Resubmissions
27/12/2023, 08:26 UTC
231227-kcc43afbcn 325/12/2023, 05:26 UTC
231225-f47qjagae7 825/12/2023, 05:23 UTC
231225-f3jmbaffh9 125/12/2023, 02:44 UTC
231225-c79shsdhb4 125/12/2023, 02:43 UTC
231225-c7yp9acegj 124/12/2023, 13:06 UTC
231224-qcfsvacaar 124/12/2023, 13:05 UTC
231224-qbs2sacaaq 124/12/2023, 09:20 UTC
231224-lap7aabehm 324/12/2023, 08:46 UTC
231224-kprg8adhc4 5Analysis
-
max time kernel
1799s -
max time network
1768s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
-
submitted
24/12/2023, 08:46 UTC
General
-
Target
test.txt
-
Size
4B
-
MD5
098f6bcd4621d373cade4e832627b4f6
-
SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
-
SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
-
SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\test.txt1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS21.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
DNS21.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTR
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692194_136002WU93FKUBGFQ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692194_136002WU93FKUBGFQ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 399443
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 43D22A6FA761405CBA7E4BF74E3ACA20 Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:28 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692256_1WQM6RJXKTQXXQ775&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692256_1WQM6RJXKTQXXQ775&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 207140
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A98B7DB995FE422F863201D72717C627 Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:28 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692218_1C2G5NA0D2U7KB730&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692218_1C2G5NA0D2U7KB730&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 414644
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4FC31893CE7743D78392360E71B891BE Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:28 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692195_1JV8M5U9CCF462N7K&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692195_1JV8M5U9CCF462N7K&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 331750
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C12107609D0A45CE9CF07CE4069BC7BF Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:28 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692219_16RSQD6Q5T7P1QOIL&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692219_16RSQD6Q5T7P1QOIL&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 225069
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7B8B0C4E51BA4B80B60337ECD29B63D7 Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:28 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239351692257_1HIZ251INBOILWVAX&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239351692257_1HIZ251INBOILWVAX&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 412540
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B0137864ECF740A79141803F66270FBB Ref B: LON04EDGE0814 Ref C: 2023-12-24T09:13:29Z
date: Sun, 24 Dec 2023 09:13:29 GMT
-
DNS54.120.234.20.in-addr.arpaRemote address:8.8.8.8:53Request54.120.234.20.in-addr.arpaIN PTRResponse
-
DNSarc.msn.comRemote address:8.8.8.8:53Requestarc.msn.comIN AResponsearc.msn.comIN CNAMEarc.trafficmanager.netarc.trafficmanager.netIN CNAMEiris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.comiris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.comIN A20.199.58.43
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNSr.bing.comRemote address:8.8.8.8:53Requestr.bing.comIN AResponser.bing.comIN CNAMEp-static.bing.trafficmanager.netp-static.bing.trafficmanager.netIN CNAMEr.bing.com.edgekey.netr.bing.com.edgekey.netIN CNAMEe86303.dscx.akamaiedge.nete86303.dscx.akamaiedge.netIN A92.123.128.133e86303.dscx.akamaiedge.netIN A92.123.128.161e86303.dscx.akamaiedge.netIN A92.123.128.164e86303.dscx.akamaiedge.netIN A92.123.128.194e86303.dscx.akamaiedge.netIN A92.123.128.146e86303.dscx.akamaiedge.netIN A92.123.128.181
-
DNS133.128.123.92.in-addr.arpaRemote address:8.8.8.8:53Request133.128.123.92.in-addr.arpaIN PTRResponse133.128.123.92.in-addr.arpaIN PTRa92-123-128-133deploystaticakamaitechnologiescom
-
DNS222.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request222.197.79.204.in-addr.arpaIN PTRResponse
-
DNSarc.msn.comRemote address:8.8.8.8:53Requestarc.msn.comIN AResponsearc.msn.comIN CNAMEarc.trafficmanager.netarc.trafficmanager.netIN CNAMEiris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.comiris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.comIN A20.31.169.57
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
DNScxcs.microsoft.netRemote address:8.8.8.8:53Requestcxcs.microsoft.netIN AResponsecxcs.microsoft.netIN CNAMEcxcs.microsoft.net.edgekey.netcxcs.microsoft.net.edgekey.netIN CNAMEe3230.b.akamaiedge.nete3230.b.akamaiedge.netIN A2.20.38.10
-
DNS10.38.20.2.in-addr.arpaRemote address:8.8.8.8:53Request10.38.20.2.in-addr.arpaIN PTRResponse10.38.20.2.in-addr.arpaIN PTRa2-20-38-10deploystaticakamaitechnologiescom
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239351692257_1HIZ251INBOILWVAX&pid=21.2&w=1920&h=1080&c=4tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692194_136002WU93FKUBGFQ&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692256_1WQM6RJXKTQXXQ775&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692218_1C2G5NA0D2U7KB730&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692195_1JV8M5U9CCF462N7K&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692219_16RSQD6Q5T7P1QOIL&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239351692257_1HIZ251INBOILWVAX&pid=21.2&w=1920&h=1080&c=4HTTP Response
200 -
184.28.176.96:443www.bing.comtls -
184.28.176.96:443www.bing.comtls
-
51.132.193.104:443browser.pipe.aria.microsoft.comtls
-
92.123.128.133:443r.bing.comtls
-
92.123.128.133:443r.bing.comtls
-
92.123.128.133:443r.bing.comtls
-
92.123.128.133:443r.bing.comtls
-
92.123.128.133:443r.bing.comtls
-
92.123.128.133:443r.bing.comtls
-
51.132.193.104:443browser.pipe.aria.microsoft.comtls
-
2.20.38.10:443cxcs.microsoft.nettls
-
92.123.128.146:443www.bing.comtls
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
21.236.111.52.in-addr.arpa
DNS Request
21.236.111.52.in-addr.arpa
-
8.8.8.8:5354.120.234.20.in-addr.arpadns
DNS Request
54.120.234.20.in-addr.arpa
DNS Request
arc.msn.com
DNS Response
20.199.58.43
DNS Request
43.58.199.20.in-addr.arpa
DNS Request
r.bing.com
DNS Response
92.123.128.13392.123.128.16192.123.128.16492.123.128.19492.123.128.14692.123.128.181
DNS Request
133.128.123.92.in-addr.arpa
-
8.8.8.8:53222.197.79.204.in-addr.arpadns
DNS Request
222.197.79.204.in-addr.arpa
DNS Request
arc.msn.com
DNS Response
20.31.169.57
DNS Request
57.169.31.20.in-addr.arpa
DNS Request
cxcs.microsoft.net
DNS Response
2.20.38.10
DNS Request
10.38.20.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB