cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4

Analysis

max time kernel
170s
max time network
204s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
Size

706KB
MD5

317aacbb0cb342ff4e081c7e3f9a069c
SHA1

e9d29a309d1dc6b7760f40bcd1429c7caaf80e98
SHA256

cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4
SHA512

fe11689f314d6a6f86b2543dc1642c5cb3665740ddd66d371f010b3ac9f0c02c83085d1c05e4852c4aa42a36872b07ded8363220d84090d453a86a4df5158f26
SSDEEP

12288:gp/iN/mlVdtvrYeyZJf7kPK+iqBZn+D73iKHeGsp8rCSP4MsNShs9fMQL1aa:gpQ/6trYlvYPK+lqD73TeGsp8rJP4Msn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1332	ScrBlaze.scr

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\s18273659	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
File opened for modification	C:\Windows\s18273659	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
File created	C:\Windows\ScrBlaze.scr	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
File created	C:\Windows\s18273659	ScrBlaze.scr
File opened for modification	C:\Windows\s18273659	ScrBlaze.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\ScrBlaze.scr"	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	ScrBlaze.scr

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
1332	ScrBlaze.scr
1332	ScrBlaze.scr

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1332	956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe	30
PID 956 wrote to memory of 1332	956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe	30
PID 956 wrote to memory of 1332	956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe	30
PID 956 wrote to memory of 1332	956	cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe	30

C:\Users\Admin\AppData\Local\Temp\cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe
"C:\Users\Admin\AppData\Local\Temp\cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4.exe"
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\ScrBlaze.scr
  "C:\Windows\ScrBlaze.scr" /S
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LAYPE7KH.txt

Filesize
74B

MD5
922ddf49889054bcc74d7efa63aa4db8

SHA1
1edf4cdddcdcdf06de184bfdbfebc633178a774f

SHA256
7579e6b8de2d50fde39b9977e56b20bb4dd073658dc3e7879a092814f549b77d

SHA512
a39897dfc2cbb7f4b3b211ea5f6fc31cd7d09b5657975f35d66ab6d029f0819ae091d422c6bf40ac158ec002e899f0e6dbe766d021d67f9ed8d749daf033fc4f

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
317aacbb0cb342ff4e081c7e3f9a069c

SHA1
e9d29a309d1dc6b7760f40bcd1429c7caaf80e98

SHA256
cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4

SHA512
fe11689f314d6a6f86b2543dc1642c5cb3665740ddd66d371f010b3ac9f0c02c83085d1c05e4852c4aa42a36872b07ded8363220d84090d453a86a4df5158f26

Download Submit
C:\Windows\ScrBlaze.scr

Filesize
706KB

MD5
317aacbb0cb342ff4e081c7e3f9a069c

SHA1
e9d29a309d1dc6b7760f40bcd1429c7caaf80e98

SHA256
cc6c941a470e14efea8b4acb2f11ce856f1d51beb42d80b801211d85e5da49c4

SHA512
fe11689f314d6a6f86b2543dc1642c5cb3665740ddd66d371f010b3ac9f0c02c83085d1c05e4852c4aa42a36872b07ded8363220d84090d453a86a4df5158f26

Download Submit
C:\Windows\s18273659

Filesize
885B

MD5
8811091b8914459d0228fecb95d7c4da

SHA1
f5fa391b7cb7bffff716409f1b79209c78d7fc26

SHA256
97f6defebdc03b26da3013da1e30d82b3319084804147ff3029847313b404365

SHA512
24f8eca968ca243ff95a697cd83010c8dffb4f07e60f45651b1c1e0d490d451331caa6f0ef8a7bf961ed796b064bc4ad61d5a8dbe56c8f9ae44f50539758b855

Download Submit
memory/956-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download