cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37

General

Target

cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe
Size

114KB
MD5

894299a4ee283ebbc94cbb5c9a5bbbbc
SHA1

e7abdb75bcab9f56176666caf7cfdeb3adcbd5d0
SHA256

cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37
SHA512

98504bc08bbe07211f865fcb93044c839464ec2e0bd09ee542f6f5c6fd408f44d6f3fd720ff0ff73a3bf4777bdd6a8d64b3062656e27d6155efd25412a2e5420
SSDEEP

3072:6mi+/dgy5Ef8doutaZZYCajVJ4x+xI+fCBqfMa9:6tSEf+oSaR6PY+xI+fCBEt9

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1688	osk.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4564-132-0x0000000011000000-0x000000001102F000-memory.dmp	upx
behavioral2/files/0x0007000000022e1d-137.dat	upx
behavioral2/files/0x0007000000022e1d-138.dat	upx
behavioral2/memory/1688-139-0x0000000011000000-0x000000001102F000-memory.dmp	upx
behavioral2/memory/1688-142-0x0000000011000000-0x000000001102F000-memory.dmp	upx
behavioral2/memory/4564-144-0x0000000011000000-0x000000001102F000-memory.dmp	upx
behavioral2/memory/1688-145-0x0000000011000000-0x000000001102F000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WINWORD.EXE	osk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1688	osk.exe
1688	osk.exe
1688	osk.exe
1688	osk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe
1688	osk.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 5020	4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe	81
PID 4564 wrote to memory of 5020	4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe	81
PID 4564 wrote to memory of 1688	4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe	82
PID 4564 wrote to memory of 1688	4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe	82
PID 4564 wrote to memory of 1688	4564	cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe	82

C:\Users\Admin\AppData\Local\Temp\cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe
"C:\Users\Admin\AppData\Local\Temp\cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\Temp\_$Cf\cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37 .doc" /o ""
  2⤵
  PID:5020
- C:\Windows\Temp\_$Cf\osk.exe
  "C:\Windows\Temp\_$Cf\osk.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\_$Cf\cb86bb8954bea2dc3f8079135955ca97aa2cb9c2f40cc55502d046142deaef37 .doc

Filesize
55KB

MD5
e80da7a41f0d2526897405eb76c632eb

SHA1
bd4fc2724d38db714c12a5a6c78c62b5c3b9d295

SHA256
349344e4b9dc479212c8e1a4ee48a6a06c2c5a9bced9989536bb1b645b7c726d

SHA512
6bd8a5d6ea7828f7818007e8c39824ec31e2a7518364bd1ae796e00d465d5e35a2583f5072926dc6171ff1b3662304ffc757a429775652ee98f0d6a5074f8d4f

Download Submit
C:\Windows\Temp\_$Cf\osk.exe

Filesize
74KB

MD5
862a96836fe55f230039047fc1897b6f

SHA1
56a56c039d90714cefe7d2e7bb02e13c2b04764c

SHA256
0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

SHA512
d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

Download Submit
C:\Windows\Temp\_$Cf\osk.exe

Filesize
74KB

MD5
862a96836fe55f230039047fc1897b6f

SHA1
56a56c039d90714cefe7d2e7bb02e13c2b04764c

SHA256
0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

SHA512
d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

Download Submit
memory/1688-142-0x0000000011000000-0x000000001102F000-memory.dmp

Filesize
188KB

Download
memory/1688-136-0x0000000000000000-mapping.dmp

Download
memory/1688-139-0x0000000011000000-0x000000001102F000-memory.dmp

Filesize
188KB

Download
memory/1688-145-0x0000000011000000-0x000000001102F000-memory.dmp

Filesize
188KB

Download
memory/4564-132-0x0000000011000000-0x000000001102F000-memory.dmp

Filesize
188KB

Download
memory/4564-144-0x0000000011000000-0x000000001102F000-memory.dmp

Filesize
188KB

Download
memory/5020-135-0x0000000000000000-mapping.dmp

Download
memory/5020-146-0x00007FFD1D890000-0x00007FFD1D8A0000-memory.dmp

Filesize
64KB

Download
memory/5020-147-0x00007FFD1D890000-0x00007FFD1D8A0000-memory.dmp

Filesize
64KB

Download
memory/5020-148-0x00007FFD1D890000-0x00007FFD1D8A0000-memory.dmp

Filesize
64KB

Download
memory/5020-149-0x00007FFD1D890000-0x00007FFD1D8A0000-memory.dmp

Filesize
64KB

Download
memory/5020-150-0x00007FFD1D890000-0x00007FFD1D8A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing