774ff3513511df5cc760b1bcd2b8e8a93a4d

      SHA256

      e3f87a48c946c9b132d9d7e6ef5aa426f622ebf4270c026763e1aa77c216fb95

      SHA512

      bdbe58e988012ba03a51926436d581292ccf4de0de83dadf063cc552516c6f04bf74a89247f312d8f1faff557b5ae3a69864f4021083406eb5900bde16e060c0

    • C:\Windows\SysWOW64\dpnscont.exe

      Filesize

      191KB

      MD5

      0f59a92a741c75589d649af26b7c0920

      SHA1

      7c42edba2f2a764ee1051397acb24564aedb5c5c

      SHA256

      cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c

      SHA512

      3ecb19e2a76bbf34d4443466c49b4c672ec22431c5c04ff8a414cb31d1cf42fef2f96c574226d2a326fa2712c70f01264a9052d35a8ccc8e583520a85ae3dc39

    • C:\Windows\SysWOW64\dpnscont.exe

      Filesize

      191KB

      MD5

      0f59a92a741c75589d649af26b7c0920

      SHA1

      7c42edba2f2a764ee1051397acb24564aedb5c5c

      SHA256

      cfff403cc6fbd08e1ce65e63ebdf32bd8b7b11c3d0ec09ac8fe0dfd7d5c1cf4c

      SHA512

      3ecb19e2a76bbf34d4443466c49b4c672ec22431c5c04ff8a414cb31d1cf42fef2f96c574226d2a326fa2712c70f01264a9052d35a8ccc8e583520a85ae3dc39

    • \Users\Admin\AppData\Local\Temp\~EB1.tmp

      Filesize

      6KB

      MD5

      f0887ae27ed1bc1004689e09dca56fec

      SHA1

      07b87fbad05e339b97e96c2ce2f7126687f7eeed

      SHA256

      5f74b20cd83769b7ab87dd5ea383d34ca5a06bd67fb51480379a4f70f1239de2

      SHA512

      fba6e502a8b11edc3c386221cd6bd3408eb2d7eae10d13fbf7925ac8a19fb2f84605361ebbc3f1d48ff7ece25bda1c40cb69bcdb636da704e6906fd21d0a82d3

    • \Users\Admin\AppData\Roaming\mstsdt32\convInit.exe

      Filesize

      172KB

      MD5

      53bc4c84b39672dda4d5a8b9b1dd7cc7

      SHA1

      627c774ff3513511df5cc760b1bcd2b8e8a93a4d

      SHA256

      e3f87a48c946c9b132d9d7e6ef5aa426f622ebf4270c026763e1aa77c216fb95

      SHA512

      bdbe58e988012ba03a51926436d581292ccf4de0de83dadf063cc552516c6f04bf74a89247f312d8f1faff557b5ae3a69864f4021083406eb5900bde16e060c0

    • \Users\Admin\AppData\Roaming\mstsdt32\convInit.exe

      Filesize

      172KB

      MD5

      53bc4c84b39672dda4d5a8b9b1dd7cc7

      SHA1

      627c774ff3513511df5cc760b1bcd2b8e8a93a4d

      SHA256

      e3f87a48c946c9b132d9d7e6ef5aa426f622ebf4270c026763e1aa77c216fb95

      SHA512

      bdbe58e988012ba03a51926436d581292ccf4de0de83dadf063cc552516c6f04bf74a89247f312d8f1faff557b5ae3a69864f4021083406eb5900bde16e060c0

    • memory/284-72-0x0000000071FA1000-0x0000000071FA4000-memory.dmp

      Filesize

      12KB

    • memory/284-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/284-83-0x0000000070A0D000-0x0000000070A18000-memory.dmp

      Filesize

      44KB

    • memory/284-71-0x0000000000000000-mapping.dmp

    • memory/284-77-0x0000000070A0D000-0x0000000070A18000-memory.dmp

      Filesize

      44KB

    • memory/284-79-0x0000000070A0D000-0x0000000070A18000-memory.dmp

      Filesize

      44KB

    • memory/284-74-0x000000006FA21000-0x000000006FA23000-memory.dmp

      Filesize

      8KB

    • memory/284-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/328-81-0x000007FEFB651000-0x000007FEFB653000-memory.dmp

      Filesize

      8KB

    • memory/328-80-0x0000000000000000-mapping.dmp

    • memory/468-73-0x0000000000070000-0x00000000000B2000-memory.dmp

      Filesize

      264KB

    • memory/840-58-0x0000000000000000-mapping.dmp

    • memory/1212-67-0x0000000002B70000-0x0000000002BB1000-memory.dmp

      Filesize

      260KB

    • memory/1212-65-0x0000000002B70000-0x0000000002BB1000-memory.dmp

      Filesize

      260KB

    • memory/1308-55-0x00000000002E0000-0x0000000000322000-memory.dmp

      Filesize

      264KB

    • memory/1308-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

      Filesize

      8KB

    • memory/1844-63-0x0000000000000000-mapping.dmp