8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc

General

Target

8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
Size

96KB
MD5

31fd9f8b733ef7e42bbd4124fc12afeb
SHA1

139b3f36ec31d1d658a1fd30f6dae86039e04144
SHA256

8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc
SHA512

272a7ad4d700b44f4ad8efe2ba7ed2a65933fd299ae37c96945831e2fec4f7c0c3bffe2d0cce9c647032e8fe482c580e560af937ed1dccb6f3b4ff51ad16efef
SSDEEP

768:TGLqfmaiMLLfxKVHyqqLPQOoIXI0y2CS1OjiR8YwtiCFdRAg5JcJ+WHv1LCbcU19:TqqOMLw9IXFCS1L0TcAgvl0z1VIEf7

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\export\services.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File created	C:\Windows\SysWOW64\export\services.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File created	C:\Windows\SysWOW64\normal.dot	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File opened for modification	C:\Windows\SysWOW64\normal.dot	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\aaa.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File created	C:\Windows\bbb.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File opened for modification	C:\Windows\bbb.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
File created	C:\Windows\aaa.exe	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4188	WINWORD.EXE
4188	WINWORD.EXE

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1684	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE
4188	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4188	1684	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe	78
PID 1684 wrote to memory of 4188	1684	8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe	78

C:\Users\Admin\AppData\Local\Temp\8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe
"C:\Users\Admin\AppData\Local\Temp\8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\8d0a2a9356a96df4e237bb4f2b3e516603713d623fc198e1a46ea3392fa842cc.doc

Filesize
44KB

MD5
04a435ea5652c9d5e7ec2c99355970ae

SHA1
b51c9c96ecffa308552593c2cbf8f619644cc21d

SHA256
b32ca4fcadfc85fc949a909ec66c450e39424bb4134768051fb21b47bafd616b

SHA512
5d640f9201286ae807547fd559d67f50a2b29a5b77afd9d64deecc21c3980e54608bb534f0c317e3c7fd328e8812e8c473b82571280e8984f73e8284bc646a5c

Download Submit
memory/4188-135-0x00007FFE0DCF0000-0x00007FFE0DD00000-memory.dmp

Filesize
64KB

Download
memory/4188-136-0x00007FFE0DCF0000-0x00007FFE0DD00000-memory.dmp

Filesize
64KB

Download
memory/4188-137-0x00007FFE0DCF0000-0x00007FFE0DD00000-memory.dmp

Filesize
64KB

Download
memory/4188-138-0x00007FFE0DCF0000-0x00007FFE0DD00000-memory.dmp

Filesize
64KB

Download
memory/4188-139-0x00007FFE0DCF0000-0x00007FFE0DD00000-memory.dmp

Filesize
64KB

Download
memory/4188-140-0x00007FFE0B3E0000-0x00007FFE0B3F0000-memory.dmp

Filesize
64KB

Download
memory/4188-141-0x00007FFE0B3E0000-0x00007FFE0B3F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads