54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9

General

Target

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
Size

706KB
MD5

95138cc71fb416c74dc3968872b6b330
SHA1

14479f3244675e1ab9b529dfce6f20fd7819b226
SHA256

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9
SHA512

4eddba4ab533d68cf5cc653f67b9ecde489314c400da681081c4357041d1bb0f362bd273d6d5f10f5dc282b7965f8f92ef284ba18bb8611969aefd92afb2cdcd
SSDEEP

12288:gp/iN/mlVdtvrYeyZJf7kPK+iqBZn+D73iKHeGspFjOzQs4xa:gpQ/6trYlvYPK+lqD73TeGsph0Qsd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

ScrBlaze.scrScrBlaze.scr

pid process

1156 ScrBlaze.scr
1572 ScrBlaze.scr

pid	process
1156	ScrBlaze.scr
1572	ScrBlaze.scr

Drops file in Windows directory 7 IoCs

Processes:

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exeScrBlaze.scrScrBlaze.scr

description	ioc	process
File opened for modification	C:\Windows\s18273659	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
File created	C:\Windows\ScrBlaze.scr	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
File created	C:\Windows\s18273659	ScrBlaze.scr
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr
File created	C:\Windows\s18273659	ScrBlaze.scr
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr
File created	C:\Windows\s18273659	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\ScrBlaze.scr"	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

ScrBlaze.scrScrBlaze.scr

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	ScrBlaze.scr
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ScrBlaze.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ScrBlaze.scr
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	ScrBlaze.scr

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

ScrBlaze.scr

pid process

1156 ScrBlaze.scr

pid	process
1156	ScrBlaze.scr

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	2008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2008	AUDIODG.EXE
Token: 33	2008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2008	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exeScrBlaze.scrScrBlaze.scr

pid	process
1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
1156	ScrBlaze.scr
1156	ScrBlaze.scr
1572	ScrBlaze.scr
1572	ScrBlaze.scr

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe

description	pid	process	target process
PID 1780 wrote to memory of 1156	1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe	ScrBlaze.scr
PID 1780 wrote to memory of 1156	1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe	ScrBlaze.scr
PID 1780 wrote to memory of 1156	1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe	ScrBlaze.scr
PID 1780 wrote to memory of 1156	1780	54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe	ScrBlaze.scr

C:\Users\Admin\AppData\Local\Temp\54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe
"C:\Users\Admin\AppData\Local\Temp\54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9.exe"
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\ScrBlaze.scr
"C:\Windows\ScrBlaze.scr" /S
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1156

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\ScrBlaze.scr
C:\Windows\ScrBlaze.scr /s
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6WCURN25.txt

Filesize
74B

MD5
154e4cd55dd5bf787954a510a4e05a9f

SHA1
c8883055440574e47c28319f1ffde92fbd60f1f9

SHA256
bc22b388483b581957f912bf120aaa8b477a7006da2cec1120fc9972828e1a88

SHA512
41170b204ff5b400cb2a167c43546686d51aa685d79a316804fb25a67947ba8939d8599b3e6df4cb659a8fc2ec249b0403d9fa340dbddfcb02bc0cb3f8ddd2f1

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
95138cc71fb416c74dc3968872b6b330

SHA1
14479f3244675e1ab9b529dfce6f20fd7819b226

SHA256
54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9

SHA512
4eddba4ab533d68cf5cc653f67b9ecde489314c400da681081c4357041d1bb0f362bd273d6d5f10f5dc282b7965f8f92ef284ba18bb8611969aefd92afb2cdcd

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
95138cc71fb416c74dc3968872b6b330

SHA1
14479f3244675e1ab9b529dfce6f20fd7819b226

SHA256
54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9

SHA512
4eddba4ab533d68cf5cc653f67b9ecde489314c400da681081c4357041d1bb0f362bd273d6d5f10f5dc282b7965f8f92ef284ba18bb8611969aefd92afb2cdcd

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
95138cc71fb416c74dc3968872b6b330

SHA1
14479f3244675e1ab9b529dfce6f20fd7819b226

SHA256
54ef004ad35db69c9645bc11842f427cdc12f5217fd13b2a97c060c5073d7ff9

SHA512
4eddba4ab533d68cf5cc653f67b9ecde489314c400da681081c4357041d1bb0f362bd273d6d5f10f5dc282b7965f8f92ef284ba18bb8611969aefd92afb2cdcd

Download Submit
C:\Windows\s18273659

Filesize
835B

MD5
836d29c1fe283a64ad10a9ca56bc39f0

SHA1
d6adf6a8dcb4010de5ff1ab44f1ee299338cba9a

SHA256
ed44570fa7da88a11b0395cf4531540b90d0c3633808252e89b826a1886136ba

SHA512
917f52bb10d76c1bac34d72d119479441cbc2f931a9e06833f015578c296adb0a4950a3065c22279d28e8cf1ada2662bb79e2e2aedbfa1af5d824b1dca0c7058

Download Submit
memory/1156-55-0x0000000000000000-mapping.dmp

Download
memory/1780-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads