d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d

General

Target

d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe
Size

110KB
MD5

0fedf6d4ac56efea2dae502e79b75adb
SHA1

cb6f4fd267aba0ea65b40bbe6058d4b79e5dc61b
SHA256

d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d
SHA512

f4d5148dec878870495768ba68937d4180f0164b2c071029af2367c30b63538f5911dbc06122000c42cad0cb4e90f0d0febe40ed00587919bad2b53002d19d57
SSDEEP

1536:1EK4J6IlF7N6onUGm9WIZrODafgGiaeQEQtbIGOB/YRufD4nWerGX0FS2Q/cC:CT1rN6oUGQSaY6EQhIGOVqeD4WLHEC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4940 set thread context of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1236	WINWORD.EXE
1236	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE
1236	WINWORD.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 4940 wrote to memory of 2232	4940	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	81
PID 2232 wrote to memory of 1236	2232	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	82
PID 2232 wrote to memory of 1236	2232	d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe	82

C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe
"C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe
  "C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.rtf" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d435ff429deac13b99705215a5081c9111895fe7babf91b422c78f73ef7da83d.rtf

Filesize
3KB

MD5
284850baa4906da63dd3c4d6b835fb03

SHA1
d2929834b25db5f679a5f7026c5da6cec153f7ce

SHA256
e9cb60622d4f5228466f5fb9bf06a5da1668097c6bdcb9088cb6040372845492

SHA512
234e855adea91e902bfc1d407bd95498c7a84e55ed077171291957e5940c69b0ef6a35a40e8e60eb4709f029fcec0f75ef65f92e4505ce69bc7239736042a6e0

Download Submit
memory/1236-144-0x00007FFBC7A10000-0x00007FFBC7A20000-memory.dmp

Filesize
64KB

Download
memory/1236-145-0x00007FFBC7A10000-0x00007FFBC7A20000-memory.dmp

Filesize
64KB

Download
memory/1236-142-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-140-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-143-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-138-0x0000000000000000-mapping.dmp

Download
memory/1236-139-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-141-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-151-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-150-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-149-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/1236-148-0x00007FFBCA370000-0x00007FFBCA380000-memory.dmp

Filesize
64KB

Download
memory/2232-135-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2232-133-0x0000000000000000-mapping.dmp

Download
memory/2232-136-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/2232-134-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/4940-132-0x0000000074740000-0x0000000074CF1000-memory.dmp

Filesize
5.7MB

Download
memory/4940-137-0x0000000074740000-0x0000000074CF1000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads